From a5040450fdc77fb38df1205b65ff6514593f95c9 Mon Sep 17 00:00:00 2001 From: oferinbar Date: Tue, 13 Oct 2026 17:13:06 +0300 Subject: [PATCH] Update CiscoASA to 3.1.3 with content provenance Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5d48e2ad-f67d-4314-b990-7eb2db60a695 --- .../CiscoASA/Data/Solution_Cisco asa.json | 13 +- Solutions/CiscoASA/Package/3.1.3.zip | Bin 0 -> 53047 bytes .../CiscoASA/Package/createUiDefinition.json | 50 +- Solutions/CiscoASA/Package/mainTemplate.json | 782 ++++++++++++++++-- .../CiscoASA/Package/testParameters.json | 35 + Solutions/CiscoASA/ReleaseNotes.md | 4 + Solutions/CiscoASA/SolutionMetadata.json | 36 +- .../CiscoASA-AvgAttackDetectRateIncrease.yaml | 154 ++++ .../CiscoASA-PossibleDataExfiltration.yaml | 115 +++ .../CiscoASA-ThreatDetectionMessage.yaml | 118 +++ 10 files changed, 1228 insertions(+), 79 deletions(-) create mode 100644 Solutions/CiscoASA/Package/3.1.3.zip create mode 100644 Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml create mode 100644 Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml create mode 100644 Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml diff --git a/Solutions/CiscoASA/Data/Solution_Cisco asa.json b/Solutions/CiscoASA/Data/Solution_Cisco asa.json index dc6f6364732..125dcfdf423 100644 --- a/Solutions/CiscoASA/Data/Solution_Cisco asa.json +++ b/Solutions/CiscoASA/Data/Solution_Cisco asa.json @@ -20,9 +20,14 @@ "Solutions/CiscoASA/Analytic Rules/CiscoASA-PossibleDataExfiltration.yaml", "Solutions/CiscoASA/Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml" ], + "XDR Detections": [ + "XDR Detections/CiscoASA-ThreatDetectionMessage.yaml", + "XDR Detections/CiscoASA-PossibleDataExfiltration.yaml", + "XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml" + ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\", - "Version": "3.0.9", "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false -} \ No newline at end of file + "TemplateSpec": false, + "Is1PConnector": false, + "Version": "3.1.3" +} diff --git a/Solutions/CiscoASA/Package/3.1.3.zip b/Solutions/CiscoASA/Package/3.1.3.zip new file mode 100644 index 0000000000000000000000000000000000000000..9bb713c51163376f5ec8643502611a679a70c4c5 GIT binary patch literal 53047 zcmV)JK)b(CO9KQH0000802zi&UGW(pYOM_b0A@A-02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?OJRBD`aTuhEMGK)XFIK~;5+;S!3SCz2*$0Gix zQSwiNF>RGInF`dj)hnK8Wz@{ZhmLfIfL}XDZMc%OwzrjkTQbcGw5ZMC0DgT005C|D zobjyr4KU#5C;pD(g<7{ z%Y>jO^xh~@(TNU#X#Mx!|AE&|ioKU`{u(`P+RD5ch6DSMTb%cYMR)>0!&nVzG$b%{dt)6O?bcoRnInRbq*`q|)3j zCoE;9<#UX}lZch2;7leMF~cHK^aay6;WEXmIJbouwc?*C4UIiOkS?HPQ-KDSsv`Ee z%+S~ln;=wXuH$u5nTbs&sY<%68a6RYBUCn-zODaLpfM~%6A5lCrqOg68Jwd#h`>3D znqw}l+Q4Z{%B4wF8{Q`0oE^iQGdO&8xVsAxoYCE+%rZ!nl$cnhAxBXf;Icj%-D3Z6 ze#51zG`v(997-mZmL~>&Qu@-AEJ3JDP<4q5aQX?al;lMJFeCefm&mk)g07uSRb@Nd z-S{<}ld85t7DOv98s|l#cD}Ju)Jc85D8X683O0&?WOE_EoRqae{~%M;Vo6)K!aTzy zmrAINqk+m`da%3eRg;@mRV=$i0}N6uQKl%9CD7BJC$Jq#V_-4`qY4Byqjd(`Z)qpw zHb)(7kxMu~@qV^riOxay&upr)RN77iW=u?K*BsGP;Q|H|kwsmY$q0;P7C~t!$hm<= zQwh2QU}@?i1ry;$l%#d4M9u0Ki89t4ILEB)wGzFLloDs0m>)P_I^%+HBTSdAkPO(ISwK1qxh9h5>-y;6&JG62(_q>q zoha#D7!g0u9E8Sf@fb5Y9gd- zhE}~)3)Jm?w)#?WgpSK{M;*3?oIz_5Qx4M0+ z?Vg@f-wk<12oj(v8bZRf=9rQ{v^}gjti|^?E>q|+=RhU5rvLN|i&7BQ)0lBG2%p@r z1V{1KD0Hp30}gs*ho)f<%E+CtOmI?MZ`J-4v9GY}2&_D7bsk={ zUWk0qhNyP{Q)P3w{?loN-i;Q2YN3!hX#bTqj16~!&Vz+vzh4rdni zwrcvA7@6^mDmkR`UY%;?=<_*Ub}DmO#ZyvH;=z|W+UP+Aw4NSyHR*O9s()>f;PP_+ zqh1^Bu;F=EdDkjVHG?D$C#u@_tnBKDRGN3YQn#jk|evDEk@6Fd#&AriH*$N%|kRi{l>n* ztoeq($+tZ@BNCm3_NzHZEGWjky`uxNxR7U3via&Y6H_vl&mufO9&uZ#;#yZBNI< zbxW%;7f%9BXA7HCDYd5LGcp2=d`7t6RHoz!SCs*3L76di%d{Cosg+fU68?)9C)8ll zXbjSx0U@{sULA_8M#7nl#OQi%K1Fb0sXh**T-S{pf1*@V?a);b8=vAC_XWASzeQU< zXNC((?Fk73vz8^7hEjYdP^B{_`8%IePM1(?K8doOyXeSm45mtQU=E(T=ulS?q-%w7 zX;vJ}s(q~gesk~O*Yp`S2EPW97sv4V zlPCLo`;q(e^g@Obm^pw4m=N-R%wOCf(1kok%eZjCELRJ{-Lp!&>Ydf9qN$}^DLdhE zPGcPzvv?C1VW4DqHsXHgg3`cz#7_qecK*tA!tCUynbHefiT6wxcQ|XTsw#?4H;e z9&-o`HH`_?E!r0+U_7J)!E}be3RU@HqpIvwRSmlHz|DV;b_{4rOgIzN4Gva4SE4GA z3WA1blFxX;T>B*FnbY)~IIsq!(ghPR#hlH#((!MlXiq+hqOmz@^4K1)cFV+s5x69< zVDMp8?a8N6HJ^tNo^PrKbX;AK$L6z+TTh+4^>yWnruQI6Hs_QucriI;s1-p`=gm#z zFk>Mnuuqc}m4|C?R*oG0XYQ40W5G6`zDLe{h8n4~{eN%%0N(sgxlYsE-I(h%qk0dJ z>ulQTgL0jX%-t>5X?XfwOm*o#YtWS7SKr^xtJljlxn% zgD^b({_ypvTc@}wYx2Xi&V5YXP_0l)Ol$YhFdEul%{)o_#@|P+G#`DBx~W+A1Pg1cSF4?C{@|A>W!4O<8@JI znsjhJY5VRU6KYIARH?7iuB;!3tI`hPuzF17E*UN#2NnykvICDYg#jA=|` zr*n7*QUGCuB-GG&ojl|Izi)Y-h`uh)x3jCMC z_Tdl&zEFX_s!Gb2a9DqGF$4nW!66jX3-G4N@PZYG#yce(jnL^(Bp!;;VGc^XIK$;0 z;85a$3NKz2QTRvT9JkMkf(iw-31tO|0`7*sh~WR}uZK_t98hupfB!*I6cqrP+81S9 z@D8!EsEA#a3Q>wCNusR&H8h{$(U2xcA4A-|f-BWUUQ>}MP^vK)sw>J=1}Ut_)S18^ z6!n92ECCq|p$cVX-Zd|>0N1siP*gyjNf5WIs4^0IMvr*lNGL&}r}hJ1DB60;!7k8v zwF!8Q)cPhvMbu;#Udy5;ot$2nU3|B-w9EpdC54rdWDF-z7F9}9Aa_o6G?fw{ zA|(Mup@2LLsp^1Ip`ud%Q!=^;)%&8xbD^@RhOS`f2FM&Ma*+F<3yNw%3JHn|0f$?q z)IOyCXClf2MFK1gnS=ZvYSKq+pF#@7K^cu9M|EX!NQ##j%Bq05ihq8Pe+hpnDzMs~ z7rriYa7#XYV?}`l>PfH$dqfIEN|#ScF$Ke%5`_wdCUTHR@Kl`b!|w#>dL0St9HFNr;h5dc3^5vx#>K9nIfSED)(E9BZ>n$gxlR^(ulfIAqs2U295D1{U&`_^335m4?as~+u}h@;~gpJh$8Pg zepS}sb_3LVCBt)IH!wy+$r=w8iUqQaAV+m@1w0j|WS(SnV_8H3M=g**0fD2Csw_S= z?JXt49#T|Um)$O4;pxRX?o@a%BOH8J#z;o5YZ!p3#6^LoibI_mpeRsP@Y5OAWGHYH z=9Ec-$%1o=!9FUl2}Etru_hpvkt8LfDXKWkh=KrFRg_OJsE0mOAO&Pd32+Q$O6em> zf*geey#pwy{EQO23!~OYpg?&H*YXxC<@@v2LFi01p$rdfiI5>=)Q#3z6dZ4IX%a}< zGygEBVZGdCfeNgNcwYwLvX~Qk-|ixKPN`xKs(mO^6QuTWT_jUxZ-izRsDKxH6ckh$ zL1mFU3nZRXHN)2|JSMH+Cl51e1IKjX%|cc8MqBf&3wULBrnR%RkN{LPh7?N%LUHCu zY+lq*S|qzl))J4Fh$0OvJ)6rDRhVlf)=3BZ{)Os@YM&Y)fx{CkP#tJEaDtKa>AawF zQ>3U!=vn4Cgv~L*K|mmcV2dEC6o(Yh;UPzfG9|;IIELH>mB~_2upV1Q6cwnNf*mSW zGg;)xLjzRsGZQZn1ZBcxN|_*)?JrNf1x?35M!0nwGKE8cc;b22;oujm*f*<{TsqJ$Kdf0yfYdyPz*(W&!hkfy1xJ;y^LXj=od~nSX}Nq9GP{0u->) ziQb5P!1Fh@QJdz>7!$3pB!Ljntz`YJGQitWAOAm7@iNK4p~h`>dYEW@O)G4(4-Rz zo@)XcX;6o1C$@3FI1b!4bcX`VQ{>dd0_kKdru8$X*v{s;{N77Yw-SK2NVJeGX1NQQ z4&yaET}2i-jkShta7zUPxWERxn4Kpgm~X-J;G`2Izfd~+>N@+3He9Qds-~Ff4Q%4L z-irfIO$lF|6b)rWp^JKUxn>l=4CflPRKz}CwpX@^;_P0@L2s7YUsK%PmrF6Xe$5u( zRD}X2d@eO7&Wh#Oa{lUGa2sW+ZeD= zXwgoa@tzen9YSR}c4w7cz-6m?>q_>D@;cJK$R5+p+7YnBLz7L8#qHv>QotrprU>PR zk~(8#8O%s+9G5!@e*11K+2MgOAd$0gGL(40!joVpcuwj6u@y8ILQ507{MyNkIFaXE z-cH|Y35U`A6kXxh>Wb627u>5^;1IIU?=JgpE96x*aH42M1D55(S@=T?#}z87ScWR* z>3!!FvMLFV+Qnr}sb%$8-=LGexYux(_UI;Qk8U}9=LXh_f7D@kW<6&|NoJV1#x5^T zmRy=s`ZmS@#oToywn;}~UPk9!Ypr6$92FyWFvW;@QHw5f|VO0}-4yQ0N6DO!A2%A8wT zt9)@s<%=Io`Ql!bFa80QFYZzK;vZJ|;+vIkiAXcDO5}^69@-wVw!dCpADY2M%qn|1 zgIxwXPNfr&>qfZ{+l|3cJkd#nF5`)4s0)*98YV&FGHOcmQh)1XeJk?7@K9Fmdu&)v zgI>Cy>%-Cre#%k>$jd_Ok%;-My3EL4%N8K-EWit)f4voNBvuQ~@jFZ=s&PkFVSd7B9%-pTF~CN*-Vbphwzq zoBw&*-*<~FNfsq2tH`!r@03@e=fqjrGkSK3nZPyH=Zvy%vy(=K09nZp3(X%tb=T@= zHHFtnX6A9<`IPJYS;(~gvG8so)nW0~s^*wKb|$!J((2y*!k9KHfYY9Xt?G^%VAaQ| zDkPhu4`j%#zF*N|IuyAKMdmJcE+0-QJ#Hd+4UmBIT?lI^B&Z@a6E!0{8YgQ~T_nQ^ z;CTfnMiJ-phBIbV8FagdJ*VIp=UJbVlpV7yg~eab^SO8y9&oOUm3yW)0To*pY9GfV zjF$AIG@RRmx;U3g(G&@>NYoSxr@1KSI6YZb&M8S2Rgo2Wy+)xz0gjWQqCni|qo|R* zA07f(pg>2|R7#bxt)T#x2!*slYLYB2gB*%OvYu{aP{hfI=P6E{U@oa5$$`=b-bK6$ zaW;^m@ha{z2NcBPj6|HUL;+O=>_EYpiG-n|+yer7)6?oYGioRbNENX&qUNe;-Zm*3XLE&QpG!WEQ9WKp6oZ zy+ICdo8mV9ehwIx>pAe{87HYj+)9|fh&%_*p94sRL*+T}<=fxSL`k0mU+D8^)1W*D zzWn_hzy^oZ{>MM&QWDNTWS;{+&Yy{vlGiGn;)4KD{CM76dbv6Kc#0#wViH+U;m{h_ zNQ3f>6d`}kIbno~9$wWGd9T>?T9;PAn1vAlePVMCvjExO6IZ2}uKj!kLVkW2jntuv)7$XN zzn=qo0vtALBp1-6Y@v;qQGfY)+T}TY>GC3$bgL1MyS$0VqAqVPlWukBRMc$*(L~y< zy<{ZrR*Q~C(r!bK#%b3kt==5oCFskz+dJE&eLsH=0G<~o`tGYS;Xgc&O@7;4Af>(q}KE4~P1HzEZ)Z_s`GIfxj2z^9zp+`49Yp z`udd=z~Y1d6y-%xrjS6LEY|*U`cJ(BOtIOOq78>YMsJYP8T6H6@xLdhm{oN&lz5ED zIQv-5s;?pvNVYZgl|q65W$I+!GWEZxAsFBcV3HjFfMJ-eaU(yS`btGGTEen>4FxPC z=HarxEqVT;s6bYK;4@sdhfv^tP>KpA`@^0LknqEO=*BeRF4xm0$s!J)g}?;3wMCyV z4%@6sma&{mC58IBp=V7XM=gwj65+Hs>ONUk5u^9l0i01^DcX8&P1e^BHC1loKE++( zKb8wPGmrX81sR?Xp08nh@Xw&ZCQDgGnS(Nx7M-1VnPk4gktT}P&4_~DOw$9Wcs-Iw zkmoRfCbq?8J_A;9%TCX$7{?M^Dr9Y^H|9>ldi@~grYz*=p5{3)Mhfa+15LbyYMAPr zu}s5@xOpER*3n?+ixds7El4pP?<3xLhksl2zJyX^jjlgoMP3^UcR*$Po93n~%0r;) zMA6pYbEabO+!rSWmJGx|WzPW~cGb0A5?Na9A?n?^0dYzYbk+9xHe-Qc<9AM^v zJX=d7F%m08roFQfKf5CO_Z;{_jwg}F`uU<3;#9q#SZoor>Jn`i=);18Iz9=A)Y%7s z2S4Bam&D#8KR&q6w~g24=pCq7@b0$v8(g}rBz7nc4g1b}t@E~VZ0@m_xa!SKFI1zz zPJY`ye_oumbNNI0YO`tLt;g8h!r#tYFLT&;(I3l2M#|kDx=->x!;lpDuT0 zoB9nst(0_dpmQhL6!{_iYC|I(B%Cbxuk#g$bZR&Iksa4d#+K2!B`u%P3J)RM2ePUM z)|S;Su@niOtFEtXzpb)qi`r%@e(s=p)RA;gv7?~hL;Ds9pVNH+U3~vVYj9QNAnz!u zzoEVv%g)7B*uqNYd|^|-Et+YS(m93y#JgEU0xP1dE<7ky&Z#@7D4++=sfv+4aZc5V z$m^x`-wPGXE{HM-hAgfYNpy5S9cOsnN*(#c`ix46d96GZGN+R}4J;_XWA zo)QrXg`Be>k_U3xf_Q;1)xjB(nk?(~NWnFgE!_7fF(mp+Vs$e-P?SQJ!mS2lk!XaD zSi>+v78#2rb)6$$@f*A_I|=^3_*hjkq*wexoqUUg(%=95&nX^+roi*yIel)Z-s!5( zWyU?TNigo6s3H>7la=mHi8o%1O6{qHV<>|jbeim6*y}DYHRseHNQLgelrrY*w^y1w zFg01>sxB9Qo*No-fmLQGD*DZ)J1C8V?X@McAxyAk!OEB$?Uj_NMwxvrl|?+}=X+&}(7<;{$9eEp`G;4N@u zOL&ZM=CdTj}HauG*m21<052T_kL9XyQ~9ixNy+mYdB2u`Z;QhFZ~tpEz{WdA>lXH52V|l zr6IZGbmAU^St!gfxeVszoZy4$)nS~8DN4UUaC0|@vdDk~>(N@c_1oytp*;GQhPhz+J( z6pq?X<0wxmNB!iG3>``0kPJ0X(Om1Xa24HA85P1|vxX6dnR~+^75XiLIHvTPB4kMJuNS^q=I%jbIM&2? zjo^5U)GQmbwR3hXtHMEH_S-mdcQ8zOF)joR?`$h}G!*Y)Crr=g+lkL(CtT+2(00Ot zQpB_VdX{26^w<`7c*7m@+ebc}H95rUWYLdV0^}Q&k8f1mChZ_rMeo820Ak7%DobK> zza0Wuja6^3Fdq_pPzSLTMtIgY6radYxXjrh!z}je#awQoiX0a280op#CjEkIA~XBg z>9P~AiyoW#Fj~`1i2dBM`DWF2*sB~6X&AC-T~7B2!=4h_ChF-%_Azwf7lr*hDuW&6 zA5dx zvmskd;Sm-<`n4B}Yae|x&|mr-Cz4`bH1fWy6~j}RP*>N~U*1Akm%4mbnJBaQmGmU*jf0_DsC2m0Xa~_I2MoKqaDWBj_|zM&yBRYi8GJdcHLJXzHQREA z4`6r9uwn^+R1ja?0*8{SPq4g9%8hSjgN_?^rSO~)d1V#VxOqV{#! z>gW}S)gj-QEL5nk*yf!6*G5ybVq>gcR&9(~{1DcqB=+#9CC#~4MM|(uz5b<4ed>uY zt_Z1bYCe^z@jl%yvwcXoQ@^pWjXofZcIF`HcQQ3GIuW612ZZBra~>)Bg|N@Kc~1X^ z2R1Ym{$}}FQ$y9r6-*A8X4TNxic*JzGI-#oQ!@n7w=I?xIH*yvP2js=7>B7nrX4Ys zM8?Opsk+9pxbfd+CkVrh=<;C<4A<~iYgR3XUVaWw9I(l%y}-?_7z?wH6^mh&KJ+mz zMW5TQ#`7~f7KWVuQSjf;R#=m8NQ+@j;QOq3HqPq7wvFis#frlr5V-d+5LnZRjljSB zTr+`N!_kn)rF|^c#nyx+xhZ5d6>@W%fy)xJkqGIPzv%10;KiT+2~yA~PpN%K1xZvT zXtMVLS6z=mR@2j$#xcLn!kD^+&wd>ysn+OHp{!0t!3zEThUR2x3Jz*j-p`_Jm{sx> zYmAm3;85a$3JdzDs}yW_1jvVUrNs^Zm%{ep5Rlh>Rh5)4;cySBeXVoBio@`oIa^^y zl6WI56Dk5p{pd*R{CEVe~PIw3u70O|~NivuC<%J%8{_!jX&i|m6eoX5Y_(BEf zi-=PRU4RN4F7j;*WQ3Ecm6M<)E9U3O3taH@yHg9;*7ihshFdUs5LhbqW8v=~i>>^< zRG8Rm+?vIoi~G4W7gnV?EXm>+aZpymL#P7$O~aLe27rW`b8bW<(P$__W_(45Xt@SJQsohTBI)RQHi;}Qjq zCd~#ZWXI@-& zZry2zPez($Da%eN7tg{&A1RbMSfdH3*t$^rG6br5IUH^XaaiQK_>+~2rbviIqNeC) zIL~zea6UgxLu%NgqZiM@qo`3V5GWo3S)f1%-#cnv1&n7^F+v(RsRVz9)4ZV0x;@UI zh?5b|Q=B-#TvA2i*7SkvpYot&sA#;3yUYOv@iU5pD!xA(kb9LCY-9*SMY#tA!zyD= z4n+Z}B0dUj+f1_Y?Hog(J_QuK(b`2l!@-b2@i;82T>O&^9eW8S3neIUP+$>MzSd`o z3Wpc>9ek1Zx9@tfjDCxyC~qih=uKe=dQdS%$f2BJgTB%i^acG-iuh1n3aJpD)PGW{ zVMuF`2PzuF3Q+rc31Z#;Nhw-KuZDZoRsE}_b3ZQZ^6p@uB!DlNcQ$dBx;dLR9VxC> zeKG4AA5L^{0)K23*ETh7gOzp~pJBG#deF_Yqb0EQUl)1Jg+Vq`N0`pk8Rt@NzT!nO z8rOZqO4TKMPujvrU6kEMZH~v9Wak0FAwc}fXvkB~15q>yTMM_5s0hj)MzS(sDkI90 zsH@_J!5bs^YYyI6ap+u!N5TMCF~NjU^6>e^@w z;LGqq4;I}u-YjARLXLWDyk9gpW@T*VU2Ec(&eb-W4O14nmv&cd{-J&Y@!h$6Xd?SGpJns2g>cm{S7r2w4S1tw5DVH_K={Xf#vj{O|Mb|{! zj++|JrQy3pmdkQud6{8aOdTd0ccF_iH9>0Mf_Nqxq+%EJMa(X*Lx2QxT9(|AxsG1& zeB{Z+91&lDH%*4b|LO0Pa5O@vbrA`3L~e08vkw9-|FK}+O}%w7j|&py2Fe2S8NyU7 z_@IE**y<}&9+VX?`uCC6rFIcmAkA(votB>~dPs*Nv9&AdJHE5D2RBb99cEOyT@PmKq~KF?TLdUD7%{Qu>~- zt4)vZfIPrUSX}GDTEN;D_cp~QxswWBwBjTHs4r@b*UPa1UhFBlC72`Rx)Cfo$JMdm zP#jSD9TCX*quDH8=|f5n*-?OpWJOPw{6j1rkV3*3pYrID$-SUR@SumrP#@AzlyMOv zTefh8eRUmFC;_TiQ0(oJ>N2Gm8Z%#MQ!J1`2l3>?Ko`!u?8!jtS2ZZ>(y}EU9zs<{ z#37Lh5LLkI)>MWpL}SRgqfs9Aps+2D?f?bi!IIeB>Sl(^*2GuJ+?WWs?{!co&jF^+ zJO|FH=Rp1;`y4p6=RXNOJawY*f}`KmSEmp5&_hz=RYU@Xwe%|z1SnG{HxS5b2Zw=d znde3fQXd?HJppy6$4w}vM>cz?H6PA>nLFmiU53ug{_foCxN#1}x{9`;gun#MD0^Xg zx%Bei^cIT@=XE?7N<7?IN|*dT{v0hAtcI#sKj;aKS?5EVuzh1*(R{opu(}08%OjzW+jX0k6P6 zJcir?5|oEX|Guqz|KE6_tM=P zrl&Pj6JpF7Gl_8nwlpzJ0lOAzKkq*#&Xu@xdLC%LeKD1>yY)x1;A@qXTn z8fuD4^}!fY`Wr@O@ft$~JjquSI0_1QX~$hq-%4ad5idi&pO{e#PGps(U_A+2=>H8F zTYX`G&7-pTFhm}PjNbmEf{yZ)sofDvS`jBuuJ<9&pU;17A%PPo%IXtFX3sOFg86>_ zDRDWJlg;~ZdoH6rgarc`@_zEQ;W-CvL~#sGl2}v`6S63{7j$GKmRNtL7V>h zC#5skT{-Q;T_BMvqwk2wRZEr?d%Oe%sgBMoeij43#(28*8&djwcVYEZ?A@Tfd5{)t7H8PQk#);IV z2URL`k58{nfXqSpg}Gy1O#3chNHfYbw-&Yv zm2iEg@M16Q-raxyHyM{SQ~Njt&9z)$Z$Zw8(hS>>65-r2Y*bAXNKQ;w#9>36&0-{b z;^?12jQ;U$N#bX=^cmB@8-`7kzZ`Ls^+RN)x$SEmD>H3DEZx)77Iz8uO;TIP%K7O# zWQ*GjOB-a{?2fG6ly+@sZR*fsf`Rw^Ay4~NMiYJ#k)K4gF^Oos>9qaj=cgRT6f7sH zxLJbbOqER=g_{#p7KXP&mdaN3x3yne=c_F6?HEZbE6#nFWR;KS%w02D);HvkL$Yg1 zja%-?FNYrXHWi!D!X7BW86B)g1?$nk)+oU4M;yKW25;}#%iBA0_UaqF`4(P$8}Gff z*Zy%NEBTYMkGy9c9U@XQ(V(imYD9UYa7!~HaUu;q?>HsyLaAB@RC-tES@V{w7aE` zY}z5+jUo@(2m7XjY?lV&oW$fU?PG=WAB2G((l$J$Yivx@a7)?Sl$P-;r(>)as14~C zTj=u9(k$G8(&l4rM-NJV!1Kl!;@~sV{!!!O9W}NDgQ^(Z{&h|poATrFpz$Kw%n-C` zvB!Yg4j88kG+u3*W_N|J?nikQ72im-`rg_J^>Q;69v3Bci51cjtM%Os*Bdp~CTs=j zP{!+RDkpG~hy2M#VhOD%?Pqdm%5R zt?gnXb*{C&&zcd+L_*K{W{!iZxs~!bduuxJGJ`JF_af2@iF*;a7kS$dr(YAO#v$i$1+~+rCSG{45m}%eP+(X#O*V0`%K%GR&x_= zYf5>yn>$nJUVZD?E9?0W`d>O+bDKryqT9`;Yj<1Bs$(15>*Q)PuBz!+bW06&>uwuG zb!y`PGwyxD4=~>cm~QX0jqeWkI^CPfdYW$!9d4fR4UOzKqef z7VoLR`_81NiQI1<_nSsX0$0PDAtdlfSV$=ieltUsMCMOUFO0(Y%NfFVhi1)S**tmF zOE}A_W|aT-%{f%sf}OCwf6GW{IW+1JYI8UkW+U7R7P|yk-K)-Hx~rodt_|#3+d4}D z*~L-WW3u>X=Nk%F!|{tO+8@;4PqN1Fe~jR1e?3wMF?UZg@EK~ zy{{Ck?(sULGIanufC6W1YPcB?MStCp`Bl5PydUEEL~BO|0+$ha{qFaFbjgoXy4CU} z*}Ir!yot<;LPJKl3B3361>w(1ge9T(Pn^x3jGv?C)qQOeDPH$PhGCd;z0uD#dJMzd zvkb#zg$z?*80Kokt4}dpfN7WOwMc=Hl{lNM;s-UM+Mur(CNq7Vj4vOn4gBzy&Gnzy z3BzQSJBDFWS%&4tqib9td0TJPu9`P}n0kt&Ua#oe{3B@hM)UyKY_E!(_ICr)d(0|aj!EvF=z^@ zJ9ym@lAXM8mTPe7M5i)tM#r)yrC!g%;UtTI*6Aj>n{Kn2Za1@Gc&QA|3guQ$RjN?E z?Sh`l;$J$Cz4T)prmw(bFAeHv(<=}kq(LS+y-G&-^e97+PsmYU5v8(L$w_6UNonuuy3Y#!9uN-BvzLpNW>t#h#+!aJf&9yJyO{ z*qp^L!}p~`KOMfjycEZ&=o_lO6`N1tacUe+i)ZQaSZ=@3u}9dggu}h-1Z>ArD4}#a z4It1@YPa+F+HJPqUg_#3dmolBg?1v>hMF9el0A7E>$2Thy4$+D7SuPE7KB7XWTxG* zd`1@w-6H#%2y2h+X)_Po=yh_|t!MHN!_q@EJ58&jv^-Ej2jHj~H>+c(WzM)n}v2Pb(g3=TuCW5oRYh-S|y6q1kc5! z$aK_hzlD<{v2oXHson0dueR^5WHy?im3UswK9*XqN;^^(6>v|p)obldEH&R45G(i8 z&iz%V8qLsRDxc1R()Fv_&Rxk$GDEYIYxV81)Ozc+BITY6?h_Ahvq<_rRu<#jeS129 zntXPD6Qy4(iGtW2(W8`-lA=j1#z#Ok(&5H$*Jl!+iiS&hxin0wnl{SNdA41TDwQ@p zj?#^Gc+hUn0QY(aMsz2fNLABqz|Sr(D>rJmmP*`9qa@v^02;;94MDtb^Ji^2+P;~+ z^&dK7LA?|jQx4F1Zge$kUQJttw`4O1FTq=WbgxADMmv}1insYnJF3Dq%~$LBv;J#i zSZF=w`_1UtU50*Yq~a=|IZX~11~)x+Ce(!SwIbA}q886q8wiy(6^ycZ`ZAF`d+Syn z8;?mD2q-aojU;IKAu_q+GReseBj0l3n;^Gt+%&>2Um}| zdqL2uAfu`EQTB!|q6#cOp=7?4YE|1BOIIV@=nOt8rQ$=i1g;}YYoN-PH1ia`W$Gz# zO{>|*3eV;$MJ@+-dv^`9*W=nGSJ9#<3e@Vo43gJMtu6JGsHoJ6sfjqJjf=O}m0lvzPSDf*C^CWdhudl^Hc_rKt?ZcY58;(o zPNtOS14fOsRH%+%A+O{>e5@k=HI-CqOf=qV)UO|F zG80oC!=u4lCs&~Rold@!ZzZ~g*K`uaGG#EDc4G`0)vDK`+LN0yo1F=@YHCPpEX{yq zvwAI8qf9Z%tL>qfy-5^M>!A@B5(QLCh$Rp!SEKDoH6jkgX(v{V$dT%`Ds^h{QE!^A z7y3h5yGqx^9tY~t@mu3cxEx%SZbx_R^x&$Hj^rgUjCYIi0&LWCk7`PUjb!1b6;Z{@ zCi57Ua@83Sa`@khdfRCwM!DHpCdUu>>(bdQ$HP%(J||DtcP({NDRTMjv@DJVj;)kq z_1f9wsvN&LYb8>NiUf*ul+l`Eb*yO9TJcuMlm_b4eNMhA)yLJU(&>!Ps*jP^M6Doc z;oIEcL3@MOMOrMJ(e0}V9(%gTw<65VeN0W)>K(a|s$S7DjHI6WsX{kW6yK5waU>$T zTkTeR68HAltaqX^TTIJ9Q`^xI52LSjt$?^#HCIfjsYX&Mb?a}j>eDPqk3qT8Yo}V* z)Alq!V(4ozQdE0qSJB7J2(_vj%sxd@a;v8ZQ!$LxCfDQAkA0PGxB7{Z+Gx_WJb`t2 z+#A96O-t;u50xTU$!nzsBh-|1w$!S0WA}nG84V`G$9^8%_U>-V4RzXKu4Jysb-5|b z$c@23%iqLqZ(0qG29xX2Y&N_q-uDZYUNd^z9Hcs_`Xr57!+xjr*5|-kxSR#rW484) z$jgbzEf`K(s!&zMP7OpjlwzWt`Y2pa%sQz%m62GON=hK971e085-vP3qhYBQO+f+D z=_JSY+Gm+Fwi^@D^{_l@^NAKW?ncM$ggoQLPDQxUCTb9b1frWG#G@F^eTrSxS=X^*P%bgG22(dp%E3Q#nzbZ;Wk^h~))C8KEkdV6&? z9?R8ak{-wEY-}t?>uIese(QCT+T(1ROex)@z;|Xh*YL48NrQU-vAwt7%~io!WR%O_ zrJkZs?e6%k6jO64Hu}m>yOs6>&vs!uJZ9dQei)4=O5!12Km}Hg^=s7;BSvo?9->M0 zz7xJ`#ByNDcH_13pM?|m=?8G8$)NPc^xL=5BtOc$#)|2uR8mU~ClyXCmYDW5 zdZrXoLip(|#$AtdiRLT!_8R40<)=zB9Mj$+jZAaK-d>&YaW2s)6rb9qXjn-NglMCD z#mJ>W@1D8tW?$o_dbsl@(vSJ}w3UdntxP3Z(~3}(yLXXtMURw_;+j@K$WcX6P_4*)8?(;V}tublj`5Z5| z9>dqQGCjJ#y6&sxSoT_xK|!gih5V>hQioxB%ttQo>Q4`M>~*7-^39zQj`8HCU@G8 zy~oi_p)mkYB}Df)cB(xx>|mB=roCKy^p;3Gg)6kwX(?RzshujfZfUhMy1j|kV1b@x zuA}M$xa_IfYEhi$j@23@x?g`ObRl7-D!b%$zl9Spfa@8r67?gfw?-?<#4#F*31lRQSO{(!Wn3U<8 zX8ca9jm3Hx)P#8DPMw1CZ4=DIvt&ON&RsvGqm|SYwhHa?gM1xLU54+^3fH6B7*?;E z@m!~Nt=&w!B9d>J>!}2WvD^Cy&8DW+Su8({j`?x%HPwsulR2i;>s;M5UZra_2l>}b zrFt)kg4DUAZ(8wAtFNVDzQ(m4vTSsmQLZ$0+8D+s*CnpO_M25zi%YOwW$RC8wa3`Q z_z68dFp>LN{+ecrQSJ3I*&XE~4>#=fxW=bz^R!{;C=mJrpjVEnvB%rW%cbbc~u%QOar!Q5#04*PL}vVyTBI6LgJO>} z0m+SCqAJ(uY@aTl4JX&-)O}LD%jRyAZ~4c|*Kn^%=V4UqUdFClNNDu(a_e!_E2%j) zes|w5@dH`7vXnmdyU50&(2)a@0zH?>ABQhH6?!W*fV znkBMnrvG^P2+rQ#UR(F0q?UT@=%Os?K;&d_~$d{!zvu=kTxeU=~8 zZ$zmo*Gj`XP>&R1@ykMMI##3QjM!1iH>pITmpuLe&Kakh4iUO`Xnv}^Th0bM>x zm-ndLxqeG2HSsJFX^b;qf0Y!u2PL^{oJhA z7_#^In^E~nxxQ`IhT+>(E?0gnJ)-+oCVt-lnm}d0t`5@o%w;?Fs9rWksab8r@|pYt zeOVjJjWjGI2hG%|TYTuTWrZGAU-@{a)sr6jbgw;Ph9h`ZNq5GztoQ~~<)#ql>Rh2W zNz(bgQjPUSxxqD$)QNc3$i&_x?(C|1eHN!%$z-vS4af7fbTpc{LZw!%I1bP5-inDD zT^OMVj9Q2=^=iGw!;F{F>uaZY zuYkAwFniONW^DcGv3HkZTPUKTg4l_qs<$#z?G$?8?)FLH%W|w-z8j6`>}&0A*wJR) zTjr@HYTQH>`Pt;ES1k*P*3*y{Z%{dU->yCN8fSMYrX}9Wz0P>_RANAO%D}?Yu%N0V zIvGF94^mp4d+XL^t#&2Gvze~i=qRkz&|1oqBHu@uvD!~Gv)qVj+~t|qR_01z!tqF@ z@t6j=S-q`fW`o9L*1Q^D7Ox*+M=19?{nt@VY^FH%Ec=*#db_U9TG89+3b?ab1A+iL9iWfr%9 zzuI4ORx1o76b2+WGK|*7@O#kh+Ch^h&|7~mFhvFQEX;!7e)H>^D|Z9>xo~n=J`Yv4 zPa&ZrYWR#1X_o4dES)uX@hjB+ZRs$q!- z$obwzs~nhr_&tn|h^#M7S|!DHnx};mBkP90;r?eLkj4cG>&9!_t>w`WshbKfpAON6 z9Vp||6-b3c1s`COp{mKkKk+pdXs8YGJ312C)ULU8h6EL2`>>&SSCof<9B@a18jJ3H zx$@z;D0aIF+?I`GGYoU8i)2M5yqvT0GqbJ_0lwz_WUyZ*c zJ9Uk?mrYEz4jis;9iL5#ngUMD8R>+kLyng^^3>F8nuy&HGJ)kMHaO-zsC*# z9i-(wF`*9$xADk$QRCGg+hl%Ahm5n1<^q7>p_7!TBGrLZ7fTZ4j_P`SkmG}#)gK?^ z91r9i58A}HroJqyR34ijAK0u1Her09l=9i&&5~~+G~ind2{X#MCBs^WBuY)hwvN$CA(wegSERgJobEj)XIr8ZMYd8?+SZ8W9dK7_JGMg z#`iJ4dr==^E%)m~tUV#t-V)UjInT=-FJ+e`$?h#WJP-!TdOvVz_=TO(F>uF$5G=hj zg7x9zM-I$}{}#!$Ex*JT^qxrcP|Y4BPV0wh$&U}=ej0?^hO4F#*@2~cRjQCRFVuEo zroXMfwuX<2KPf8q1CN=UA8z~*;YNc`!fI?=u6#_uR2PCPuUfqBy7m#P5#}_h|7z*w9CYA1dZ#|IqL} zoOfb{p-#!y3yj#FsBbT>N|7IfTCU+^A6rEq`+O$s?%d8!hk{q}uYW3dWmrCj_c6Q=p?nDS%bf(yh(Z_jG~F}IwKHdArUH)JoR{h! z47L^W(+)pvwDmnVn~xWG1;U>2bJu1L6MXe!ujI$aZNJ5tkh!PzkNdjR@S*P~g}#3D z@R-Ma{T=vsKkR!9%%-1`HPF@;AkA~V9nbChz|7^x2WGz+Fw?Dv56o6-_`u9o(FbN` zLH}^>FAyaYpgIxdf&QoQRoZt7iIw%P^}qCw)*dJ_W)Ni>`yD^oyLBsj#KjzV;lnWU z<7d?Q8Fe3@bw2d+p_l#V_l=3oJ(>Rr-(Nnf?idhmo)qT6+qR*7((6`P;%C|Y zW@yw013nn|RJmb4Hb)P2{e(oY<3+u|zJO`hW)2$n^21&qZqIDK zS>_}eep-`{+I~sY=7(@}Wag(feT1+LP}%;61|bzZLTU){MhUs2Y;QbrfEKrpzqVJ|4m%CcsBnt2KOt^+^$y9~biw7bA}U;|9k39I#(2F!poOzmAjnwQtVXyJUO$ ziC+4TpXlW$dVPG>`54y6u=XE6N=TfTpXT-3q$1DIn*t$ubU*Rhhg_DsEJ0aC8^qm=_-{~&<*@sD z7raGCUpE0ZWOT2O$9;y@Xt=%y^kGOTk>Tt_i7Kjq|2UL9kl`FKV!7M_5q%0_+23lB zP_VABeMglUAc5O7Hx4KbSJQDCzQ+qHq9(KE9aUe9e`~P&k2y`ACe#BgSYfx-1sT+C zA}Ygf2?>Kuj5y3N&CYfjsfDcHWvEtfJB`%Qvd-immiLF!%Y1|*;g5U;$)IL)q(tTMI;;X7*0P$%-k*gw;79L)9+wo(?EN1ntw z@w^Pj$vCRMW*%*ODc?5Wqd&IXGx!K7?OwpklrIz`%nB8Q9p_Y`GLA3&k*{XU`ftV# zf&K?^=;YU=y?D|pp0pQF8pZ37)nug3@EU3U*8}LC&p#PesGQqER`YEM=cgWkqo?hs zfSnDSb{cF<@=_G@#7jAYDlbI|KRpyQC&x=skHa)4)=N=O!?X*9*Rl^_<94M@pf(kC z60BY7Y{Z1$KVV$vJz|*mUNR6I_iTrfD63%IZtyzV#(>w3isqW6gJV#&_r{0r=kOOf zi2>NkM`od-B7r2v_>R(dlnbSNN9j9C-%%cEbiSi}e@AI^cDs2?-P6{gJVxu&1%4k# zX)xoQDrD{|$%VhHKMZqFkwsNxMc#T~6wvRJT7GKe4WCmFtkmEnlj(=?YhGHz2HQrH zm$DvZL&?I zoKsoY(a5BqQ@J6Odr)8zRL-f4j8wz|{+z;z2AD5M6!4!64`pnVvq-_G(ztV~1!MsU zJ#4;36?Kg>V5DvRjLQKGwm#fV*2^MhQ$ZW4n~Iu@*l7IiY}!;I%HXHLLI zk6@pk&Aikn@2B_xtRKo+19FgTcKnfM)8_3C1@+jFj|JDoS?6&p^YJ00s7H$Btr_$u zLq_i!ZTraB?cETVVH9=>efb8(Hz>9r-=O^Fv8r8c2|fq!TM!(c!koZM69MYK&6Thu zvVg}AO)a#)#LvmYrA=U?{DGoSWSTa@c75pHt;-5w-mBWl-mVs|;9D`@iY;|OBzG&* z^?-&@-@^Cp*IdQsTseT{acb7r-BsQFy;T>>21U*)ZKuGwsR{)Sa!e-os~jh`lk@?V z;rBaEEJ4}BB_d1o-iQ;0Li%Z9pdaKz3Z*wii894OVdjnCjwtdF2-{Iy(Z{^o40}9i zvF51B;#rNIM!{{9%DQGK4k@vFaAosu{F@cJ@7t6^ z#*uNP5G5HytQttre?O;;o6F{}kEk(>-oZ{>kl_%>gP(BF>p)lTt!`Hs1ntHRjfbU; z+q>%y9ozPYceB`{LYg}0F06w;H~TTKjlh?vAVERKMS)DFbi|F_ib>>7EJBKYavAg5 ztK9CSR|TxQGu6^IpySx|rUkkti~|-$<4=8g?3l zwm!hPrg!&W> z)O(Np0KC=Okmz{f<6DS%S9=)>lU`Fqccu5}I<(r=d!dkDGrDe(mo;u;^+W7OB-{_N zZ`Yo?JF}ql!D0_{YyCdq^`%R-?%=Sq{uspvN)=wYLvP_KyoKxXtT$U|U=>-{Mww&o{k$9Ht}pf69sD_X$EQJ0$$s(n%i*RM6Ic5GONv3ftgRD6ic9$pMgK z;mdRV+po?{{3&s)pA?EXppWpd^4qj*{futrIMEU#L2*voF}@e#((+HSq`QZB{D8+k z0S{sT{GiAC7+avS{r6n|dlbOsENZCgmaK~)&rzyK$xz~P3M$}vl7DKnYi6ek4(lFo z4)Yff`TH@HWt^C+FZWEA?_)470LSe;XMp3Zc~V7xo*0fhCBl{mY_a?fv9hR$UG?H#g0k_=zk;Bk zUSCzh*eEFyV4)J0WO0l*C@bM1Q~?K6urg5rAfYCd6=Qy)k!Um&q4EDE8IBR0tky8h zN8sBxRuovEp4d2MbsoZ{f~V)f@O-r9y%^R|gXcyI!IIcREF(!uMpIOAm=Og5vZ^SD zg69+u6!k=rc(l-y#DiH!6bA*4Cfx*2Pft(3ua0(u=L$$bhJwC^3Vi$K*1>AS6cu1a zL7msNRedq*X3P?9O&I<%;6}ewo$-9SoW^U+rdyA?Z*|dZYdm$4*NDzK>Y6D58Kkfx zQ)iq@={-4cM==^NaE|Kapx*(koub=OIBPtXs5uV^4gumD+8u7qAZEJE^ipTF@nE_mR_;q(76t;uet(#Rh5)4;jmHlVxej{u&tT;!^y%aJk^}IMMD^w=h|MEQu2yKWAQ{75F9r z84RHcW#uH8g%U5$Dn=t#WuvO8pZmB?gDw*X%=chc-DWHli95N?xw~{A+-$fmK^9MD z)Xuj6FX|u5T_Jq#Wz8ZB^*AU&fm7~<1uPW!2J!8kc*r$lg;n5A%*9rLI|+JaQ1F~` z98K`_^qdN=@%N^f=z56TaZ|#%AXp11H&4EDKaHUbA%^1$6;)hVtCJmQ$`l!Dg48~x z8k0a7QcA@x=!=+Le1`xD=2R_N{=k1J#5OFLS@Ps!2n5iBLnx>h;7yYuF}C_UB^-^= zX@dv93hp!()cW3-Cl0T| zFjEQZ&P%6&1yCJ9+VZtLV2JmYN!|l7mlPvOVUvu&HXvIkhGOarWm!*3*pdk zyN-1$ip_wTK3|ls5=Qi_kaeQ_u#>mGd(Y5gfvkX~3#;PIVCAbrK}7=O4aOM&VPP2) zBwDH%1w%_#&aNcHJ}q(e0fM2ju5}d`VC@T=ZJJ*aHOC%UTm~p$=T3}@NEAZ!V$)$o z>sYgh7jBgO!O7``{m%k-P6cgVbnX#auoE_27HP$C>1dV+A%RB%UPV&Dux?E`MnXz> zVWL*oIf0i|LTnw`UpiE_y^ellCJ=erKzwu^@zM3f$Mz=P#1=%wNtJ~sC#M(Kc&%d- zOCT^IcS)4pOreulzpPT_%#oM_M_gxwG-Pt;+cITF;ovzH6uz%**20G_n99BC9LDKH z*|FSkEtYH9vD}*Q&El$f(c+rDDJu~-4}mK(xfbJBbDLK1HJuDalA#E_E*xbeWR1;t zii<2l?Qh-`a))3OkdRyCz*t=^EU%U=)zRaL$DS4kC;2(2Bl=5Bhcl@7oHG)8ml+|e z4YCyO^5VqHjHE)5)P@;xhiJ!}2Maa0C(ds2JnTTOODNfpz~Oxj>>2~Gt6+x*!oUHOyDz1k2km{+Qw1twYf#a6bqz-u zj(cInA(o04ReV7Li#YuINi%jDSw}2xU&9Rt>Ke;J$Tv8NWI&;^3YC|C)+bi!Q)%2j9H7(D3p#muLDLuX zx)hWR2~|6H8vPla#x``i=I!csyoaIgE3lqbS(Q<*x7IGU`cQZwKK8|QvU62tWk`Jf z3;yKE%LFJdMuU)hIjP8K3{?11(f1}^M1h~3dNHkxgyv4L1v`BlUUk(JBpgOjSitig zzz$wCne2G}^*4_cHDf$&$o$FakK^SR&Ard&L`M_D{bh%6cK;PT{k9lZ41WJ+i#Qax zpi4f9LCa25Nn)$8tARX?;vs)_{&g>E0LR>oc`xqP0fJtb=b{xnTS z6uPLV8R-!l@r8+qHqD2B$;|haf9X#6XXOv+%{+ z^hCss`SSQPOChEQ1(IT1%hew!rc$8vC!fbHk=>#YQ)k8@Ys2V$ZAcG#Ga*1iVO{E! zup#sMpG4x7@LzvJffYH}s1-8eP!a_wETjsqU+e`>-Om`L42}gU#+Ryxc2~_O*yH@l(*$q;%&~>&MI7$GJ zpu7|+8<#-d490puzv&Fg+<0KVJcuN>w`sCtZB-A3WI+dQ4BvDx+so=j}6@$!5mrS%gaN@AEXq8zy7xAR9BR9fbACq4o-uo9@>Ueq^L?k za7Y%xM4;|T4}(-FpYTxVsr?gODe{O{q3kSG#@#_LT@jP}Vp58;kRqq&lqzfRoazEz zfv3B#8h0~t+Yj68*@LPE<=J6G6yF_Uvp?%#1ra6VVvV&xm^3`;Ls@q~K;TZ`NCUib zf~AxoZgOqj_j4*}yMqC5Z!ec4>VOM+lkd~Dlf2tBdb4M1=go_KUb4}E0}}oMYzD}j zrRoLD1j}T<=-0r!ba;{7bg*(yi?@wPEm%HxGB)K9o9p?W5PSq%D=;0Om)NCAKdjr)-Qvc0xK*kxDRQpwJUUd9(3wRqX)M z8`!G8$648*IzuP-AWt(|*p9v}N_*BE+Xng}LES?0~}6QM6~O0%SLvVvrlii{y5Osm&T1};E#Pf|FJt1KR?VWbtiEC^B1je`f*EtK-7Yy#eTs5Of=Nx`i{{)tv8a z(6@j+A4|S=1*O{qw*vsveWB^r;B-GKchRCnB6onN+X2)qA?ndV>VaYEfq?3Ma`($v zxIYd^!!E$p%MgARxP?;*tAnTAKS0irZ?d-@Ae<49_h`HWf9)T*_atYLjb+wh?9H>Z z|F%-0yW2i+L11N)yGuBOF&MUVF9@5u!)?-S+zkBrOP#q@H5hW7y*axp@wz!j@3zUX zOX|yZ$r_8|@-dP#^2R3j0TX=ii91b}p}=m;Bb1>8@s_&29Hx()l~d@x;F|y+L~=ag zMbSD#q`v6O@fW1L)X9T&DFNQL^4H{YAI?TBuK(s(!c+uNI;+zb;iT5&w;Kes38Tt!7mh@l%~&tfB#ES zWl`w;dwvksyaR%gHGwj2p8HqWDE6-~Ztvg!>d60o7Tnv8leY1dj9roE#R(F6RH33! z6DZ?Hn!r&=Aong53(*9#+tkdx(=!*Qa{cj_-4Xjv7;l|rU2DAU31iMm7F>^? zy{977CkUs4*xebv-ebFr719z5HdAI4%>c!FK7-ZxJdEKfyz4zWz6h2{7jRLG7Go5q zQh9B88+W`=i+mI8#mL2Z5xXuKJ9=23d$H$=Z4-m@>czKNcWoUeTiHd>kIikdjj+pR zf_nzv;#6-D6tUtvE)n(xEyg*Y^H4h#q73Q7uGez+&ugxc-6gQ%aZdITKhKJ>J-*v} zvOVIyH6LF)a@K`;GpF|t7adj%kC?^q#}UHo9+UYGl-$49K)nIkeL(HcI2^FML~O%6 z8x|&?%G{#r2RL4^qoqDfB>UVWBr~&^wghEnwWGo^qmxeu%#7?^ADexCY-WkzXG3QW zGWe?kH0#r=K1Q?s_!!OmKz)q1RMN+2dzU&uw!y{_==@tq9wKntp)eDJ38J~lrGfzz z4v54KgD|%DHittOdtwVgq;%F>a>%jE^FT3mGhdzl>XzPJ*@|Gv)wx^Vo>tcysXk zH~lamv1#VX)Zljydui4+TO^XbM~vUoKBT$Lz0-z3L*nq=Jm#*%0rNc8?-cvnxY$Ya zKv7T^S$8UW*{E2k!w6gr0>u#Pzdg!z(437rxn9ZxcH69BN7#~9;20Vo)!KzNqqe8B z=kq(+GQ6m45;}i(*aO0ag zJw?;;vPWM4T?BB$Rn#6u(!(c-7s3&C{JJSP_CZXk7X-Mc=_qZ7S<0Z zRtJ=%4R>_bqS4?kRd_o|nMUEj-k}p9TE*nT-88 z@P&E~n7|n0;^)A*SpYYW3w+Zb;2)#1`D1Uyy0E}%VO|QKn$Sy?fZT%)B_xA+3^No+ZPNfb;U4_{V*{z4czq;(nDH{o_HoM(Jlt)#Z=-1Q92{x93=d_MlJw6> zlkfT|ADX+bA`(u#vlwvt7p(!GB_VVC2vcl)KO66IDddLCb1HcHlcwNXhDYpx!Z&$R zsz~AQMl78B`hK#FP?>h1A@jlSKTZ!#l6A`8p<&~So+X3t(x`jmD=p89lAT?b_BZsi z-TbW9nmeF7$RTa$p^68OO;WuPLlDVrOun7CflVtP^`~^ zBH%6T^&iiU&$z8=TTwA?MjH&c8`YoC}91RVD!(rJW61)y`vBqXQv|>vT5$)%|Vor+F za(C_#SaB!;*2y2*9L?gLSPo_PW%gkWX&(qZ=&Z!)8oJe<^S zK%WbJn`IBzdr6#l>zWiiT)zdOE6PLT$OOMk(D@`Bt>dMwLxDoOlJBz8DBnD z8~EWZo9jQZ6NbqNRff5`jWAqdcoV}7qf)(5yJ}wdv#I9bmd(@6>uw5mx#5F4;NdVy z-;N@&j#Oy0X0syb^lB4HyuI&7a}BjnY4#MYkfF=NYC(*5Q01;r=mSZ9%I9;qVpAH79&hWN`?F3a+<|EUqI5c(8t`whF^25mo=bMK<#B1&VJ|Ne z;aK?W@+@4rYqXgwb(9{YUZok+REoLRoA9`ihvSF(u~N8 z+{Y79F;x@tchPVpeiuEvd!UoaZsy@G92Gl#Idch~`r%4HB1{wIo6=)`Fs#Oz3>%(R zJJ(DKG)ndBs`8q>dY#-|m0N|1+H0f6)$B>hPT{>WnRYoPqj8h!AaVth;oJU1d`t-U zBG+$qSvh=Gx`{Qi@o29z?WD3Vp|=hbNx$Lk(5d@ zm3Vs)2C3|@G^y5emvXn2d#Z+8@hnUh~L6bnwjmr+lkrO0m@`mWo4z$`GQM`d{Zk&rR|a(7S}7GJlaGvR*NzE zIFYIjm(fx&i#9>2FlASXN}ud-1gaL|386E@vuJ6Yz-FmYamAWBGMZm*JLH&Az)9EsuZ57>&2UAcL=!P*`E7f(0YiY@7GjElcUM@=2I@(G$%S>3H_8PXj`+G5XE6GAuQHoby%O4S31~G)!`(&PzU6OKnZ@CU!aKr zMP%m#4Uk)TJuFS4a!V@F8KReM&g7NZl}qL6Y)xkB%i4N6D#=S_W_IK)(aV8ZGcj94 zm36<-R0`(8WUP9BP9@QHvbfaCR=qOeTB~?eGZKwKmhYxpRn{Cen#JLOm6HrBWzlwV zA&j(GUdzt6z2zt+H*zs?os}|OBNuB~96fId>$#S~CvDDJ6s<~1NY|?z6`Q4&C^_gY zN7-Si53163);FRxLP<^wrTQXMz!%hntoIg^k!AD?)8#O(TWq&bZq=14u}n`>@#Mhd2W!iy=VsDc0p%FqNeC=aYBx5-D5oUYY8i-N zWQ}s=k*=rBMNPp>kdmwOVRoFJ_FGXwN%pF}QcWWpM1DZA6|BIrlTl)m zs&^^2$MlnvL7bM-WvLj~V$;5vDUZjzkfpP1U2jUQSUlGx$;q&>PNvt|I^S9J(q^8?-7VjshRK7~j&3=6fvUAN!ada%bQHg9}Q5Dzu(SWLz zRH7^_C>?EW8*8$d=%O`j+nkLtx>p%en-nYb_>Hy@ls1TS1B%?v38U9lsA5$vsqyZ# zMsvw3i*hnU6tMxesuk-4bKFo9sc5@^G07+>#gm*k%FzNn#F?HYCpTSP80cvUUyn;^ zK&Nsh5OoD@DuryJT+Yd< zthF1N;h?GZl}>#H>LoTi>ul;O-nPUkWsFuO(yT0Xs;;j$-OW5+9@7i9+2<-&m0xvM zU}K@!cuTfY#k8EufYFxEO|?nCq35<7!I8D}D&81U$yI`h&N_H)hWCWtJXaKCrVt;m zv2=GNlv*_zHTm_do*R)eNcHo0%BnN8GVJ8W&Aw8>@Z6vx^p`EGUCNd6T2mi#js9@5 zo^0x)t*~T`l$OZm`emzONvx9YQ9Ov2vWe;p9pK6Ks6^*E+7#ntvqu(MMq3}qs6>YuCaNekqgXOGAk_SFTWmGJQjbp5MR{B&WS!vq(_t;wDUg`~ zUeI#jp9BO0+(Y$#ay z#BAIW*|;86qswh#({HZ2O>R4H4!8ZW)@lRIhz;;AQHfDRu1lAR1}Rl2x|5+-)mC${ zZEG*3k-CISb0z_FNAEh406#pnqH<`jdZ-tv#f&2 z?VK3x_nBd8iRLRytf9+ng_^NMV$NFg4Vy_=l0|k6y4CHG+aDWpp+A39Gb49ez zZxfk*W-}`m)MZiLB>Y?dzEH$6QSF) zQWDQM2Dwdh)Z#|1I@(8TbE?M~T7yybt=UW~gYqy|(x;l7)0Yh`ie=Yqx3lVU4Fj#9 zVoWNO#ALZrAu@fbN>w&oel|DdxRlg5W-&B|B;CLVv9;dW@YG^3S(n5dV&$6E8g>n3N^bMyHpRDAWEOA8=9-8W%u0i?*>{uOgL zl?V>zI9}pE4MqSmy)&EqilW|jF|^JaucC@NZ4Cd17x>HTY~LvJEwThUj6`up!d~NW z+DnmF5gjn1CWZ^kjX?E+0wgEA?Cak7P9<8I8xKzxf}1V{FByVrNvsnQ2~owX_GcLHD=L<~uc(ir z@Cq8Ji-hPu4QuMVs+{u{j4UjmiJh|SB zRgNMDHrI;@xqUpbx9+PB4As&ZK(LPwzBc`J2&U*hu011rdyK>RJbnAl9oQ*F^7SjsI8K|759k5Dp%2f<{uhr=ulpYf_8ECVHC9dC0M^HSKxJB?dBEbDXdGI_&miY%AJ3rtAwS`$ zZ8a%Q;deddQ-l8K1NPQ$$4uB=4!(JOdWA&y94auDVXCryqz})?K4sqNligLRy6p;Q zZ`Ji4y%*e*?{&Pk8}wbzHgLqh@Xd8z*fVDs{?Q29gG&KL7axVl*RR(^2L-Mp;5qx{ z0_+i!=7SM5B8V&tloyYR552wi&@|{Ax<2X#fOrVZ5h%w1_|EVT)@l2Ga}K3`Dkd8c#t&7D=0v)aeLT@r>CHs9NF30f{#z5 zb)cB<8LNZwgDy0r3}#^0H?MEOYjJ7_FDIL~+@LnD;B*Q;_nc16;NaOQhRmCvQYGtT zeiQ#}y>~3Qm50&qcEfN74@CB0R+6?%;pBVo!{cL8FhD@2Md=+h_P3z{F)U3}^;3dQ z#1x%EZ5JSU2QX4lbxn0^6PyR$h2Y<^e{C354(=m~3e1G+yEnRBUk|#X;TFyUnAHj> z%xTdi!swz2bdf$81ay*v_wdek4#PFgDA5-Nt1zFky!)cy=r z4=QI@RoTzy^^8~s{E0?_9^6+1)?^8Mibc}^5{Edd6J!b?4{5>~Xa&I;sNsP8Bg~$K zloV6nydEz>(}4~amS~7(U=&{jdqs#nNMRU&4iE(Z)_|b_Q*aXKv1%as?YaF?*^_`t5;i+v2PxO0tK}U)MQasWen7C-#?T#X!u_)jnW1y zXVNGq>R?4nlKuH5lYa5OfWiHL;8!1T@l!#ZaS`2;z`;?u z*w(cqVEnuTf?ymhF6k@|OU0j#aUDS-@z*^}c7!h&%HYXYdq~X!O;R_2MKoPhb@(Mb zW#?NM?F{djd2rt!;q!n@fuydUp1ndz(9O!13K3h!gwP6$=zxb>dF(`id0o$H%5c4w(KTECaCi zH}*&ew|pwuu|PD-B5rD3`y=88IeSupvqn|-L38lJ&Ebat#e~|pXJooT-29Y?DbOZj zQz0D~aKo3P1bBc*U2((a5dd^_HiZ%hn+D1 zE1Gud+dVCC06IC1{l&j;l6}B+Ma#1gxsDzl13ZGO4Zo|Jaxq{_I){|$d@nE zSHy9xb>VTf$w62E3FAQ{IQ~iy8Nmj`v&A6L7UN(9oLn_bz#byV)J8amO0t)b!d6&1 zKK%%-X=l*@DM1W?y`1*ArUlZIvZy$B`XDEmn_M&qAG|%H?G11a&Dnz>6tS`65*S~; zFt3mk**#!31LR?T&;dA%N5Czi6=8>^9n_*p7!Ne6{>gX5&olQpR{GFj?b<;-QLItFTi;!1*L4qw$&3IX(b+uV=uAHOFY|)#eTK_PLA0# zxMo+jen-^^?fi_cO66U@E|38$2Fpf~u4^qrI9-(yM{js`7B_;cr3Ukl0UCil(E!GJ z#e&3YpA8TCQ8_V}vnx)D3&fk{mrGK_q0F%V>+Y952`-}1%$(*y{j_NBHQ7_~1Pbi# z?}u`f*V)&G2K9We2KBmK)DP@+ab-QqHZSi1n>ad^4`^b%uJzN3m_`^%&E;PCgijEDCmh`Fy|2}CSQ>A`{LXGy z?_PaGKk2Tk2V_m6;g#~CdZ(XEyu^}0`pKPMGGO7}z?23Uc)E%GeT#Ui@^=e=uT4Mb z=V(rhwsJrLB45GU1PTOsr~G{kHesCKpd&-fo^ll`^Ur8kJv4DH;*n+K;1=!>!KbFD z^r*)=2LE;xZ1x&2ln4bcG!PF@oCnTyciy9dNa7WHP3+^WOpA(lK1W&*&ne|V)n$M4 z>R2)$SM0>`+ESh8o)V8?IR{P99rx_bVY{pR#HoXvI9R_`e*{sC{e?u(w76jHrjB+kBp{W4Lzs zVEg;w47L)8Ht3rt*-3&g*k8&u<7gdk?-#N+(f*GCo%eo@|0S&4XBHnnxA^$^#V7u{ zz8hzDByny>-o1Ya5;=Jy`sc^h*poW3~T)Q`#Y;{59N#yunaUYvL(G zq~}tz&(9uHs%vd?&!6pBLV6l~{^N-MR~$!pr@qgBB8i`JBDMr!3$oCOI?Rb=p!)Ir ziJWH9e%wI>OZfiJKgq}VM|(it-GTOKhVNG+IIO~BAA3oGv#~)yvw#z!hV^8~!L{0h zAoj|^8s{+n^o%&&LjXnTaqkxZn3-SP`h-;Czs|Hz&Y>i?2K4YS?7@IS9;@~ zIJozv4}S8p!lYNeoK*U9?c2z%YH$S0#b2>>_7%fku@A+6-8gCd&zLlEdr`sfH^obR z5Me`KW!JEI<`xeHpuE|y>6`bQ?yj=!^8u@YLQCn}iZe78M#LvTy7Y{pr6!KmwVH;eV<~sDd3*MbA&Ulo( zN(azet=RTIf?0c24&i#k;GpM6fr>{?6Cq}VwHr)P1_$mdm-!2iBf4}R`)%89 zIP0%Sq$nDvnDBrD3SvD@@9kZ<9jC|%UMLxFs`5rFZ?G_y&e12MA#SX1R%pCIZuoQ5 zGrJ=#5C9Fuo=fO)TfO^F_xyakUj0XD1rNfJiv4Qywod^ISelV8mznqEHds&|h5GCJ zNEJafVNPBz&Mig_j{`n7j}PxD!vlP9;Q!AEh+(S1N6MmP0{yMzZW5#gZ*~TdH%`^} zN)cW{Ht%wEETC`hQvw=#ukCHZXB~Kke3cP3^v&faSdwz-oP481=nsX3a+csb$zk){i#j$?R2^tfBH8a z$m$Zj+0hXp>hfMwQvFgr-Ej55cMld^R!_xYove#RzplM!H&*Wom4@P=v40MZBo^*k zTrNCrkL`vgw2qhIWcoSCWVBx|^x-Mw_%=2hgyPXjoB>WnTeuXFd*p4GBmGeV3U3OJ zF2xE-TWznj*weF$os4Cs!@qb(k#n%|5Th6-)U-FA3?Jt!&|7a=n z58dZKKH>Gcxis?ix6Q3;5|Xf8)}r|X+qe^Y*lUKihllBy;a2q(`yi2r(3IlgU!m^I zyYu&xLtob&R>N`ATZQg+>AIY>`&?XvQ-db-3Y_vMcI>pNL&oazRS)%MeJ)&bbN630 z!L^edhB`Ru;;urZ!_*z3Gr(2-L!QdVSLfcz4=m4eN4Rc%SF{d&bM|ch_vRM-;Wde7 zfM92dcLOK9kBCj?ZX#DlDfX`$8?CNXBJ0D73)3<1<+m7;lPd-bZ%5R(idf-=$ghD&h4y@%6F*8|vZtAeVg| zpMA3+dnI%IV};otFV22mf%d#edqcw7u+;w|iM}Wg-hO%i__Vj^L-OkNm+D%X^%`FG z23g};R@s+b^FLN{{jltMqx5JVek&(sER8dYSJIGVMpD+NBS{_8-j&%IqI;M#(&?+d56NT*vHM6KS;RuNdR}7XAGe*x*eZj?+oO;Abooi zA%VMO;|{Mcxze)!=j%*%l-1pyP{KoKUky)S*ndtgxng)!8aubBU#|V-tP9|EZfl3g z^EsT?%C2+J9UUEEjIpKbKw&QWQ|mwj&=twit6@LbJCWet_OhM58FsmzH%G7cCK_)} z{hqT`Fv7S%or`I?AH_J70r%BYpNTw#^NqZUG=%WecgJ(~9oJ>of#HmUwFn&zFREnZ zT}7eawBLU-G+IIIg2w;%EyAga`2tI6{fb~|ZT&6s`)`J+s|x@7F7)3|si|8EVpy_F z>zm(Dx7lwf9Pjtvruy&Sl+$A;?Xh7dLQeIv2gB6CE0}_pQ!Rz{@{D>#%6~l=`G8yB zLmP*eFF1Jn@bsVGQ0@1R)ou#mQ+lmm=}&P$x7YTem4|jlKlC#74$MH^W4OHx)zwt{ zS{L;XyQv=><@qqc+qw3eIKFd~^(^t;ceD+@WDn=L>F`dG)JlZjtNYIxOkH%HldU}x zLtkE*+q6I%;oYJ9!FQ^RP%7T=W;VA2#2xxg0V`XG2_JTFhd1kXjretM*}Dx|f>4F< zj(W1dFh#|t1>q6oL=^#C+3ZYKx2jWUWs|&0nR4rLDWEUKtFYl{xo*NqQddotQQzmh z4Xr>r8EW+L^=d$O*jL*=c2(B{Z}Z!CY0szq<{dg=L_RaaZhp$grI| zh4Fj{&~Pl-N7%DJBMj*0obpv%-Jcal^lpK_+;JN`o3vX1;(%p4v=n=NmCh|8 zU;k?iTi3a>gmr4U64Bn7=AC>TSJ>u1z>frYyBwb96-fU9ijKVaHAeO;TYNhiC4M8; z-^b|i9FlYPd{wXHoxN^9huSK8j2B9O-{HUP9rlsx$KK+QZ`Uza zeP+4vZ-(-Ji=kv~-29VS%HSSh?)?cD%ZKmhvf=!RFZLzn??t_(n`$kb+U&YF*?W-{ z)w4{Q^c*O6e3$R@I$clK?)Nf%@Lf_=x6lz{Z|zO5(`UiN1J{$tzulB@j|XL)p1wXn zMI$7EP)Ypo{i~B^z@~_vU--lK5C$+mN1&~K{(xdWl=0BBP2Z%&cj_wnriA+$UN4w; z|F*rtCtjirL*!ts!q8^D!a*NgVY`4fT(tfpBwjywr$O1d@j@sEFW;~qU`IB<62LMs zH?Ga?9VY%`FQH^XQjJSU_qRzmg!0e2!J>O(E|wqflXU7W{&T&PLON82aHhOK(44e8 zVaWEyr`2&M!gu(1@ou{QMz=o$ciizyZjvW`s?KL+`(U))Lv(2Ex+UN^*|BZg&W>%{ zwr$(ij&0kvZQJ%vH$)>r^?pWtt?%{2QdDt2+VTMz#-uN~VumZ=9Pi_xB z4@=!0cXN99Fh$6H5Vg3jMm+{rio8g=;)pXdH=90$&0w$H$A@2(mZdM<%lqX9H^%Lga%}ntWnbNJNPSm_Y0h^iC3pK&L7^m%~ZpR;BNBaoO%lGdsPjMeJ@7`V;oj*hY zz6P@kfjwC6D~rwJ+34T>zgMzmK6E<3OMj`&B?vnGx+4VTd&$0M_}EkF2}x(a4T}B# zBzrBnA#>f4x!>&-(JXHFosf-s`|`!=fk=ndQ{H~51!l~mC7zA;1HbmhlT7`Ct8*l{ zLndydH00(_yjA86p@!Q@*(>CX5BM_=N2_lyKpj6IcY{}BPmRDuO&-&4ufr1DbM7F= zNF&alc2`zMi=EdjodsJUc7-miaqnK^8|?GCi7dX7UvDPI2Nd;d6{+S9cQvlbahGz8iyA8fsgYuFb5d7iOlsZP<8Hb*9|CZGycqTIyoqZV` ztsUH3wgr}SGf^V9*_0w9(=Im@^VG-g#GmkfJp9)~N_f(8hG&v~ZjV9hM^#=;?d&;m zq=XthoTpZ?;Eh?hS;2G5XdbV4Tx*9X0=n|D8R;qarl%P!l00bR*Qv=)Y8+%^e;`2o z#)&(^4AxO%!eaR-)Slh2xjS!VSFbnjZ=vO7J(@bI2pE_x&MwIJQ5=3OGia5QHbo+$6uQ51$eMljn3mFRx$_71m{iW&hfcrPy>HdB#bq16SPdmM zk=^!qqxqlYd;ZMO9hN?P~7()@Lpu zGE<;?G=*UxWGWyw)yrfX$RV?e<{+YC^eG%$CMWk%2bFYHQ?Of^E#jdc8+E>4(;;jg zX$j#PF@*o}qj;MZCiDEpS*3dH(n^<2TXoc;fOqZ`+5skuwP*>b6QlzqydwuQQ)+W= z56EQaRB@Yu<=U!Lx)p0M>8u%RM8ecxh?&gD&EHH5tgpSLsV2%!YjlCev6yt?c~-am z0@KpNUM7<(RAv;CEs15V8E2G7CfLy=nRjLlp+yT?c`HH(=Ss6s>K=r-h46~YWhzY! zv@=ICh;;O)#Y|PZ80|Z`lsJYelQSw)UY25Uq`Zh9Z&QQh)%+W3RUFIYYM13qu}A!v zRllg5|0t|eQbBWwh!#X!2c0Z zNayj;=Qo+OjTCzp#5ZS?6#Xf3Ixt!~Evb_BRSq++f?cjU=A2TfuPamtJYvVlA*p!P z!d--N=1IMtG_e$LU^AE=w+$cNv3?yhxVAwa&+=7((~{=@Sf{Fe^(F&dgOx ztFI6$l67GRQii$_ z$VURXu}WPkY@a?A9`&M*vr=|~3dgGS+%7@86xcy97o=yBZg$X*u>QdxY_zHqH-%Kb zjU@RLdTxT%^nUzuyy)JknUv|t*qR$B`LKwQiR(V)^r*KoJ&h)RynV-v64X(jQKgHw zB*BbJUF+PqLMPp>O8Iv=M))xPgzG{TrDY7})V^KsxOhl%y;(;qyod&Mjq%CGwnI_^ zR$E%@v_yJ!d}I@KOm<7qla}OOBC9D)gbE2s;e~Qc#FT<$682+C!Da0txUxCd1=bv9 z9&t&qf_FT{E|i79vS;MjD5FP^LUv)sX6GVRxuGL#nxQ*#&U0HC1I^vinFIO?O|vF> z%eh3dT5(C4n}gncV3YBpBa?ZRpF`9QF-Qt|6Bd?1k|N?y7%D_xFVc1|wz6=XU#wU3 zN1*s4YW^Di;V&WGQKLkqI>JRp@;GFHcow2M$<}TVXA3!7U`TAN7`J7>yvsZeumX~e~+8Q+owr93KXQcQDmG>f{F z(;Q~A_4F|MRt0pKbOegWr-&wm1lC|1ps>wJ(A)*3QXOULqMNHmL7P#sFh@E;#43R1 zQpA%#hfQg?QloZnnh|o+zPJqbk(od4zSK-YVrDfh^kZXC%}5b*t|A9gSbG3#vOu#O zt*M1ZIU~Y3Hm0nGfqT^mqja|-;<$E5Z;7{-85t_!%J?K&(^DAM@_O{7-K^4wL`gT$ z6JlnTGpjR-t>%6bqeum!xk?JB^2$o)wFxd=>>23Br6Wqkcnv32ZJnG|Cy8d6fyT6P zui3;&@p|FTtfOYk?x=Sw36WuaBHyb&G_lcj)vm*)jsxr7X5npz7S=OgH6}5U12}vWz zull80VioZha$F(FH6iB^*jpn{rThnM>j?Y$H6kdQf+{#82lMf0gdqloflH&hA{He{ zrThVCB;}+GdFpg5cnhC4nr2MBGEuVg{NL3`^)k0#XSFF8$fJ`0bY>hrn+Va#lq!dV zm8&iF;=K^*@zlylDlQpA?)B^9sz+_?OF@*eDh`!x2+?YktjLvK2CO#WR$8&;b4RRo zXKbolq%B!&p&NhIESvmI2Ep7?O9#mbSBfTt0+T3_x5j2GEGpVoo14-S0EITR>Wmdm zjs+skYw|4!+vwMW*s}^>`%Nh3P;g68wGTAAtfFQ~MXGq|{X45vUhN|rlZ@DQNFpLu zDPV?#uuQ{ob*thqifgq@)1{pk8iTBiGbmOvxS=#_(A4Ud3M2aEhR)o2IQ}>f6Ddtv zQ5rdAmDgHnUz`R5^;JA5RQ@haK@(`!0BbYDmZn>%65-rFR#)jebdiaA{+Oh15_(7` zS)Mg+7MM~aWH7CI3z;IO9wY1k+d6+9y+YKUy_+^D8V@Ayo>W(ET2_3MqOxvkal)Xw z>!Oia34hF8$c-lFFo()?H(AuJ5OmhE4%qiIY9Wuuu53pSfnm#^!woC*Q9>QRQUMdx zgpy9N++>{ti7KDo7)b9=B$YGNtlc!gU#CSYI15)PTDLYIgN0-gS2KQU(h)aCvB6qd z09%nfGHsYIEkDG15YLJs{b;!FG&R~+Q(lu;apvQDO~Z6jPiX$hC&ZAeFfIZU(w+s@jU!ceIe0l}W|Fvyy02kKZz7_| zfrFB%z{N@Wj%|*LB}o`Bg?6wic4lSIs9qDU%-uo0a&RZn7(;un7B3BxVOB?+`4zsJ zwG62B(3k<4ndXc>l#nFSLz&caG(3vQ9I@^oZ#ExUo{ndi?rae!UFR@m0n-t} zNYdi&kh!l(#TdzE$z*2Sty_Z`9U=kXid5u5HV2aE_H zeLG#+M_Asr16{*3TJ>iglr`jg0P6F|x!E@94OJZoM+6EDRQ19%&$W zQ6$&nr?hkm)R-0&_utH53PPSlX}=}RxW)GRKKU600;a!=vtFJCXU;#bECNuE!(50t zj>0coh($YCycF=m!}DBRnB|MSyPKAS!6v~h4OAncn3?J3V*a45_f}T5WV=z&+ebj( zgV!c1adAnBMgFCFBS*iox>W7CJD(?_pUNzk7BT;uxw7o0++kXizP{FvR!7Es?4rDA zD`-Qt*y=CIq${8&+8WMgc$3g`?8Bi4T?%Rh_No@0N$>OB;C6crr=7wj!sS6=jkGUL z07ZMO<;uba3j`)Q$4z`#a0!s42M1xv$q3q@vft@d2=hpY7=Y zQ~meQ!NSE~(Ex7|TsdjgR6;460Nm@qLQdiVTw^%3G?%$qGq6rK8XX~FM3mcGkkCZ) z;A6l@%Y1t?6yCr;CEmXS8ACsV3YwP+*@JhUl4N1t3*c5YeL)joJ0|+re*8k*X|^Ef zFr$=mbL`_D##+fFmv?;!rE-h*-epz$cEL-4=Y3bqic4Vk#Tr=5D_VEkG?eEt^Z+j= zzh`Y^RHxWqBHbRaP!6zu)LWr12f*ww@rOP!Gz6g((D6vo^w90U?xkprE!ucEzAjTyY zxUauQvg*fu-aDf>brErSZrD9oFvB4SOeTRFhHEc$ai8w3w$<4QSlM5M*MZcrZR5Ar z(mzG^y5`8r=<91xluBXaEs|Is^CJ4Y=3%R7M+H}~a}}}&iyL;?cS&HK-ap2+89Fjj zsORS=6*}(^@2c+9(T(dQJV5gYlzswPE^T37Bxp_;>6Fl$vG#;m^?EPs>NeOiL%ud0JcpYd zC*ARV9>-p$+~?XF#{H*;utsy1>iO%w<9?z{7Mx|3kjI#3`%Sy3A4l;i0QoZCAPf=( zq`n;l!dkURK<|qJSRN%PNFFK)E#mO0IT%a8yYC&=v5B6qgdBYcn80|f=w zxj|TfC1`w&MEd!`ftx4=(D(g*s4Ni_gD|XzBI;-J4EHb9Kxy2k3;D8;?N5EWh5QI1*S~i2&mR7da_yM5#t*IRcVGV zQ%0<~&L<|Wt<^s#c49AtYd@ic^K*)airqbXnm{wE)PNAAsy2VayDR_%*f%u0BY^CGF7QnhL9Si~L!9WZm<5SNP zI|Hi;EeJ1#PQIZI4{gje>2ogc65yaUx z(jf><7deW=xeN$z1V+@d0>W){5ptu{LGJ>~TlK$vzE z=+datu{K{WUWA53USyO@6jo1WkQ+Ekm0Qo<^W~rp|Hod`5|4*-{#;3neD4za66m(s zzyW6A~A&lVzia6z^j|1Au1Z0s-a zh<+c_>2BlcY3jqmLv2$kFY8H6nPM$jX8_2e+E8D?K^aQC48!ulT%y<;`0T!cYF%iX z;^_ufM=^ov2`@~Kw3p;U^NEzy^}N1FC)6N2L7@P9lx%JzcR`<~`CI|P{CI~nK1Zj% zatZ)%Utfd)1CStAc+J7anyqVx-zmylJG^1tcAC##ov_Q#R^Jvs-~s_Jrf@E#PQm%v zPo`A??kE9M3v+oXv5eo2b5(I)7>9qz#Nce{sKzRLj zd3gs?SZ!w>*}~3axuV9zCkX?rOp|LPc4&af!1SpHjyNg4@QOdj?|%9X2Q4* z{1vGqKsq1;+Qe~3__jF9bGDUvCe^}r-xuhZEy1rp$I$U86nYjjvcD=x{eU?0Y*43r z)stvQ3RJy@g0LgcBEZF4fc3nf5cn1g5bqfK5(Fqvhu=1J@(|#oBr|!`dvPet*QvhU z^yZU7vGwizGLanyKWAnl^N{PK;qsVqc?J(eBJlDeD6(~NSuq>n(Y=!8zC{a}>#41! zA5d?d;Mq$WBXb0t-@Vf0qcI;_n-3UzhkE&okq*{208Jt&01Xo`uwB2|w3pMy4f?0m zc7^H@u?L#~A!z3pcC+WrMFckNzy?WA!^TpF6y8ra&Bb{eW3SAod(D%?KYBo;Caan1 zKlMQ2*gtweV(A|};L3e^GI}7Q${FPgG=aE{FLHqvkuzBi3GwJ@(47vB@|Iblfdh4c>w1G=3bZ^O*?*&>N#U| z#4sHd4*RRyzLc#246C)AfBAu54*&RpQ{TpzmKUhCOtbG1ziCh2k#EH31*XW@ z98Is!&wV6c?HWHOt_1cLB0!Vc(J`d87F8ZE?w`~Iy|`MwI|pa^1WeXWuB78St@*_U z@?L#LLDS&=`v`#V5Q-*I*T6;|_c?3l`&|W{>s| z=GZ_3Nj81pw`sKZ-PUWR-UeT{ z>B|rUH-(*QFw}V_|_XL$M>2 z>&tRB=vJsh7}Q`(Z7*=N77mDB;~)cahBCE-Yf|8probMw;Vip)-neiUomA84+pBbQ zQ%r$#4dy(vaw8`O@(I@NSf+0T%vr)In6~U4u409 zBekSve)uRdPlF?{J}SFdCz{&a$pMUKe&u(&%bs6TZp6sc$`CWVbXS=jOyR)S+QwE3 z&SYN9J`_{VA5%aRd^y%@G1-KzW4|1DLXk_rnbOEM0yk6q!4JxEtr|Ic61Nk! ze^ScpB>E0tz5E{Cw8XoW_;|N|idTg98$y&vPu~%IKwiF0ZOThGtbr2b^_ywmAgz2azMedt&-cO0Pv1O?jca2NtK{5Mcz`x9 z-L;Anb(Zag0%h{7ytC!k9z|*w$1@@A@@!P49<7fjs)jyZmO-}5kjIC=YZAB5*^RHa zx8EG03kqO>7HJn=c6R&(_th)kDogElt81}OY)Q$7E`d{O8%uAN*uCE<0i&gcZwkTV2X-%xbsC>#l%_ z^D=hoNvFE;#irD&VF&rVdt7Yh=b1i)>He+Y3FY#ux)+N%Jn8{)8pk+J)1JLB?*$;p+sL@u^(YCw>(kbCC8lI-Q2l+MhqC&6oPHy7 zdhN->->s+-HFY=LM!k>(FkeC7a?$L)$~<{?!FkvK@l6YIz>l(eAY* z*rlEWmAYwkrz&lCMI5S+DC1LK0e?mx7<3A4r~DmPa(}nf=6Vl2;dtOwqqT!lCAjm4 zTh-6g5$f-4h7c29?LtBaKianFAgLo;d_}>Z>lGLWrtGgHiWNH7fG-FeHz3{&Nlr58 zY?Ky3N!gWCAlmr(TE_X8%v4a~14b-l4ZW?q^h(GmHer?za=Q z?oaQM&Q+5hFm#@QmG(3hmlM@*cvNjZYA#*!9$g_wJpph%$w-~)Xq^HE?^>_U6~8^Z zCSAePp9>VOmK?4|RNNx`9 z=(TypXu&LDbVB7~5E`@S4-mUx`uf|joz)}{dTft61@%=g4~{4Bh&Mlo{W_)?Lgdi5 zU^Q!9!5nnry1T;TdbR8ALswFR7)rk1A`);ooL`8O2I1Ew2NDsVcj6>v&~VL%r)kbp zEqysIAlLto$bpu-uC(XoARsqC3|=)ZWVY zFB(wa_MbEWiuHe^0Wf|!*~%@*gSAHK%WOS)HVr#+?Atdz(oZ`*6eS}v>xKh`0e>Kw zminDS=_#%tPesK=x;CqOaHG6>^KbH^2YS)4JH6fBXKYKKKSn4)f^UhsmQx=~*z-3m zKW4`Txr*>SQar#-a<3USbuLdW%Dt;9-b1&R;9~B**mtig-=(d#ImSIw+-^En!F20G zAE=$&WW_8<1bUXfPN0h!+o!vhamQpjv9I@0%!oSSl6YTbd=VsSu(q3BO0io?07A{2 zO8?x_DzC=ZwA8nC{pmD_dAQ~3+4u7cvt+heSzGJZ*r-;D=xV@VuNzQBhp}P6`NKMZ zlYN6i39p;!D3If0=bUHxDN`5I$xgAKrF8ul>-)+`Xv5kfDbCb^WjeSUXvNV1k7q9q zdz-7i4kRxE9{0%zP|Dq=CvI=-INSoRwSG?{ew@@jS?6x~NP$l`LREiY&Ox&` zC>>o)n?+f~J7qvy9PAg> zNTGLZreC_#>K|e+6mA!mb=OP}%f7th-t39W>TD0W3EmOs3{2fNnzIbkypOCM7Y?r}xsfC>{@Clxmw;yf1 zQKf$0>W6=BNVC1T$vvH&T>vXB@a==6%)ssRaEe1(X`FJT@p{4OD?L2Gty5mXk$(tc z5OaIJNT&dnTqf9Nx8^Xs1dP4fdeVArlC0AU$vi4fgw&~FKlY(CLzxW-U+@a-KLxsC zCS|$O1z8;3!+ZcXn*&n=QfoRMtZ#1X1BpK;D5DZDwFWu)W`+xv%2Z-i4zigzyxsZ8 zlx*+wt{hMlnwmh=OhSQ7iLWDtSm}Cc;GmIsg~p=Y6kiNDeK6UL;Pf2Yx^v#u#Y(hd zkvxJ81U*x4=;xF02DRo4aM^-y2+MFP$+Uez3gPwM!j0IyK^5xPu2~0N9#(HhSe9%t z-Gu7v|2ywzs%;@IO+D!Q2rwZF>RCPE8&V9X;SCG(=dk@2X+b)5iSy+pZpY|rI+iKN ze0E`DA2~aH}_=`2i^Ji!Oq1HZ>`LMtYIZpK@ zu`ubcISQPB`BA4IL}^n%?%z9Ue_h`O{cqGalsD8nbe+)~pUB^yFuS+4eX1u=uOnBN zUu$@SvckKuwU(d*gnv|EG*0;WB2oN6L9N}7L0X~|Hm-Msj^*ukYJe8ljHxsN*td~M4!rTP!2(zcz?>Ln~K~0 zeR8%fd4KQ%4Caz}gN^Ws6qt?sxi#8R+&uI=_=s_&al)cH@B(=lVDm_Ry{31Q!L`b2`l7$s(@uB|?W4*s z{1^~ITk0wzw>t-W>v&pcxlcXYo$2?om4KRfCFeGSfVmg>UIMw`kmFTlq|#cX3LBR< z3!s6&PzJVaVZ4KbDb>}L`UBio4;XPgL?wl=ntFs`y`=*Nx3(gCOY23L_;2>M1s&6_ zD08nw**?01lyXsULBck9W+L6PDRYtvRfKgQLYZVHKJ>3ZuOIYmYOcOaY)dQb6gOag zj9{K!Iqe2CJxy@nZt29A9!2?hU^qQ1Y$)(huCX1S$KG~CjueBKA3dN@?-!x2*&gewG(1_?wF>N`E;+5B`*zQ(ozZoOQ{ulSFO!-ngqY3Zk;eC%|ghxb#3vCVn^HDqKalv z(mN3!yi*?mw35UXf`tQRjFcauu~>HeXg)W7TgG(Cqq6(jdBWMa5cM3`x*L6^)SQcx zCRZ^|(JyTxFTJf1^ovCA*qU_;MRQ`+m=|y}1uuq>H&C zf5HcY+H=uO9MU)t4b{Ph@tDc5TZdm#y**26Xh}+yg6+VJdM!#clbbs07_y5LQ?(@E zCyGP@BneKdmuV`Gws)s>O>pz)XUj4NotgatQ$9m)Fz{)%IMx&lV1A2Vov|eqv4>e7 zwwS6D=`&Exa;JuyHsnBghf^%!fS2)ULhc5>0E2WvSOZ+ z5KWSdNj)<5O07P0a-XYH`q1WN%BqQ_Ax<-N3`I+DFI|P5+$`y$rd1PkZ-z9bMl*bR zAXLt&B_cUQy$({;pQKGf>0Lj7P^u9|7Bme%lV4;HlvyM)gkpI-YUa~+6=x^{DA;Bi zNBIl7ctB>MN!f`BSBhUb7i-w8O6g}#sfeUts#Dp(qm5ko!i;Jy&a?qE5m&YXD>7X{ zSfR+UA3chkwLRiKAYg_x(jkL1(GVWXwA|8CDiVrxDZ)ajfO%B%fj~!=F|u;9ZY?_u z4m$3SR5Et(Qvnw3c?{x)Kp|%j(@+NV8HEA<;?h`)hhBY%3IXVQZ zEXB-2>?UHsOm$-)(nrPoTfCCMT#`2#Jck@j%1;Yv3&(P&8P7o%c_0(DKTa+_3lg?Wp&3zGt^LE6&c3LB;k#r zVETCjcN(sp=ahn^&C#JjXO(fMXst?P`^Qd_$`cL9oJI~y`9?|#0__?HC94#T{KMQ9 zY~#=(o>GYo^_{R~2oesOr1MBAKwUYc`fW`qk(4>2q`ZY>&?G}IGJ;y6vaMD4f+v6%MXIBmaA04P1*}e7v^694HFmSBFj4LlZ!$ z_m2)XIG|aRKv{601s2idVOt{o3d!DZ01;iDuW&OIBT@ZD%6YNdgt3j}@t`FimoDJd zIXu4=FK4l2w0OAE;9(;)j=wZ>Kv6M0J6@ZJ#r7cqI^Y->F{|5L=|Z78ZYk|O%JS23 z>rr18+uWbPqM$*Td68NbLQ*HuE_#QrF-}^}WuW-`>BEDaT=CP?x87 zgw$X!X>{PB6iwR_F5T01&f0d>$+7u7qEP|EOvKvTAw(jA&_=6Gidm?XcPbO2qpUeK z)Lb=`1dYFb96^)F$%dvO<%yzbYV`{IG2{+HcM3JE2LMhnzLPL}e8A2y3)!>M~sT00_iE&i;z|14vhGqVab*3JY zw8hb&amO^Ij3lFmx-Nva0mWh%F`UD4ip`2tUmSIfEgd zct2&u&-IzI!fvBAo3&Mkk~cG1M44nKP4?W0c`YaTgqsLyqkiWB{h$SJf-ou1~{7N}vN;=49 zMne4e4*DVMlzb#s)43U5)l?a-sTqvOQi};w74-Okns|40KnpOJ7u8F|w&Q-rxe zVsLr}{X%~+A5i34N@i4=h5WKwtYuSjZ<4245=t$4i?oZn&F?-jj-@N++bg{YV=@ym z5vI(+X80A%KnA9a@w3v^r1d$5xf8L5RW-zLqjvNW5ed`C#4!))%JVhhHr!a%d}pWl zkq9e`S)oXhwM*H->q-+TpR6cUt`A(_k3!S7I;G}rwlJcP9?paa0fS9hgO^Qh9&f6X zdyDAoX$NlM-^}QMqmR>8_f$Vqu|u<*mYorl=Zy@XcsjduH4WYclP#l&r}X`U7{5HD z2h8b&m4uyo!!pomH(7y}pdjOHsx=%b$j9K7Bn`5}M8hca6fA_PJG>oJ@tVl^%;05~ z;-f9j!eF7Lm7xKkl!@~Fr2wV0%Fiet=YTISuF7apmL7>d-`fudd&KkgQO(3N<|jLA zBx6qkhG&GmLLg*1Na<;`Nn$Kt$9(Mj+zD)jDQ_Fr_y?aA@ zvv+F0{~`|T>Pmyp#@~Cx#j-rexqOR#j{RJq@t$YnfucaIHF%QXW^nrxZK}UhLrsP9 zVIJmYiSO_Y6I5aR^b((I;bdj`TbSz`3PAC4L@xM#ksG?x`^*|QS^9&yct5;4EZ|IAK2|qB;tjtR?C?qvUQR4!b;0izls=T7qQrqjks}1p& z=3^y9{%Dscp|qDet@|Q>UCJ4!jq$|)u?80me)~$PQy*=PO`3yHz)Zk>K(k7ca2-6L#%T}6Yy03=07V(CBa1XEPM z{;4NOm0p`!_*Xr_*+gpBSTvn(Trxf*P(32auXLcGI(=gVWqz}?(+SYaCv-+>a85O~ ze1Z)BJa>dkl(+jMcs-=i3=mhKaxt@k^rJsqN;7vocKpaNgA`px5?HOw3TUZz%=7M# zaiW`y$|Fxh>YED}sdS@iP4FQqS~DnIgT2lde){0I1-vx}SEpZ;lwsODK;>@m8sK61 z8F9X>d)NIwq7Qhs2mwO-H634~*do~NO`e^s0F{9LX+S}s8HF|gk!J0s?{OSE{p@O{ z(_K?u&yah3bXdCNd{!vH0#wxbz_^qM@w9Qh2`W-TO3;ce*eUDV@n`blSvW?OC zL}H11`B(hHX-iq5SN{|csDa)3le6x9{+$g|)rMtd%|-wQIJ6{qUAc+HCDEx;scCMs zP}Bnhg|xsZ9m}sAM=#yG=O?$Gz3stH5i$=P~u62hr86R+=a8`B#@yTKxVa3H)P zP4~*f7;{6BQhx`R_X;1GZ%al03@lnJ(0eVIPjJ~k%Z~-;XS!aNM=bBdsq{3&P41@491fD80b%%>#75m1NIdDlZNZ&1GwU`vNp1k zOLY(hs5aNwP0*18mlMFqFu=QNL0ti#r#o z+Nrmjt_kVw-uOL&T_=n7cQqjs1e9KQRiKESSLmbw-)|-WpecaA8vybMwV@C|IZ<0( z-G0c;)syyQqGr-ukziuK3;-^V8b`i;JyqL(_Th@YPbe&yd8vzpueRHX4F9m7vD(Zt z7_iZ&spusQB@ALk6cJFY0kzW|s~^uDi-VP*){CK1%qJX>pfIl^t51|&DJ{7+4+%^} z^RQ=6C6H`N{qjw2f5ZQPXn@@f9RA>A6JEVs6&k)+IY7N_U)2e}>T)=~0L$GFI9Z>9 z^IX*qoks5n!+0U0Z4h%|-oPK^8EQ7K)8FRYgNF7@r%Q64jzP8;WSzgu9;;B4kg;MP z(t@P**Q#_lx*c$;S-8;160C4_S~~lj{QFV!NC31>UG0NW?b1zNEuZ%EDf4s!H>Iq= zp%?%tC+dn9Ic?h>t0SZRN9XzlU`#{Dn$w3AF7tflHPYd+hUWGaD?7pWaOamXA}H4E z_T%8oA)uB?3_hdwG&L(}gLS7GrTQSrUcwmm&xmE2{MtSwUBh3ZZ!q14EP#l3m=rYR z$Q>geKm#JoF62fe2^rTkTDIidP-~D*zzc-mAmMJt~&q60#KY z-~5CwnW3{qH^p=JZ5e&<97F`XYY=sBPv(s^bsZQ9Jwr5US6XwR@=|7tw$7T~&c!oz z2V-@TTir$Zffnn0uP=ip_^Mv8sawBa zh~46YcophbKu#0w0utYeO%+@WDgA{_iy=FJDxip|UaD*NtCv;~m}FUgyLP=mB3waW z;mm|}ErK3)-U!e}OP8qha$xuU2^R!%;v&*H@0>{mjaUXH++Mtc2>8f{31vUdBN!Gw zUPT!;r+&{wszv}EP`q^n-B}|^4<#3j0jDG!6k)S;62ZS*`#`x9IL3efgvNRP*pgW> z@O>6Vz=HGcI%qL!=Sy1ak`3-V`Vf=?bpj2&`cu#76o?YEJY%^%ic{{BvA{~aa>osrD9cp1@c zUHU99zNt|!gzAepqcM@qyzO-0kapN7OnZSTWV_!=cuTKB0MWF6S0nL0?hf#MHu09! z+OSvnd*=K&;P?fR6|Nnm#eCe7Z>z#ZnwCqKUmG5p=7da<*;ySe#uz!^@qvBj#0h6~ zENk*A!cRm652Z+*n`(Wr2rDLzD*wPXF|+K+mO?oR>0%M#6wZL}0`p}MHhNy|mw#y5 zj6>~nZFV^8FfJK$s0J+-YtR-R95=8h*!$$!-@jm;B()CT34$W6EczIWYT`YvSiEug zDT6Yd3+&-B7)<)q z7o243&{b(MYTg-S5tm**|5|T#V>$Gc=w+d#&p<2rjxb}~3Gn0Wn=prRtU=P@$YOI? zwS-;Nv})U`*8_V?hi0k4q1Nj>TU)ga-KgRLxv(S4Qw&WFVYuIjM33t1SL+RmT#|*8 zK$Og=NLHKy>zl-g986lLVMsh!`orsx3~eHo|MC4)Sj4FfKyC}I12}X&qh1zz@JY1B z3v2E&cc8`%WK(x8|L$fh2yMm94QUM4J?mF*tFy;*c+_~IXLzeKUFu5-=3fIlOIUGm zGyc3R{DBZpc*1eYUB6}}2#}Llft|}wAkbbOcoAARa#1&#R4wgjTEXheQ3)hW>)*V; zGQ&Wi7+q>Fstp^xKwngganacoV=;IbjeF9Wj3Mr!$svFb{UfR5#MAeZ1-~k@1@E${ zRyZAZ!xoot2Oc#0TWJAX!XL5H%<>7&r+qNoZ?6*%zUu5Kns=%N5qndo^}p?AxzAzd zDY^lK&B9_{G_!O?bO7n0Dbacyb~9H`LG~!BCdQd+YgfzWputyGHG!$2<+UvRHhfw+ zk^E|e{_r39`%fcEnb8Mh91URXzT#eVJwUPC7_hXu1YCfwBt$`lCAu+JmL!ryPRPwj z7sMZYK|z>e*8XvN9{r8USaHpu9(3ODSr5P)Lhw=6Kb7k}AaY3bR196}QpQ##TC>!s zJDSE$Wnei^##8h$r`c|!MQCJ15pd)c!|xicsjfQ*-$4yZEG+n%J-#GWlC%`DXc(c5 z7$u&7J-RNG6*7s7^}CN5d!W2(!gd^AOO7`P#PKs)3mhcw?_dk*xwBF8!caeoLAVg= z(O0mnAZKxP##P_}_#O!Xz{3nqO?KKeVG zVakKagum}9(1CE3mD%IlB3m-Hv*$*58Ko`CS zj=ThT%}Eu2yM7)k5!`S#@igtMVu>~1Qds30xRAQd(_`{7{F&o3Ce?bBIr~1u5-)PA zkc-b+=Rne6(qBkqV7bZlUu+47Tae1atWC#^Pe7pHZWa^g9==p?C=7HQDmfwN@PHMF zA3??>VZT$nCMM$W5F3+!zxK6x!PRkC+>mi7%yZWqlP96y#6OfmW`fA< zdj)hXt$hTL%|z&Q=#5FH!J|Dy0K%1vHx3|ZZO+ALT@N~{gI<+f=GDWu@8zN3A-T80 z=hXY8C*Zk@dK&Pq!n=)l&CMYUp;FP(Cz!+TdvL+$fy&}Y?;TV=GNngoXJQsQ8qyae zg^QH1yd2IoU>E8a$p^NvGZaTW5X&Jm<35AE>!?bYnV3ReTwwWdV%e&m+v*pI+?QlgFQi%9 zO}iCxG$uG3o=&9&8-bJRj~5kNV|__toml(Xry5f5Y56nJ&gYVzpWBB}aZSC&@0NTG z_g8!>E=ydZdT~U=ijzz#j8U??Obo55q7$QvwXaeykh65K(nib;N?@9^wlYv1xJe_* z)7i9~eDk)dWUxgq2`|Exe@!;Smm+$H0&ar26A|w~$y-#%1;c-gNmb-!wM@)zQEjfQAMu~9<13uC#02>$02quksAB!#bF`&-K$rW~V)GQ|+p_EljI_NXs|E&FOY^sA_ z|JyGif&pL#)q2qlS38=F#+Rez1FmMcK%(k8Z@A#+Z(zxm07?g!KcFCkKq|sy!7Ugz z{CTPvUGmTGfGKP2zRr#8exHGaGFMYMs#rIQLqASdF-pWDbzLyxs9Tl!`w6)yhY6Ax z6if6?IO%|ytu6$R9nxfwSF(7Dv%@A|dQ+L(@e{27JV*X&YX49g{(Uhs+wbKhXQy$9 z&Z$pJfC$g%bAI1RppOyWuM&$f51;!k0KNly-QW&M$oBKIxQiXb-4>PX`-S&Avimj; z(E{iZtRP*MbU=QvvP6bmbDJJ^N-Oi>TePltJx^B5GbS+Z)q3rMU-Mc0BXYmLoux&z z3F!{3PStk(m6(4KC2;Q84Q9HxVR6^Cl?9vxP^Y7i>-Bg}bLLk7$uE&6q-UtR968_s z_aL0uCvc~9Bz$p8B$|3|&KVaYDng{saZ`$ka#k%aTxw!HlyZ&0C?2XEHFWC6S~gNC zUqI4vnrHFMJZr6!d>2G}#pOR{t-Xdl!#$iU0=x3u0uk7@5&^ZyQ$@)FK~S;10en@1 z%{I#^Ak);Tm0_8A*#3yWh<5G-$_cox^*NpjIVttS755AkiWuv%=CCHJMk8Tlp-dNKr%dM#ySaaz%}2iau`OEeyK6Xkf$LL z!Y-g8R&37I;Z%>NUc!};9VSq?Y#8L!?N&`R{*SWGJE#dKi{n8t(xpfXEr3RvNau%i z2!x*m5}H4X(lii25~@^z(4>>ldyPo%U78?LgrGD*AP7oVDI(IncyqtIxx3w&_uhW@ z?fY+M=QF!A`>WOkr*`)(|CAxL2h?>>izN%q#KQ-DXx=VmO*0qh* zDmF?ZF?`B7jIgG@v;KwBNC)b>sQnY-q&MVOdCKM9&ueeBSo)cv()&nm59F;X%P6~x zjYyC&QhZ#ShFuCLX5IsY7Rf*h6o_C$+juei#)-u-<1Dh@%Zsx3iX4WdFbDVk(@eUS z94OZnj(4|AG)P~KR!Q-|R@$3s#2cUe%+_0`;(oe7i=wKmjBne2Y9@fT`3mbE>3ck= zPAizd-SqW)EdHEy_Q~@h?$QXkNVIdni7rvs^Z46Yo6qsLPaOL{1(MH;(6_A`o!qt+ z*tJittloe8l%GYQqH~Iu_>~m8UH8FiG|SOP!?EeWBPf5nOJa6ed9H;i@n^K^#_Y83 z_>F1XUk;16L0^7W(kgKYBwy?Zo}BQy2edskoHRT>M9()UPcMxYxG)Y%Hz(Y1L zcX3U@DsqcIt;ip}wI&0~K@N#qX3!J)xAZy2HlFy#OiP`+s6vR&hrv+hTp5z>+1~e! zbm*kXGbQenU|7+9{OkPel?z7my#40&H2aHd1;Nv3MKaG=<*@iJOtzJBUA&bTaxG5S zViOMWAsm0Cd!avFIR?Ln&n$VFu_x%Ql6ZK0VthCVY?eGIc|&~LlpbSRCf$o#l9(9E zQJQCMDCgacOA{_7q`-KE>ZpqtbSh&9rbkfsk02eQGQxj~%)OMqwg*hRCbbA?%`Fu< zOtgOPW9!XC_ai{TX_&fKMiFt@F6rIS&1bXBM#BrXtEnWR=#`8ZY>b(WQfsQAEP5t%hUb&2+Xy_GQ(Bd~=-!gMCk%nZ*3sXHbLsjK4$zre-UW?uPL}h>_yU zxMMvs6u!;_fo7k|VTbb5I=amtS-r-Q@4<@YGN=1KC_#!jQp*&T_nxuCeo3~bV#ho6 zH6aLc{IuczKIL$HF!#Yl^60$xJtl&?dUJDo-XNV{@U0eKt>pH_`$XvQE%s6=p8`(b z%l@p^@0$S;4A&ll1uxQaKSqNKU#U|9y+I8vAgc@>xeMU=9V_9HT2-e5&DXmIq@EcF z?3u;!OZhg2RP}_H<-J!OJ!1lxQy%rzbq??|57bF2^|7EnJ2+ZQpuxdbLAwo~AMHWj z)n=4+gqK{M{f1e#R{mu9taXa1)l|~wjvdwf62}aOMoKqp9yzuX<$92us-!rD(ODVE z(%!enIp;M~@u);Td3yKiA>SM9n_@ixKYXk@iK*;egRK8!-7!)~`CM3e7SGSVBA#eu zK_Zo#7d=(ND&|1x2ekHu0U1I^#0YUsKh0EoRk1nXyZiP*c6C#XSBmmL#! z|66ugX@ty68sIjs;O@(p7aTvVQ;5xtLzAm*=CY%a=W1TQA@lvnk@|#mNFaIV^x7jK zR*Auxm(?#4o=J*x2>`~CAK|Kw%W-v_?JjbjC2&?MD&HI_yrwT^kfDZmv*jQUjHI#S zP%}RM3Ji1$Gsk?>0k)p1`VA0)R;mVWAY9ZsKu2TM6L{{{qMvYMmo7vzC!z#pA#RFYhG}ys0^af+`E?XZr zqp3r$&UVTw2S$w>U0;F=1A29rQGP zM|FjrZJBMXwNy${%(^-@#+U@5<8cX~Y6(dU5OqS>Fv70Q-E3|Z6BwJqA%k~h8r}%)^1HlG3_O>MSZg-Q^mJ`nQt8qJ(q#RGdYIu5)LLFkg>~>2?+iYS|Z* zAye2Zya?)QvcK}!qAe=*&6eAL*vkW$B&M2cISm#=4xfc@lZ~*;@N~60vpv7I%uxS! zhy3c2Ir(<08MIMg86>vxIu9>f9=clM+QQ7yct5js2JYA|JjK-$;na|0KnO=jtoXcX ztE7MBElLM6ApAdmeK~^rMh;0Fl?Wjxs`nfkKTtP>7H?@@cktHkwZd;r;ZS@dpwcP( z`3hx|XWfxl)$3iCicgUp^us~pr}|E(hJNNHOR0xk&o`C#>fbP*2uiG|_tsgvC6WW0 zlfc4FSUL=0`Ds=f^iOXUX{^d5+`lVBJ)TDx`+kIwzkIIsi#W2F@s!$IxQ1o%iw`ng zC>jw*xXnAdV0J@MKq+cN(+sG|z4kEc0QY!og315fAzgi5xMo2&ow_$nc(cs~T2K|z zWJ}|Wk%bj7SMlK)R>e~KZDF4=ny+hNwCf@fGf=Q0s3zK{crr3L)W4=-LG#JignYfq zj=z$huXzh0N;u4Hl+Pz>F9$xDB=ai6C!c9++@;}m}- z=Rrsp<&=hC-Gzju6<8loOpcN4pssyR<%C{b{Hs3dP_>IqtB35NH;Y+S7>4t5A;ba%2cD(Vl_ z<%LIKTd5iP^6d\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CiscoASA/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cisco ASA](https://www.cisco.com/c/en_in/products/security/adaptive-security-appliance-asa-software/index.html) solution for Microsoft Sentinel enables you to ingest [Cisco ASA logs](https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/messages-listed-by-severity-level.html) into Microsoft Sentinel. \n\r\n**Cisco ASA/FTD via AMA** - This data connector helps in ingesting Cisco ASA logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). \r\n\n

\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Agent-based log collection (Syslog)](https://docs.microsoft.com/azure/sentinel/connect-syslog)\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 3, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CiscoASA/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Cisco ASA](https://www.cisco.com/c/en_in/products/security/adaptive-security-appliance-asa-software/index.html) solution for Microsoft Sentinel enables you to ingest [Cisco ASA logs](https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/messages-listed-by-severity-level.html) into Microsoft Sentinel. \n\r\n**Cisco ASA/FTD via AMA** - This data connector helps in ingesting Cisco ASA logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). \r\n\n

\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n a. [Agent-based log collection (Syslog)](https://docs.microsoft.com/azure/sentinel/connect-syslog)\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 3, **XDR Detections:** 3, **Custom Azure Logic Apps Connectors:** 1, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -51,6 +51,47 @@ } ], "steps": [ + { + "name": "contentSelection", + "label": "Content selection", + "elements": [ + { + "name": "DeployAnalyticsRule", + "type": "Microsoft.Common.CheckBox", + "label": "DeployAnalyticsRule", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + }, + { + "name": "DeployPlaybook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployPlaybook", + "defaultValue": true, + "toolTip": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + }, + { + "name": "DeployWorkbook", + "type": "Microsoft.Common.CheckBox", + "label": "DeployWorkbook", + "defaultValue": true, + "toolTip": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + }, + { + "name": "DeployDataConnector", + "type": "Microsoft.Common.CheckBox", + "label": "DeployDataConnector", + "defaultValue": true, + "toolTip": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + }, + { + "name": "DeployCustomDetection", + "type": "Microsoft.Common.CheckBox", + "label": "DeployCustomDetection", + "defaultValue": false, + "toolTip": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } + ] + }, { "name": "dataconnectors", "label": "Data Connectors", @@ -219,7 +260,12 @@ "outputs": { "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", - "workspace": "[basics('workspace')]" + "workspace": "[basics('workspace')]", + "DeployAnalyticsRule": "[steps('contentSelection').DeployAnalyticsRule]", + "DeployPlaybook": "[steps('contentSelection').DeployPlaybook]", + "DeployWorkbook": "[steps('contentSelection').DeployWorkbook]", + "DeployDataConnector": "[steps('contentSelection').DeployDataConnector]", + "DeployCustomDetection": "[steps('contentSelection').DeployCustomDetection]" } } } diff --git a/Solutions/CiscoASA/Package/mainTemplate.json b/Solutions/CiscoASA/Package/mainTemplate.json index 9318dd8f710..d4d49782254 100644 --- a/Solutions/CiscoASA/Package/mainTemplate.json +++ b/Solutions/CiscoASA/Package/mainTemplate.json @@ -35,13 +35,48 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployPlaybook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } } }, "variables": { "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CiscoASA", - "_solutionVersion": "3.0.9", + "_solutionVersion": "3.1.3", "solutionId": "azuresentinel.azure-sentinel-solution-ciscoasa", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.1.1", @@ -126,7 +161,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Cisco Workbook with template version 3.0.9", + "description": "Cisco Workbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -144,7 +179,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Cisco ASA/FTD\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[{\"id\":\"94910267-b8f6-4b30-aa2f-e5780ad9738e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"bb491a9f-3089-4a2e-a6de-e7efbc77e7f6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DeviceAddress\",\"label\":\"Device Address\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| distinct DeviceAddress\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Count by Action\\r\\nlet data = CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where DeviceAction != ''\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress});\\r\\ndata\\r\\n| summarize Count = count() by SimplifiedDeviceAction\\r\\n| join kind = inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction)\\r\\n on SimplifiedDeviceAction\\r\\n| project-away SimplifiedDeviceAction1, TimeGenerated\\r\\n| extend SimplifiedDeviceActions = SimplifiedDeviceAction\\r\\n| union (\\r\\n data \\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\\r\\n | extend jkey = 1) on jkey\\r\\n | extend SimplifiedDeviceAction = 'All', SimplifiedDeviceActions = '*' \\r\\n)\\r\\n| order by Count desc\\r\\n| take 10\",\"size\":3,\"exportFieldName\":\"SimplifiedDeviceAction\",\"exportParameterName\":\"SelectedDeviceAction\",\"exportDefaultValue\":\"All\",\"exportToExcelOptions\":\"visible\",\"title\":\"Events, by action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SimplifiedDeviceAction\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"showIcon\":true}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Events by action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Count by Severity\\r\\nlet data = CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress});\\r\\ndata\\r\\n| summarize Count = count() by LogSeverity\\r\\n| join kind = inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by LogSeverity)\\r\\n on LogSeverity\\r\\n| project-away LogSeverity1, TimeGenerated\\r\\n| extend LogSeveritys = LogSeverity\\r\\n| union (\\r\\n data \\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\\r\\n | extend jkey = 1) on jkey\\r\\n | extend LogSeverity = 'All', LogSeveritys = '*' \\r\\n)\\r\\n| order by Count desc, LogSeverity asc\\r\\n| take 10\",\"size\":3,\"exportFieldName\":\"LogSeverity\",\"exportParameterName\":\"SelectedLogSeverity\",\"exportDefaultValue\":\"All\",\"exportToExcelOptions\":\"visible\",\"title\":\"Severity, by volume\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"LogSeverity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"showIcon\":true}},\"showBorder\":false,\"sortCriteriaField\":\"LogSeverity\",\"sortOrderField\":1}},\"customWidth\":\"33\",\"name\":\"Severity by volume\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//volume by time\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where '{SelectedDeviceAction}' == \\\"All\\\" or '{SelectedDeviceAction}' == SimplifiedDeviceAction\\r\\n| where '{SelectedLogSeverity}' == \\\"All\\\" or '{SelectedLogSeverity}' == LogSeverity\\r\\n| summarize Volme=count() by bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Event trends, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"50\",\"name\":\"Severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//volume by time\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where '{SelectedDeviceAction}' == \\\"All\\\" or '{SelectedDeviceAction}' == SimplifiedDeviceAction\\r\\n| where '{SelectedLogSeverity}' == \\\"All\\\" or '{SelectedLogSeverity}' == LogSeverity\\r\\n| summarize Volume=count() by LogSeverity, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Event severity, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"50\",\"name\":\"Event severity by time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where '{SelectedDeviceAction}' == \\\"All\\\" or '{SelectedDeviceAction}' == SimplifiedDeviceAction\\r\\n| where '{SelectedLogSeverity}' == \\\"All\\\" or '{SelectedLogSeverity}' == LogSeverity\\r\\n| project TimeGenerated, LogSeverity, DeviceAction, SimplifiedDeviceAction, DeviceAddress, DestinationPort, DestinationIP, Message, Protocol, SourcePort, SourceIP\\r\\n| sort by TimeGenerated desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"All events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"name\":\"All events, by time\"},{\"type\":1,\"content\":{\"json\":\"---\"},\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//no. of concurrent sessions\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '302010'\\r\\n| extend ConcurrentSession= extract('%ASA-6-302010: ([0-9]*?) in use,',1,Message)\\r\\n| summarize AvgSession=avg(toint(ConcurrentSession)) by TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Average concurrent sessions, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"concurrent\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Max Sessions\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '302010'\\r\\n| extend MaxSessions= extract('%ASA-6-302010:.*, ([0-9].*?) most used',1,Message)\\r\\n| summarize AvgSession=avg(toint(MaxSessions)) by TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Average max concurrent sessions, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"max concurrent\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 reason for packet drop\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '733100'\\r\\n| extend TrafficType= extract('%ASA-4-733100: \\\\\\\\[(.*?)\\\\\\\\]',1,Message)\\r\\n| project TrafficType\\r\\n| summarize AttackCount=count() by TrafficType\\r\\n| top 5 by AttackCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 reasons for packet drop\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TrafficType\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"AttackCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"coldHot\",\"showIcon\":true}}]}},\"customWidth\":\"30\",\"name\":\"Top 5 reasons for packet drop\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Firewall log trends and activities\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Communication direction count by time\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection != ''\\r\\n| summarize DirectionVolume=count() by CommunicationDirection, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Inbound Outbound Time Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Inbound Outbound Time Trend\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//out bound\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'outbound'\\r\\n| summarize TrafficVolume=count() by SimplifiedDeviceAction, TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Outbound traffic connection, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Outbound traffic connection by time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//allowd vs denied for in bound\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound'\\r\\n| where SimplifiedDeviceAction in ('Deny', 'Allow')\\r\\n| summarize TrafficVolume=count() by SimplifiedDeviceAction, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Inbound traffic events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Inbound traffic events by time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Communication direction count\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection != ''\\r\\n| summarize DirectionVolume=count() by CommunicationDirection\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Summary of inbound and outbound traffic\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Summary of inbound and outbound traffic\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Top 5 allowed and blocked ports\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 port inbound Allow \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100' \\r\\n | where SimplifiedDeviceAction == 'Allow' \\r\\n//| where Message contains ' -> inside' \\r\\n| extend DestinationPortS=tostring(DestinationPort) \\r\\n| summarize PortCount=count() by DestinationPortS \\r\\n| top 5 by PortCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed inbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed inbound ports\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 port inbound deny\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound'\\r\\n | where SimplifiedDeviceAction == 'Deny'\\r\\n| extend DestinationPortS=tostring(DestinationPort)\\r\\n| summarize PortCount=count() by DestinationPortS\\r\\n| top 5 by PortCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 blocked inbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 blocked inbound ports\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 port outbound Allow\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100'\\r\\n | where SimplifiedDeviceAction == 'Allow'\\r\\n//| where Message contains ' -> management'\\r\\n| extend DestinationPortS=tostring(DestinationPort)\\r\\n| summarize PortCount=count() by DestinationPortS\\r\\n| top 5 by PortCount desc\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed outbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed outbound ports\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Outbound Ports Denied\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains'outbound'\\r\\n| where SimplifiedDeviceAction =='Deny'\\r\\n| extend DestinationPortS=tostring(DestinationPort)\\r\\n| summarize PortCount=count() by DestinationPortS\\r\\n| top 5 by PortCount desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied outbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 denied outbound ports\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Top 5 allowed and blocked IP addresses\"},\"name\":\"text - 20\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 protocol Deny\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where Protocol != ''\\r\\n| where SimplifiedDeviceAction == 'Deny'\\r\\n| summarize ProtocolCount= count() by Protocol\\r\\n| top 5 by ProtocolCount\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied protocols\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top 5 denied protocols\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 protocol Allow\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where Protocol != ''\\r\\n| where SimplifiedDeviceAction == 'Allow'\\r\\n| summarize ProtocolCount= count() by Protocol\\r\\n| top 5 by ProtocolCount\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed protocols\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top 5 allowed protocols\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Inbound Destination IP Addresses Blocked \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound' \\r\\n| where SimplifiedDeviceAction == 'Deny' \\r\\n| summarize IpCount= count() by DestinationIP \\r\\n| top 5 by IpCount desc nulls last \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 blocked inbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 blocked inbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Inbound Destination IP Addresses Allowed \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound' \\r\\n| where DestinationIP != '' \\r\\n| where SimplifiedDeviceAction == 'Allow' or SimplifiedDeviceAction == 'Built' \\r\\n| summarize IpCount= count() by DestinationIP \\r\\n| top 5 by IpCount desc nulls last\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed inbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed inbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 outbound deny dst ip\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100'\\r\\n | where SimplifiedDeviceAction == 'Deny'\\r\\n//| where Message contains ' -> management'\\r\\n| summarize IpCount= count() by DestinationIP\\r\\n| top 5 by IpCount desc nulls last\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied outbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 denied outbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 outbound Allow dst ip\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100'\\r\\n | where SimplifiedDeviceAction == 'Allow'\\r\\n | where Message contains ' -> management'\\r\\n| summarize IpCount= count() by DestinationIP\\r\\n| top 5 by IpCount desc nulls last\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed outbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed outbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Inbound Source IP Addresses Denied \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound' \\r\\n| where SimplifiedDeviceAction == 'Deny' \\r\\n| summarize IpCount= count() by SourceIP \\r\\n| top 5 by IpCount desc nulls last\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied inbound source IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 denied inbound source IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Outbound Source IP Addresses Allowed \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'outbound' \\r\\n| where SimplifiedDeviceAction == 'Built' \\r\\n| summarize IpCount= count() by SourceIP \\r\\n| top 5 by IpCount desc nulls last\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed outbound source IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed outbound source IP addresses\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Firewall management\"},\"name\":\"text - 29\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Source IP Addresses By Failed Authentication \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '611102' \\r\\n| extend IPAddress= extract('%ASA-6-611102:.*: IP address: (.*?), Uname.*',1,Message) \\r\\n| summarize IPAddressCount=count() by IPAddress \\r\\n| top 5 by IPAddressCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 source IP addresses, by failed authentication\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ipaddress\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IPCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 source IP addresses, by failed authentication\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\r\\n//Login Attempts For Nonexistent User Account \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '113015' \\r\\n| extend ipaddress=extract('%ASA-6-113015:.*: user IP = (.*)$',1,Message) \\r\\n| summarize IPCount=count() by ipaddress \\r\\n| top 5 by IPCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Logon attempts to nonexistent user account, by source IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ipaddress\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IPCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Logon attempts to nonexistent user account by source IP address\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 SSH Failed Attempt By Source IP \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '315011' \\r\\n| extend IP= extract('%ASA-6-315011: SSH session from (.*) on',1,Message) \\r\\n| summarize ReasonCount=count() by IP \\r\\n| top 5 by ReasonCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 SSH failed attempts, by source IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"IP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ReasonCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 SSH failed attempts by source IP address\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Authentocation Success\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '113012'\\r\\n| extend UserName= extract('%ASA-6-113012:.*: user = (.*)$',1,Message)\\r\\n| summarize UserCount=count() by UserName\\r\\n| top 5 by UserCount desc\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 successfully authenticated users\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"UserCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 successfully authenticated users\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 10 commands\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ \\\"Cisco\\\"\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == \\\"111008\\\"\\r\\n| extend CommandExecuted= extract(\\\"%ASA-5-111008: User '.*?' executed the '(.*?)' command.\\\",1,Message) \\r\\n| summarize Count= count() by CommandExecuted \\r\\n| top 10 by Count desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 Commands Executed on Firewall\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CommandExecuted\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 Commands Executed on Firewall\"}],\"fromTemplateId\":\"sentinel-Cisco\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Cisco ASA/FTD\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"query\":\"\",\"parameters\":[{\"id\":\"94910267-b8f6-4b30-aa2f-e5780ad9738e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}},{\"id\":\"bb491a9f-3089-4a2e-a6de-e7efbc77e7f6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DeviceAddress\",\"label\":\"Device Address\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| distinct DeviceAddress\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Count by Action\\r\\nlet data = CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where DeviceAction != ''\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress});\\r\\ndata\\r\\n| summarize Count = count() by SimplifiedDeviceAction\\r\\n| join kind = inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction)\\r\\n on SimplifiedDeviceAction\\r\\n| project-away SimplifiedDeviceAction1, TimeGenerated\\r\\n| extend SimplifiedDeviceActions = SimplifiedDeviceAction\\r\\n| union (\\r\\n data \\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\\r\\n | extend jkey = 1) on jkey\\r\\n | extend SimplifiedDeviceAction = 'All', SimplifiedDeviceActions = '*' \\r\\n)\\r\\n| order by Count desc\\r\\n| take 10\",\"size\":3,\"exportFieldName\":\"SimplifiedDeviceAction\",\"exportParameterName\":\"SelectedDeviceAction\",\"exportDefaultValue\":\"All\",\"exportToExcelOptions\":\"visible\",\"title\":\"Events, by action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"SimplifiedDeviceAction\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"showIcon\":true}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Events by action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Count by Severity\\r\\nlet data = CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress});\\r\\ndata\\r\\n| summarize Count = count() by LogSeverity\\r\\n| join kind = inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by LogSeverity)\\r\\n on LogSeverity\\r\\n| project-away LogSeverity1, TimeGenerated\\r\\n| extend LogSeveritys = LogSeverity\\r\\n| union (\\r\\n data \\r\\n | summarize Count = count() \\r\\n | extend jkey = 1\\r\\n | join kind=inner (data\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\\r\\n | extend jkey = 1) on jkey\\r\\n | extend LogSeverity = 'All', LogSeveritys = '*' \\r\\n)\\r\\n| order by Count desc, LogSeverity asc\\r\\n| take 10\",\"size\":3,\"exportFieldName\":\"LogSeverity\",\"exportParameterName\":\"SelectedLogSeverity\",\"exportDefaultValue\":\"All\",\"exportToExcelOptions\":\"visible\",\"title\":\"Severity, by volume\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"LogSeverity\",\"formatter\":1,\"formatOptions\":{\"showIcon\":true}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\",\"showIcon\":true},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"showIcon\":true}},\"showBorder\":false,\"sortCriteriaField\":\"LogSeverity\",\"sortOrderField\":1}},\"customWidth\":\"33\",\"name\":\"Severity by volume\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//volume by time\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where '{SelectedDeviceAction}' == \\\"All\\\" or '{SelectedDeviceAction}' == SimplifiedDeviceAction\\r\\n| where '{SelectedLogSeverity}' == \\\"All\\\" or '{SelectedLogSeverity}' == LogSeverity\\r\\n| summarize Volme=count() by bin(TimeGenerated,{TimeRange:grain})\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Event trends, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"50\",\"name\":\"Severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//volume by time\\r\\nCommonSecurityLog\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where \\\"{DeviceAddress:lable}\\\" == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where '{SelectedDeviceAction}' == \\\"All\\\" or '{SelectedDeviceAction}' == SimplifiedDeviceAction\\r\\n| where '{SelectedLogSeverity}' == \\\"All\\\" or '{SelectedLogSeverity}' == LogSeverity\\r\\n| summarize Volume=count() by LogSeverity, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Event severity, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"50\",\"name\":\"Event severity by time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where '{SelectedDeviceAction}' == \\\"All\\\" or '{SelectedDeviceAction}' == SimplifiedDeviceAction\\r\\n| where '{SelectedLogSeverity}' == \\\"All\\\" or '{SelectedLogSeverity}' == LogSeverity\\r\\n| project TimeGenerated, LogSeverity, DeviceAction, SimplifiedDeviceAction, DeviceAddress, DestinationPort, DestinationIP, Message, Protocol, SourcePort, SourceIP\\r\\n| sort by TimeGenerated desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"All events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true}},\"name\":\"All events, by time\"},{\"type\":1,\"content\":{\"json\":\"---\"},\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//no. of concurrent sessions\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '302010'\\r\\n| extend ConcurrentSession= extract('%ASA-6-302010: ([0-9]*?) in use,',1,Message)\\r\\n| summarize AvgSession=avg(toint(ConcurrentSession)) by TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Average concurrent sessions, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"concurrent\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Max Sessions\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '302010'\\r\\n| extend MaxSessions= extract('%ASA-6-302010:.*, ([0-9].*?) most used',1,Message)\\r\\n| summarize AvgSession=avg(toint(MaxSessions)) by TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Average max concurrent sessions, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"33\",\"name\":\"max concurrent\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 reason for packet drop\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '733100'\\r\\n| extend TrafficType= extract('%ASA-4-733100: \\\\\\\\[(.*?)\\\\\\\\]',1,Message)\\r\\n| project TrafficType\\r\\n| summarize AttackCount=count() by TrafficType\\r\\n| top 5 by AttackCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 reasons for packet drop\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TrafficType\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"AttackCount\",\"formatter\":4,\"formatOptions\":{\"palette\":\"coldHot\",\"showIcon\":true}}]}},\"customWidth\":\"30\",\"name\":\"Top 5 reasons for packet drop\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Firewall log trends and activities\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Communication direction count by time\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection != ''\\r\\n| summarize DirectionVolume=count() by CommunicationDirection, bin(TimeGenerated, {TimeRange:grain})\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Inbound Outbound Time Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Inbound Outbound Time Trend\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//out bound\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'outbound'\\r\\n| summarize TrafficVolume=count() by SimplifiedDeviceAction, TimeGenerated\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Outbound traffic connection, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Outbound traffic connection by time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//allowd vs denied for in bound\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound'\\r\\n| where SimplifiedDeviceAction in ('Deny', 'Allow')\\r\\n| summarize TrafficVolume=count() by SimplifiedDeviceAction, TimeGenerated\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Inbound traffic events, by time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Inbound traffic events by time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Communication direction count\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection != ''\\r\\n| summarize DirectionVolume=count() by CommunicationDirection\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Summary of inbound and outbound traffic\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\"},\"customWidth\":\"25\",\"name\":\"Summary of inbound and outbound traffic\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Top 5 allowed and blocked ports\"},\"name\":\"text - 15\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 port inbound Allow \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100' \\r\\n | where SimplifiedDeviceAction == 'Allow' \\r\\n//| where Message contains ' -> inside' \\r\\n| extend DestinationPortS=tostring(DestinationPort) \\r\\n| summarize PortCount=count() by DestinationPortS \\r\\n| top 5 by PortCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed inbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed inbound ports\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 port inbound deny\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound'\\r\\n | where SimplifiedDeviceAction == 'Deny'\\r\\n| extend DestinationPortS=tostring(DestinationPort)\\r\\n| summarize PortCount=count() by DestinationPortS\\r\\n| top 5 by PortCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 blocked inbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 blocked inbound ports\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 port outbound Allow\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100'\\r\\n | where SimplifiedDeviceAction == 'Allow'\\r\\n//| where Message contains ' -> management'\\r\\n| extend DestinationPortS=tostring(DestinationPort)\\r\\n| summarize PortCount=count() by DestinationPortS\\r\\n| top 5 by PortCount desc\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed outbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed outbound ports\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Outbound Ports Denied\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains'outbound'\\r\\n| where SimplifiedDeviceAction =='Deny'\\r\\n| extend DestinationPortS=tostring(DestinationPort)\\r\\n| summarize PortCount=count() by DestinationPortS\\r\\n| top 5 by PortCount desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied outbound ports\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationPortS\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"PortCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 denied outbound ports\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Top 5 allowed and blocked IP addresses\"},\"name\":\"text - 20\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 protocol Deny\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where Protocol != ''\\r\\n| where SimplifiedDeviceAction == 'Deny'\\r\\n| summarize ProtocolCount= count() by Protocol\\r\\n| top 5 by ProtocolCount\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied protocols\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top 5 denied protocols\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 protocol Allow\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where Protocol != ''\\r\\n| where SimplifiedDeviceAction == 'Allow'\\r\\n| summarize ProtocolCount= count() by Protocol\\r\\n| top 5 by ProtocolCount\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed protocols\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"25\",\"name\":\"Top 5 allowed protocols\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Inbound Destination IP Addresses Blocked \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound' \\r\\n| where SimplifiedDeviceAction == 'Deny' \\r\\n| summarize IpCount= count() by DestinationIP \\r\\n| top 5 by IpCount desc nulls last \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 blocked inbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 blocked inbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Inbound Destination IP Addresses Allowed \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound' \\r\\n| where DestinationIP != '' \\r\\n| where SimplifiedDeviceAction == 'Allow' or SimplifiedDeviceAction == 'Built' \\r\\n| summarize IpCount= count() by DestinationIP \\r\\n| top 5 by IpCount desc nulls last\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed inbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed inbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 outbound deny dst ip\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100'\\r\\n | where SimplifiedDeviceAction == 'Deny'\\r\\n//| where Message contains ' -> management'\\r\\n| summarize IpCount= count() by DestinationIP\\r\\n| top 5 by IpCount desc nulls last\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied outbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 denied outbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 5 outbound Allow dst ip\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '106100'\\r\\n | where SimplifiedDeviceAction == 'Allow'\\r\\n | where Message contains ' -> management'\\r\\n| summarize IpCount= count() by DestinationIP\\r\\n| top 5 by IpCount desc nulls last\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed outbound destination IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed outbound destination IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Inbound Source IP Addresses Denied \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'inbound' \\r\\n| where SimplifiedDeviceAction == 'Deny' \\r\\n| summarize IpCount= count() by SourceIP \\r\\n| top 5 by IpCount desc nulls last\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 denied inbound source IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 denied inbound source IP addresses\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Outbound Source IP Addresses Allowed \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where CommunicationDirection contains 'outbound' \\r\\n| where SimplifiedDeviceAction == 'Built' \\r\\n| summarize IpCount= count() by SourceIP \\r\\n| top 5 by IpCount desc nulls last\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 allowed outbound source IP addresses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IpCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 allowed outbound source IP addresses\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Firewall management\"},\"name\":\"text - 29\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 Source IP Addresses By Failed Authentication \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '611102' \\r\\n| extend IPAddress= extract('%ASA-6-611102:.*: IP address: (.*?), Uname.*',1,Message) \\r\\n| summarize IPAddressCount=count() by IPAddress \\r\\n| top 5 by IPAddressCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 source IP addresses, by failed authentication\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ipaddress\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IPCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 source IP addresses, by failed authentication\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\r\\n//Login Attempts For Nonexistent User Account \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '113015' \\r\\n| extend ipaddress=extract('%ASA-6-113015:.*: user IP = (.*)$',1,Message) \\r\\n| summarize IPCount=count() by ipaddress \\r\\n| top 5 by IPCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Logon attempts to nonexistent user account, by source IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ipaddress\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"IPCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Logon attempts to nonexistent user account by source IP address\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Top 5 SSH Failed Attempt By Source IP \\r\\nCommonSecurityLog \\r\\n| where DeviceProduct in~ ('ASA', 'FTD') \\r\\n| where DeviceVendor =~ 'Cisco' \\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '315011' \\r\\n| extend IP= extract('%ASA-6-315011: SSH session from (.*) on',1,Message) \\r\\n| summarize ReasonCount=count() by IP \\r\\n| top 5 by ReasonCount desc\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 SSH failed attempts, by source IP address\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"IP\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"ReasonCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 SSH failed attempts by source IP address\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//Authentocation Success\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ 'Cisco'\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == '113012'\\r\\n| extend UserName= extract('%ASA-6-113012:.*: user = (.*)$',1,Message)\\r\\n| summarize UserCount=count() by UserName\\r\\n| top 5 by UserCount desc\\r\\n\",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 successfully authenticated users\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"UserCount\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 successfully authenticated users\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"//top 10 commands\\r\\nCommonSecurityLog\\r\\n| where DeviceProduct in~ ('ASA', 'FTD')\\r\\n| where DeviceVendor =~ \\\"Cisco\\\"\\r\\n| where '{DeviceAddress:label}' == \\\"All\\\" or DeviceAddress in ({DeviceAddress})\\r\\n| where DeviceEventClassID == \\\"111008\\\"\\r\\n| extend CommandExecuted= extract(\\\"%ASA-5-111008: User '.*?' executed the '(.*?)' command.\\\",1,Message) \\r\\n| summarize Count= count() by CommandExecuted \\r\\n| top 10 by Count desc \",\"size\":0,\"exportToExcelOptions\":\"visible\",\"title\":\"Top 5 Commands Executed on Firewall\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"CommandExecuted\",\"formatter\":0,\"formatOptions\":{\"showIcon\":true}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"showIcon\":true}}]}},\"customWidth\":\"25\",\"name\":\"Top 5 Commands Executed on Firewall\"}],\"fromTemplateId\":\"sentinel-Cisco\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -203,7 +238,8 @@ "contentProductId": "[variables('_workbookcontentProductId1')]", "id": "[variables('_workbookcontentProductId1')]", "version": "[variables('workbookVersion1')]" - } + }, + "condition": "[parameters('DeployWorkbook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -214,7 +250,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA data connector with template version 3.0.9", + "description": "CiscoASA data connector with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -360,7 +396,8 @@ "contentProductId": "[variables('_dataConnectorcontentProductId1')]", "id": "[variables('_dataConnectorcontentProductId1')]", "version": "[variables('dataConnectorVersion1')]" - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", @@ -390,7 +427,8 @@ "email": "support@microsoft.com", "link": "https://support.microsoft.com/" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", @@ -490,7 +528,8 @@ ], "id": "[variables('_uiConfigId1')]" } - } + }, + "condition": "[parameters('DeployDataConnector')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -501,7 +540,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASAConnector Playbook with template version 3.0.9", + "description": "CiscoASAConnector Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -2649,7 +2688,8 @@ "contentProductId": "[variables('_playbookcontentProductId1')]", "id": "[variables('_playbookcontentProductId1')]", "version": "[variables('playbookVersion1')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -2660,7 +2700,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-AddIPtoNetworkObjectGroup Playbook with template version 3.0.9", + "description": "CiscoASA-AddIPtoNetworkObjectGroup Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -3416,7 +3456,8 @@ "contentProductId": "[variables('_playbookcontentProductId2')]", "id": "[variables('_playbookcontentProductId2')]", "version": "[variables('playbookVersion2')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -3427,7 +3468,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-CreateACEInACL Playbook with template version 3.0.9", + "description": "CiscoASA-CreateACEInACL Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -4197,7 +4238,8 @@ "contentProductId": "[variables('_playbookcontentProductId3')]", "id": "[variables('_playbookcontentProductId3')]", "version": "[variables('playbookVersion3')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -4208,7 +4250,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-CreateInboundAccessRuleOnInterface Playbook with template version 3.0.9", + "description": "CiscoASA-CreateInboundAccessRuleOnInterface Playbook with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion4')]", @@ -4978,7 +5020,8 @@ "contentProductId": "[variables('_playbookcontentProductId4')]", "id": "[variables('_playbookcontentProductId4')]", "version": "[variables('playbookVersion4')]" - } + }, + "condition": "[parameters('DeployPlaybook')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -4989,7 +5032,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-ThreatDetectionMessage_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "CiscoASA-ThreatDetectionMessage_AnalyticalRules Analytics Rule with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -5017,10 +5060,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CiscoAsaAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CiscoAsaAma" + ] } ], "tactics": [ @@ -5033,22 +5076,22 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } - ] + ], + "entityType": "IP" } ] } @@ -5093,7 +5136,8 @@ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5104,7 +5148,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-PossibleDataExfiltration_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "CiscoASA-PossibleDataExfiltration_AnalyticalRules Analytics Rule with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -5132,10 +5176,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CiscoAsaAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CiscoAsaAma" + ] } ], "tactics": [ @@ -5147,22 +5191,22 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "DestinationIP" + "columnName": "DestinationIP", + "identifier": "Address" } - ] + ], + "entityType": "IP" } ] } @@ -5207,7 +5251,8 @@ "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", @@ -5218,7 +5263,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CiscoASA-AvgAttackDetectRateIncrease_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "CiscoASA-AvgAttackDetectRateIncrease_AnalyticalRules Analytics Rule with template version 3.1.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -5246,10 +5291,10 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "CiscoAsaAma", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "CiscoAsaAma" + ] } ], "tactics": [ @@ -5262,30 +5307,30 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "HostNameDomain" + "columnName": "HostNameDomain", + "identifier": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } - ] + ], + "entityType": "IP" } ] } @@ -5330,19 +5375,20 @@ "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" - } + }, + "condition": "[parameters('DeployAnalyticsRule')]" }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.9", + "version": "3.1.3", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "CiscoASA", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Cisco ASA solution for Microsoft Sentinel enables you to ingest Cisco ASA logs into Microsoft Sentinel.

\n

Cisco ASA/FTD via AMA - This data connector helps in ingesting Cisco ASA logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here.

\n

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Agent-based log collection (Syslog)
    2. \n
\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 3, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Cisco ASA solution for Microsoft Sentinel enables you to ingest Cisco ASA logs into Microsoft Sentinel.

\n

Cisco ASA/FTD via AMA - This data connector helps in ingesting Cisco ASA logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here.

\n

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Agent-based log collection (Syslog)
    2. \n
\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 3, XDR Detections: 3, Custom Azure Logic Apps Connectors: 1, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -5411,6 +5457,21 @@ "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "version": "3.1.3" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "version": "3.1.3" + }, + { + "kind": "CustomDetection", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "version": "3.1.3" } ] }, @@ -5425,6 +5486,611 @@ } }, "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CiscoASA-CD-xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "detectionAction": { + "alertTemplate": { + "title": "Cisco ASA - threat detection message fired", + "description": "'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105\nResources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", + "customDetails": { + "HostFullName": "DeviceName" + }, + "entityMappings": { + "ips": [ + { + "addressColumn": "SourceIP", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ], + "hosts": [ + { + "nameColumn": "DeviceName", + "id": "[if(true(), 'host1', 'host1')]" + } + ] + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "medium" + } + }, + "status": "disabled", + "queryCondition": { + "queryText": "CommonSecurityLog\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID in (\"733101\",\"733102\",\"733103\",\"733104\",\"733105\")\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - threat detection message fired", + "id": "[if(true(), 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e', 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentVersion": "3.1.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CiscoASA-CD-xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105\nResources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "detectionAction": { + "alertTemplate": { + "title": "Cisco ASA - threat detection message fired", + "description": "'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105\nResources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", + "customDetails": { + "HostFullName": "DeviceName" + }, + "entityMappings": { + "ips": [ + { + "addressColumn": "SourceIP", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ], + "hosts": [ + { + "nameColumn": "DeviceName", + "id": "[if(true(), 'host1', 'host1')]" + } + ] + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "medium" + } + }, + "status": "disabled", + "queryCondition": { + "queryText": "CommonSecurityLog\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID in (\"733101\",\"733102\",\"733103\",\"733104\",\"733105\")\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - threat detection message fired", + "id": "[if(true(), 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e', 'xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentVersion": "3.1.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentKind": "CustomDetection", + "displayName": "Cisco ASA - threat detection message fired", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e','-','3.1.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e','-','3.1.3')))]", + "version": "3.1.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e", + "contentVersion": "3.1.3", + "requiredWorkloads": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CiscoASA-CD-xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "tactics": [ + { + "tactic": "Exfiltration", + "techniques": [ + { + "technique": "T1041" + }, + { + "technique": "T1048" + } + ] + } + ], + "entityMappings": { + "ips": [ + { + "addressColumn": "SourceIP", + "id": "[if(true(), 'ip1', 'ip1')]" + }, + { + "addressColumn": "DestinationIP", + "id": "[if(true(), 'ip2', 'ip2')]" + } + ] + }, + "title": "Cisco ASA - Possible Data Exfiltration Detection", + "description": "'Detects potential data exfiltration when an internal source IP sends a large amount of outbound data to the internet, especially when the volume is significantly higher than its normal behavior.'" + } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let Lookback = 1h;\nlet MinUploadBytes = 1073741824;\nlet MinUploadRatio = 95.0;\nCommonSecurityLog\n| where TimeGenerated > ago(Lookback)\n| where DeviceProduct has_any (\"ASA\", \"FTD\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| where ipv4_is_private(SourceIP)\n| where not(ipv4_is_private(DestinationIP))\n| where DeviceAction in~ (\"allow\", \"allowed\", \"accept\", \"accepted\", \"permitted\")\n| extend SentBytesLong = tolong(SentBytes)\n| extend ReceivedBytesLong = tolong(ReceivedBytes)\n| where isnotnull(SentBytesLong)\n| summarize\n TotalBytesSent = sum(SentBytesLong),\n TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),\n Connections = count(),\n DestinationPorts = make_set(DestinationPort, 20),\n Applications = make_set(ApplicationProtocol, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SourceIP, DestinationIP\n| where TotalBytesSent >= MinUploadBytes\n| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)\n| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)\n| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)\n| where UploadRatio >= MinUploadRatio\n| project\n TimeGenerated = LastSeen,\n SourceIP,\n DestinationIP,\n TotalGBSent,\n TotalGBReceived,\n UploadRatio,\n Connections,\n DestinationPorts,\n Applications,\n FirstSeen,\n LastSeen\n| order by TotalGBSent desc" + }, + "displayName": "Cisco ASA - Possible Data Exfiltration Detection", + "id": "[if(true(), 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72', 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentVersion": "3.1.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CiscoASA-CD-xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'Detects potential data exfiltration when an internal source IP sends a large amount of outbound data to the internet, especially when the volume is significantly higher than its normal behavior.'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "detectionAction": { + "alertTemplate": { + "severity": "medium", + "tactics": [ + { + "tactic": "Exfiltration", + "techniques": [ + { + "technique": "T1041" + }, + { + "technique": "T1048" + } + ] + } + ], + "entityMappings": { + "ips": [ + { + "addressColumn": "SourceIP", + "id": "[if(true(), 'ip1', 'ip1')]" + }, + { + "addressColumn": "DestinationIP", + "id": "[if(true(), 'ip2', 'ip2')]" + } + ] + }, + "title": "Cisco ASA - Possible Data Exfiltration Detection", + "description": "'Detects potential data exfiltration when an internal source IP sends a large amount of outbound data to the internet, especially when the volume is significantly higher than its normal behavior.'" + } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let Lookback = 1h;\nlet MinUploadBytes = 1073741824;\nlet MinUploadRatio = 95.0;\nCommonSecurityLog\n| where TimeGenerated > ago(Lookback)\n| where DeviceProduct has_any (\"ASA\", \"FTD\")\n| where isnotempty(SourceIP) and isnotempty(DestinationIP)\n| where ipv4_is_private(SourceIP)\n| where not(ipv4_is_private(DestinationIP))\n| where DeviceAction in~ (\"allow\", \"allowed\", \"accept\", \"accepted\", \"permitted\")\n| extend SentBytesLong = tolong(SentBytes)\n| extend ReceivedBytesLong = tolong(ReceivedBytes)\n| where isnotnull(SentBytesLong)\n| summarize\n TotalBytesSent = sum(SentBytesLong),\n TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)),\n Connections = count(),\n DestinationPorts = make_set(DestinationPort, 20),\n Applications = make_set(ApplicationProtocol, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SourceIP, DestinationIP\n| where TotalBytesSent >= MinUploadBytes\n| extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2)\n| extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2)\n| extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2)\n| where UploadRatio >= MinUploadRatio\n| project\n TimeGenerated = LastSeen,\n SourceIP,\n DestinationIP,\n TotalGBSent,\n TotalGBReceived,\n UploadRatio,\n Connections,\n DestinationPorts,\n Applications,\n FirstSeen,\n LastSeen\n| order by TotalGBSent desc" + }, + "displayName": "Cisco ASA - Possible Data Exfiltration Detection", + "id": "[if(true(), 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72', 'xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentVersion": "3.1.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentKind": "CustomDetection", + "displayName": "Cisco ASA - Possible Data Exfiltration Detection", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72','-','3.1.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72','-','3.1.3')))]", + "version": "3.1.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72", + "contentVersion": "3.1.3", + "requiredWorkloads": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "CiscoASA-CD-xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "mode": "Incremental", + "expressionEvaluationOptions": { + "scope": "inner" + }, + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "detectionAction": { + "alertTemplate": { + "title": "Cisco ASA - average attack detection rate increase", + "description": "'This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100\nReferences: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", + "customDetails": { + "HostFullName": "DeviceName" + }, + "entityMappings": { + "ips": [ + { + "addressColumn": "SourceIP", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "HostNameDomain", + "nameColumn": "HostName" + } + ] + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "low" + } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let timeframe = 1h;\nlet last1h = CommonSecurityLog\n| where TimeGenerated >= ago(timeframe)\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlet prev6h = CommonSecurityLog\n| where TimeGenerated between (ago(6h) .. ago(1h))\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec)\nby DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlast1h | join (\n prev6h\n) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate\n| project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec\n// Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours\n| where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - average attack detection rate increase", + "id": "[if(true(), 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1', 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentVersion": "3.1.3" + } + } + } + } + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-cd-',uniquestring('xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[resourceId('Microsoft.Resources/deployments', 'CiscoASA-CD-xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "'This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100\nReferences: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", + "contentVersion": "1.0.0", + "imports": { + "MicrosoftSecurity": { + "provider": "MicrosoftSecurity", + "version": "1.0.0" + } + }, + "resources": { + "detectionRule": { + "import": "MicrosoftSecurity", + "type": "Microsoft.Security/detectionRules@2026-06-01-preview", + "properties": { + "schedule": { + "frequency": "PT1H" + }, + "detectionAction": { + "alertTemplate": { + "title": "Cisco ASA - average attack detection rate increase", + "description": "'This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100\nReferences: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html\nDetails on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html'", + "customDetails": { + "HostFullName": "DeviceName" + }, + "entityMappings": { + "ips": [ + { + "addressColumn": "SourceIP", + "id": "[if(true(), 'ip1', 'ip1')]" + } + ], + "hosts": [ + { + "id": "[if(true(), 'host1', 'host1')]", + "dnsDomainColumn": "HostNameDomain", + "nameColumn": "HostName" + } + ] + }, + "tactics": [ + { + "tactic": "Discovery", + "techniques": [ + { + "technique": "T1046" + } + ] + } + ], + "severity": "low" + } + }, + "status": "disabled", + "queryCondition": { + "queryText": "let timeframe = 1h;\nlet last1h = CommonSecurityLog\n| where TimeGenerated >= ago(timeframe)\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlet prev6h = CommonSecurityLog\n| where TimeGenerated between (ago(6h) .. ago(1h))\n| where isempty(CommunicationDirection)\n| where DeviceEventClassID == \"733100\"\n| extend SourceOfDropRateCount = tostring(split(tostring(split(Message, \"]\")[0]),\"[ \")[1])\n| extend splitMessage = split(Message, \".\")\n| extend DropRate = tostring(split(tostring(splitMessage[0]),\"] \")[1])\n| extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1]),\" \")[0]),\"is \")\n| extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1]),\" \")[0])\n| extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2])\n| extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1]),\" \")[1]),\"is \")\n| extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1]),\" \")[0])\n| extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2])\n| extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1]),\" \")[2]),\"is \")[1])\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec)\nby DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate;\nlast1h | join (\n prev6h\n) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate\n| project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec\n// Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours\n| where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec\n| extend HostName = tostring(split(DeviceName, \".\")[0]), DomainIndex = toint(indexof(DeviceName, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName)" + }, + "displayName": "Cisco ASA - average attack detection rate increase", + "id": "[if(true(), 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1', 'xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1')]", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentVersion": "3.1.3" + } + } + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentKind": "CustomDetection", + "displayName": "Cisco ASA - average attack detection rate increase", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1','-','3.1.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','cd','-', uniqueString(concat(variables('_solutionId'),'-','CustomDetection','-','xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1','-','3.1.3')))]", + "version": "3.1.3", + "contentProvenance": { + "packageId": "azuresentinel.azure-sentinel-solution-ciscoasa", + "packageVersion": "3.1.3", + "contentId": "xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1", + "contentVersion": "3.1.3", + "requiredWorkloads": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "workload": "sentinel" + } + ], + "requiredDataConnectors": [ + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" + } + ] + } + }, + "condition": "[parameters('DeployCustomDetection')]" + }, + { + "type": "Microsoft.Resources/deployments", + "apiVersion": "2025-04-01", + "name": "pid-3a2fe349-a98b-4e96-83d2-045415a8ffa9-partnercenter", + "properties": { + "mode": "Incremental", + "template": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "resources": [] + } + } } ], "outputs": {} diff --git a/Solutions/CiscoASA/Package/testParameters.json b/Solutions/CiscoASA/Package/testParameters.json index b1cecba0740..2812ef3b7d9 100644 --- a/Solutions/CiscoASA/Package/testParameters.json +++ b/Solutions/CiscoASA/Package/testParameters.json @@ -28,5 +28,40 @@ "metadata": { "description": "Name for the workbook" } + }, + "DeployAnalyticsRule": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel analytic rules carried by this solution (ContentKind AnalyticsRule and its AnalyticsRuleTemplate registration face)." + } + }, + "DeployPlaybook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the playbooks carried by this solution and the automation assets they depend on (PlaybookTemplate, AzureFunction, LogicAppsCustomConnector). These are never shipped independently of the playbook they serve." + } + }, + "DeployWorkbook": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the Microsoft Sentinel workbook content and its Content Hub registration carried by this solution (ContentKind Workbook and WorkbookTemplate)." + } + }, + "DeployDataConnector": { + "type": "bool", + "defaultValue": true, + "metadata": { + "description": "Deploy the data connectors carried by this solution, together with their metadata and catalog entries (ContentKind DataConnector, ResourceDataConnector and DataType)." + } + }, + "DeployCustomDetection": { + "type": "bool", + "defaultValue": false, + "metadata": { + "description": "Deploy the XDR-native custom detection resources and their Content Hub registrations (ContentKind CustomDetection and CustomDetectionTemplate). Independent of DeployAnalyticsRule: both kinds can be selected together. Existing analytic-rule instances are not disabled or removed. CD enabled or disabled status is controlled separately from this deployment switch." + } } } diff --git a/Solutions/CiscoASA/ReleaseNotes.md b/Solutions/CiscoASA/ReleaseNotes.md index 1e831a7a5ff..f33b06a2c87 100644 --- a/Solutions/CiscoASA/ReleaseNotes.md +++ b/Solutions/CiscoASA/ReleaseNotes.md @@ -1,5 +1,9 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|------------------------------------------------------------------------------| +| 3.1.3 | 13-10-2026 | Added workload, data-type, and connector prerequisite records to all three disabled XDR Custom Detections. Updated XDR content versions to 3.1.3 and V3.1 packaging to include resolved package/content provenance in installation and Content Hub registration records. | +| 3.1.2 | 12-10-2026 | Refreshed the V3.1 hybrid package for three disabled Defender XDR Custom Detections with reviewed Host mappings and source-rule provenance. | +| 3.1.1 | 11-10-2026 | Added a reviewed Host mapping to the threat-message Custom Detection and recorded accepted Host-mapping assumptions while preserving original host values in alert details. | +| 3.1.0 | 11-10-2026 | Added three disabled Defender XDR Custom Detections with source-rule provenance and V3.1 hybrid packaging support. | | 3.0.9 | 15-09-2026 |Updated the CiscoASA workbook and analytic rules to incorporate FTD logs alongside ASA logs. | | 3.0.8 | 22-08-2026 | Added new detection rule for Possible Data Exfilteration | | 3.0.7 | 01-09-2025 | Updates to the `template_CiscoAsaAma.json` file to reflect the general availability of the Cisco ASA/FTD via AMA connector | diff --git a/Solutions/CiscoASA/SolutionMetadata.json b/Solutions/CiscoASA/SolutionMetadata.json index d69f02d0df3..fda2ab8ab4d 100644 --- a/Solutions/CiscoASA/SolutionMetadata.json +++ b/Solutions/CiscoASA/SolutionMetadata.json @@ -1,16 +1,22 @@ { - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-ciscoasa", - "firstPublishDate": "2022-05-23", - "providers": ["Cisco"], - "categories": { - "domains" : ["Security - Automation (SOAR)"], - "verticals": [] - }, - "support": { - "tier": "Microsoft", - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "link": "https://support.microsoft.com/" - } -} \ No newline at end of file + "trackingId": "pid-3a2fe349-a98b-4e96-83d2-045415a8ffa9-partnercenter", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-ciscoasa", + "firstPublishDate": "2022-05-23", + "providers": [ + "Cisco" + ], + "categories": { + "domains": [ + "Security - Automation (SOAR)" + ], + "verticals": [] + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + }, + "version": "3.1.3" +} diff --git a/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml b/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml new file mode 100644 index 00000000000..5f5ff05f73c --- /dev/null +++ b/Solutions/CiscoASA/XDR Detections/CiscoASA-AvgAttackDetectRateIncrease.yaml @@ -0,0 +1,154 @@ +schemaVersion: 1.0.0 +version: 3.1.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 79f29feb-6a9d-4cdf-baaa-2daf480a5da1 + path: Analytic Rules/CiscoASA-AvgAttackDetectRateIncrease.yaml + version: 1.0.3 + querySha256: 5bb9db1a60eb71e21009f4b1e0d049090642e0c89b8c693d50b3f66219bb1143 + schedule: + queryFrequency: 1h + queryPeriod: 6h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=6h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Best-effort entity mapping requires review: source Host.FullName column `DeviceName` is provisionally represented by + hosts.nameColumn `HostName`; confirm that this column is the intended host identifier. The original value is also retained + in customDetails when the query output binding is available; this assumption does not prove entity parity' + - Host.FullName value is retained as customDetails.HostFullName from query column `DeviceName`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.HostFullName column `DeviceName` requires runtime output-schema binding verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Discovery + - Impact + originalTechniques: + - T1046 + - T1498 + reviewScope: + sourceDocumentSha256: 8e3a5cd157088c224cdaf56c1505b3175865e771700c9fc14afac7b2cc042c87 + targetQuerySha256: d97131b413ab064a6fc032c18fadc8fe78c6eaa2ee5973230904cf6528704b8e + reviewDecisions: + - reason: 'Best-effort entity mapping requires review: source Host.FullName column `DeviceName` is provisionally represented + by hosts.nameColumn `HostName`; confirm that this column is the intended host identifier. The original value is also + retained in customDetails when the query output binding is available; this assumption does not prove entity parity' + decision: accepted + sourceDocumentSha256: 8e3a5cd157088c224cdaf56c1505b3175865e771700c9fc14afac7b2cc042c87 + targetQuerySha256: d97131b413ab064a6fc032c18fadc8fe78c6eaa2ee5973230904cf6528704b8e + supplementalEntityDetails: + - entityType: Host + entityIndex: 1 + identifier: FullName + sourceColumn: DeviceName + column: DeviceName + status: runtime-binding-pending + customDetailKey: HostFullName + acceptedReviewReasons: + - 'Best-effort entity mapping requires review: source Host.FullName column `DeviceName` is provisionally represented by + hosts.nameColumn `HostName`; confirm that this column is the intended host identifier. The original value is also retained + in customDetails when the query output binding is available; this assumption does not prove entity parity' +properties: + id: xdr-79f29feb-6a9d-4cdf-baaa-2daf480a5da1 + displayName: Cisco ASA - average attack detection rate increase + status: disabled + queryCondition: + queryText: |- + let timeframe = 1h; + let last1h = CommonSecurityLog + | where TimeGenerated >= ago(timeframe) + | where isempty(CommunicationDirection) + | where DeviceEventClassID == "733100" + | extend SourceOfDropRateCount = tostring(split(tostring(split(Message, "]")[0]),"[ ")[1]) + | extend splitMessage = split(Message, ".") + | extend DropRate = tostring(split(tostring(splitMessage[0]),"] ")[1]) + | extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1])," ")[0]),"is ") + | extend CurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1])," ")[0]) + | extend MaxConfiguredBurstRate = toint(CurrentBurstRate[2]) + | extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1])," ")[1]),"is ") + | extend CurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1])," ")[0]) + | extend MaxConfiguredAvgRate = toint(CurrentAvgRate[2]) + | extend CumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1])," ")[2]),"is ")[1]) + | summarize last1hCumTotal = sum(CumulativeTotal), last1hAvgRatePerSec = avg(CurrentAvgRatePerSec), last1hAvgBurstRatePerSec = avg(CurrentBurstRatePerSec) by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate; + let prev6h = CommonSecurityLog + | where TimeGenerated between (ago(6h) .. ago(1h)) + | where isempty(CommunicationDirection) + | where DeviceEventClassID == "733100" + | extend SourceOfDropRateCount = tostring(split(tostring(split(Message, "]")[0]),"[ ")[1]) + | extend splitMessage = split(Message, ".") + | extend DropRate = tostring(split(tostring(splitMessage[0]),"] ")[1]) + | extend CurrentBurstRate = split(tostring(split(tostring(splitMessage[1])," ")[0]),"is ") + | extend prevCurrentBurstRatePerSec = toint(split(tostring(CurrentBurstRate[1])," ")[0]) + | extend prevMaxConfiguredBurstRate = toint(CurrentBurstRate[2]) + | extend CurrentAvgRate = split(tostring(split(tostring(splitMessage[1])," ")[1]),"is ") + | extend prevCurrentAvgRatePerSec = toint(split(tostring(CurrentAvgRate[1])," ")[0]) + | extend prevMaxConfiguredAvgRate = toint(CurrentAvgRate[2]) + | extend prevCumulativeTotal = toint(split(tostring(split(tostring(splitMessage[1])," ")[2]),"is ")[1]) + | summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated), prev6hCumTotal = sum(prevCumulativeTotal), prev6hAvgRatePerSec = avg(prevCurrentAvgRatePerSec), prev6hAvgBurstRatePerSec = avg(prevCurrentBurstRatePerSec) + by DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate; + last1h | join ( + prev6h + ) on DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate + | project StartTimeUtc, EndTimeUtc, DeviceName, DeviceEventClassID, SourceIP, SourceOfDropRateCount, DropRate, last1hCumTotal, prev6hCumTotal, prev6hAvgCumTotal = prev6hCumTotal/6, last1hAvgRatePerSec, prev6hAvgRatePerSec, last1hAvgBurstRatePerSec, prev6hAvgBurstRatePerSec + // Select only events that indicate a doubling of the expected rate in the last hour over the previous 6 hours + | where last1hCumTotal > 2*prev6hAvgCumTotal or last1hAvgRatePerSec > 2*prev6hAvgRatePerSec or last1hAvgBurstRatePerSec > 2*prev6hAvgBurstRatePerSec + | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.')) + | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Cisco ASA - average attack detection rate increase + description: |- + 'This will help you determine if Cisco ASA devices are under heavier attack than normal over the last hour versus the previous 6 hours based on DeviceEventClassID 733100 + References: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html + Details on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html' + severity: low + entityMappings: + hosts: + - id: host1 + nameColumn: HostName + dnsDomainColumn: HostNameDomain + ips: + - id: ip1 + addressColumn: SourceIP + tactics: + - tactic: Discovery + techniques: + - technique: T1046 + - tactic: Impact + techniques: + - technique: T1498 + customDetails: + HostFullName: DeviceName diff --git a/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml b/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml new file mode 100644 index 00000000000..0f8d0e8f68a --- /dev/null +++ b/Solutions/CiscoASA/XDR Detections/CiscoASA-PossibleDataExfiltration.yaml @@ -0,0 +1,115 @@ +schemaVersion: 1.0.0 +version: 3.1.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72 + path: Analytic Rules/CiscoASA-PossibleDataExfiltration.yaml + version: 1.0.2 + querySha256: f1d897203ad69c043b0c39637d5d5453043c2a5125da58fb4661ee7cfaf54712 + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + informational: [] + errors: [] + originalTactics: + - Exfiltration + originalTechniques: + - T1041 + - T1048 + reviewScope: + sourceDocumentSha256: 8c396f191884d39b0116322d96829140ed5bec7fd7de3118579390ebd7129728 + targetQuerySha256: 6a81fb5eae70a7441a378b0a8cf6e5073747c7376befbedf5b36f6bb601dad64 +properties: + id: xdr-f3a8c2d0-7b41-4e9a-9f6a-2d8a1c4e5b72 + displayName: Cisco ASA - Possible Data Exfiltration Detection + status: disabled + queryCondition: + queryText: |- + let Lookback = 1h; + let MinUploadBytes = 1073741824; + let MinUploadRatio = 95.0; + CommonSecurityLog + | where TimeGenerated > ago(Lookback) + | where DeviceProduct has_any ("ASA", "FTD") + | where isnotempty(SourceIP) and isnotempty(DestinationIP) + | where ipv4_is_private(SourceIP) + | where not(ipv4_is_private(DestinationIP)) + | where DeviceAction in~ ("allow", "allowed", "accept", "accepted", "permitted") + | extend SentBytesLong = tolong(SentBytes) + | extend ReceivedBytesLong = tolong(ReceivedBytes) + | where isnotnull(SentBytesLong) + | summarize + TotalBytesSent = sum(SentBytesLong), + TotalBytesReceived = sum(coalesce(ReceivedBytesLong, 0)), + Connections = count(), + DestinationPorts = make_set(DestinationPort, 20), + Applications = make_set(ApplicationProtocol, 20), + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated) + by SourceIP, DestinationIP + | where TotalBytesSent >= MinUploadBytes + | extend TotalGBSent = round(TotalBytesSent / 1024.0 / 1024.0 / 1024.0, 2) + | extend TotalGBReceived = round(TotalBytesReceived / 1024.0 / 1024.0 / 1024.0, 2) + | extend UploadRatio = round(todouble(TotalBytesSent) / todouble(TotalBytesSent + TotalBytesReceived) * 100, 2) + | where UploadRatio >= MinUploadRatio + | project + TimeGenerated = LastSeen, + SourceIP, + DestinationIP, + TotalGBSent, + TotalGBReceived, + UploadRatio, + Connections, + DestinationPorts, + Applications, + FirstSeen, + LastSeen + | order by TotalGBSent desc + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Cisco ASA - Possible Data Exfiltration Detection + description: '''Detects potential data exfiltration when an internal source IP sends a large amount of outbound data + to the internet, especially when the volume is significantly higher than its normal behavior.''' + severity: medium + entityMappings: + ips: + - id: ip1 + addressColumn: SourceIP + - id: ip2 + addressColumn: DestinationIP + tactics: + - tactic: Exfiltration + techniques: + - technique: T1041 + - technique: T1048 diff --git a/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml b/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml new file mode 100644 index 00000000000..381502539b3 --- /dev/null +++ b/Solutions/CiscoASA/XDR Detections/CiscoASA-ThreatDetectionMessage.yaml @@ -0,0 +1,118 @@ +schemaVersion: 1.0.0 +version: 3.1.3 +kind: CustomDetection +resourceType: Microsoft.Security/detectionRules +apiVersion: 2026-06-01-preview +requiredDataConnectors: +- connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog +contentProvenance: + requiredWorkloads: + - workload: sentinel + dataTypes: + - CommonSecurityLog + requiredDataConnectors: + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog + dependencyReviewRequired: false + source: + platform: Microsoft Sentinel + kind: AnalyticsRule + id: 795edf2d-cf3e-45b5-8452-fe6c9e6a582e + path: Analytic Rules/CiscoASA-ThreatDetectionMessage.yaml + version: 1.0.3 + querySha256: d2550971e5d78a731b0300f36e424804e569c5832dad6dd99bd27ba5779386ca + schedule: + queryFrequency: 1h + queryPeriod: 1h + conversion: + tool: sentinel-to-xdr-migration + version: 0.1.0 + status: converted + reviewRequired: false + reviewReasons: [] + requiredWorkloads: + - sentinel + warnings: + - 'Schedule assessment: source frequency=1h, lookback=1h; target frequency=PT1H, native lookback=unknown/unconfigured; + mixed, Sentinel-only, or unknown query surface; no custom lookback is configured in the payload. See https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules#lookback' + - 'Best-effort entity mapping requires review: source Host.FullName column `DeviceName` is provisionally represented by + hosts.nameColumn `DeviceName`; confirm that this column is the intended host identifier. The original value is also + retained in customDetails when the query output binding is available; this assumption does not prove entity parity' + - Host.FullName value is retained as customDetails.HostFullName from query column `DeviceName`, but its target output + binding requires runtime-schema verification; custom details do not restore entity identity or correlation + - Supplemental customDetails.HostFullName column `DeviceName` requires runtime output-schema binding verification + - Custom-detail values must remain within the documented combined 4 KB per-alert limit; runtime values are unverified + and the service drops all custom details if exceeded + informational: + - All source MITRE tactics are preserved in source order in authored YAML. V3.1 ARM packaging carries only the first tactic + and its compatible techniques; this classification loss is not validated parity. Direct Graph deployment requires a + single tactic. + errors: [] + originalTactics: + - Discovery + - Impact + originalTechniques: + - T1046 + - T1498 + reviewScope: + sourceDocumentSha256: 1950041799fad8925658109382fafd0a6af66a8d6f56feabf7224ddf380881c4 + targetQuerySha256: 7c14061341a40bd433b9ca444954e39693ef716b5b4c70fdeb60b13d0754ac78 + reviewDecisions: + - reason: 'Best-effort entity mapping requires review: source Host.FullName column `DeviceName` is provisionally represented + by hosts.nameColumn `DeviceName`; confirm that this column is the intended host identifier. The original value is + also retained in customDetails when the query output binding is available; this assumption does not prove entity parity' + decision: accepted + sourceDocumentSha256: 1950041799fad8925658109382fafd0a6af66a8d6f56feabf7224ddf380881c4 + targetQuerySha256: 7c14061341a40bd433b9ca444954e39693ef716b5b4c70fdeb60b13d0754ac78 + supplementalEntityDetails: + - entityType: Host + entityIndex: 1 + identifier: FullName + sourceColumn: DeviceName + column: DeviceName + status: runtime-binding-pending + customDetailKey: HostFullName + acceptedReviewReasons: + - 'Best-effort entity mapping requires review: source Host.FullName column `DeviceName` is provisionally represented by + hosts.nameColumn `DeviceName`; confirm that this column is the intended host identifier. The original value is also + retained in customDetails when the query output binding is available; this assumption does not prove entity parity' +properties: + id: xdr-795edf2d-cf3e-45b5-8452-fe6c9e6a582e + displayName: Cisco ASA - threat detection message fired + status: disabled + queryCondition: + queryText: |- + CommonSecurityLog + | where isempty(CommunicationDirection) + | where DeviceEventClassID in ("733101","733102","733103","733104","733105") + | extend HostName = tostring(split(DeviceName, ".")[0]), DomainIndex = toint(indexof(DeviceName, '.')) + | extend HostNameDomain = iff(DomainIndex != -1, substring(DeviceName, DomainIndex + 1), DeviceName) + schedule: + frequency: PT1H + detectionAction: + alertTemplate: + title: Cisco ASA - threat detection message fired + description: |- + 'Identifies when the Cisco ASA Threat Detection engine fired an alert based on malicious activity occurring on the network inicated by DeviceEventClassID 733101-733105 + Resources: https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs9.html + Details on how to further troubleshoot/investigate: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113685-asa-threat-detection.html' + severity: medium + entityMappings: + hosts: + - id: host1 + nameColumn: DeviceName + ips: + - id: ip1 + addressColumn: SourceIP + tactics: + - tactic: Discovery + techniques: + - technique: T1046 + - tactic: Impact + techniques: + - technique: T1498 + customDetails: + HostFullName: DeviceName