From 54b6a85734284f3e8bc526cb8515fe63195f46ee Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:02:41 -0700 Subject: [PATCH 01/47] Remove old Analytic Rules --- ...umberOfHighThreatLevelQueriesDetected.yaml | 42 ------------------ ...hNumberOfNXDOMAINDNSResponsesDetected.yaml | 43 ------------------ ...ighThreatLevelQueryNotBlockedDetected.yaml | 44 ------------------- 3 files changed, 129 deletions(-) delete mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfHighThreatLevelQueriesDetected.yaml delete mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfNXDOMAINDNSResponsesDetected.yaml delete mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfHighThreatLevelQueriesDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfHighThreatLevelQueriesDetected.yaml deleted file mode 100644 index 993f39e7ec5..00000000000 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfHighThreatLevelQueriesDetected.yaml +++ /dev/null @@ -1,42 +0,0 @@ -id: 57113ad7-7dd6-4150-84d8-252e162aaf4a -name: Infoblox - High Number of High Threat Level Queries Detected -description: | - 'This creates an incident in the event a single host generates at least 200 high threat level RPZ queries (Threat Defense security hits) in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).' -severity: Medium -status: Available -requiredDataConnectors: - - connectorId: InfobloxCloudDataConnector - dataTypes: - - CommonSecurityLog (InfobloxCDC) -queryFrequency: 1h -queryPeriod: 1h -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Impact -relevantTechniques: - - T1498 - - T1565 -query: | - let threshold = 200; - InfobloxCDC - | where DeviceEventClassID has_cs "RPZ" - | where ThreatLevel_Score >=80 - | summarize count() by SourceIP - | where count_ > threshold - | join kind=inner (InfobloxCDC - | where DeviceEventClassID has_cs "RPZ" - | where ThreatLevel_Score >=80 - ) on SourceIP - | extend timestamp = TimeGenerated, IPCustomEntity = SourceIP, HostCustomEntity = DeviceName -entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - columnName: IPCustomEntity - - entityType: Host - fieldMappings: - - identifier: HostName - columnName: HostCustomEntity -version: 1.0.1 -kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfNXDOMAINDNSResponsesDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfNXDOMAINDNSResponsesDetected.yaml deleted file mode 100644 index 4963aa2e5e4..00000000000 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighNumberOfNXDOMAINDNSResponsesDetected.yaml +++ /dev/null @@ -1,43 +0,0 @@ -id: 818eddaa-3806-43a2-8930-3defc5a06803 -name: Infoblox - High Number of NXDOMAIN DNS Responses Detected -description: | - 'This creates an incident in the event a single host generates at least 200 DNS responses for non-existent domains in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).' -severity: Medium -status: Available -requiredDataConnectors: - - connectorId: InfobloxCloudDataConnector - dataTypes: - - CommonSecurityLog (InfobloxCDC) -queryFrequency: 1h -queryPeriod: 1h -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Impact -relevantTechniques: - - T1498 - - T1565 -query: | - let threshold = 200; - InfobloxCDC - | where DeviceEventClassID == "DNS Response" - | where InfobloxDNSRCode == "NXDOMAIN" - | summarize count() by SourceIP - | where count_ > threshold - | join kind=inner (InfobloxCDC - | where DeviceEventClassID == "DNS Response" - | where InfobloxDNSRCode == "NXDOMAIN" - ) on SourceIP - | extend timestamp = TimeGenerated, IPCustomEntity = SourceIP, HostCustomEntity = DeviceName -entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - columnName: IPCustomEntity - - entityType: Host - fieldMappings: - - identifier: HostName - columnName: HostCustomEntity -version: 1.0.1 -kind: Scheduled - diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml deleted file mode 100644 index e7780309d3b..00000000000 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml +++ /dev/null @@ -1,44 +0,0 @@ -id: dc7af829-d716-4774-9d6f-03d9aa7c27a4 -name: Infoblox - High Threat Level Query Not Blocked Detected -description: | - 'This creates an incident in the event a single host generates at least 1 high threat level query (Threat Defense security hit) that is not blocked or redirected in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).' -severity: Medium -status: Available -requiredDataConnectors: - - connectorId: InfobloxCloudDataConnector - dataTypes: - - CommonSecurityLog (InfobloxCDC) -queryFrequency: 1h -queryPeriod: 1h -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Impact -relevantTechniques: - - T1498 - - T1565 -query: | - let threshold = 1; - InfobloxCDC - | where DeviceEventClassID has_cs "RPZ" - | where ThreatLevel_Score >=80 - | where InfobloxB1PolicyAction == "Log" or SimplifiedDeviceAction == "PASSTHRU" - | summarize count() by SourceIP - | where count_ > threshold - | join kind=inner (InfobloxCDC - | where DeviceEventClassID has_cs "RPZ" - | where ThreatLevel_Score >=80 - | where InfobloxB1PolicyAction == "Log" or SimplifiedDeviceAction == "PASSTHRU" - ) on SourceIP - | extend timestamp = TimeGenerated, IPCustomEntity = SourceIP, HostCustomEntity = DeviceName -entityMappings: - - entityType: IP - fieldMappings: - - identifier: Address - columnName: IPCustomEntity - - entityType: Host - fieldMappings: - - identifier: HostName - columnName: HostCustomEntity -version: 1.0.1 -kind: Scheduled From 24080c400f7f2d973001b63c95cdf1b1d85a7ad9 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:03:03 -0700 Subject: [PATCH 02/47] Add new Analytic Rules --- .../Infoblox-DataExfiltrationAttack.yaml | 68 +++++++++++++++ ...ighThreatLevelQueryNotBlockedDetected.yaml | 69 +++++++++++++++ ...eatLevelQueriesFromSingleHostDetected.yaml | 53 ++++++++++++ ...anyHighThreatLevelSingleQueryDetected.yaml | 53 ++++++++++++ ...blox-ManyNXDOMAINDNSResponsesDetected.yaml | 53 ++++++++++++ ...CommonSecurityLogMatchFound-MalwareC2.yaml | 71 ++++++++++++++++ ...nfobloxCDCMatchFound-LookalikeDomains.yaml | 85 +++++++++++++++++++ .../Infoblox-TI-SyslogMatchFound-URL.yaml | 70 +++++++++++++++ 8 files changed, 522 insertions(+) create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml create mode 100644 Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-SyslogMatchFound-URL.yaml diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml new file mode 100644 index 00000000000..5e5b244db24 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml @@ -0,0 +1,68 @@ +id: 8db2b374-0337-49bd-94c9-cfbf8e5d83ad +name: Infoblox - Data Exfiltration Attack +description: | + 'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. + +This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: InfobloxCloudDataConnector + dataTypes: + - CommonSecurityLog (InfobloxCDC) +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let threshold = 1; + InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where InfobloxB1FeedName == "Threat Insight - Data Exfiltration" + | summarize count() by SourceIP + | where count_ > threshold + | join kind=innerunique (InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where InfobloxB1FeedName == "Threat Insight - Data Exfiltration" + ) on SourceIP +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - identifier: OSVersion + columnName: InfobloxB1SrcOSVersion + - identifier: FullName + columnName: SourceUserName + - entityType: Malware + fieldMappings: + - identifier: Name + columnName: InfobloxB1FeedName + - identifier: Category + columnName: InfobloxB1FeedName +customDetails: + SourceMACAddress: SourceMACAddress + InfobloxB1FeedName: InfobloxB1FeedName + InfobloxB1Network: InfobloxB1Network + InfobloxB1Action: InfobloxB1PolicyAction + InfobloxB1PolicyName: InfobloxB1PolicyName +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: true + lookbackDuration: 7d + matchingMethod: AllEntities +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml new file mode 100644 index 00000000000..5897d273217 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml @@ -0,0 +1,69 @@ +id: dfd8b74c-735e-48e4-9b2d-7f1216cb2283 +name: Infoblox - High Threat Level Query Not Blocked Detected +description: | + 'At least 1 high threat level query generated by single host in 1 hour that is not blocked or redirected. Customize query count, scheduling, responses and more. + +This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: InfobloxCloudDataConnector + dataTypes: + - CommonSecurityLog (InfobloxCDC) +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let threshold = 1; + InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where ThreatLevel_Score >=80 + | where InfobloxB1PolicyAction == "Log" or SimplifiedDeviceAction == "PASSTHRU" + | summarize count() by SourceIP + | where count_ > threshold + | join kind=inner (InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where ThreatLevel_Score >=80 + | where InfobloxB1PolicyAction == "Log" or SimplifiedDeviceAction == "PASSTHRU" + ) on SourceIP +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - identifier: OSVersion + columnName: InfobloxB1SrcOSVersion + - identifier: FullName + columnName: SourceUserName + - entityType: DNS + fieldMappings: + - identifier: DomainName + columnName: DestinationDnsDomain + - entityType: Malware + fieldMappings: + - identifier: Name + columnName: ThreatProperty + - identifier: Category + columnName: ThreatClass +customDetails: + SourceMACAddress: SourceMACAddress + InfobloxB1FeedName: InfobloxB1FeedName + InfobloxB1Network: InfobloxB1Network + InfobloxB1Action: InfobloxB1PolicyAction + InfobloxB1PolicyName: InfobloxB1PolicyName +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml new file mode 100644 index 00000000000..015827d40f7 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml @@ -0,0 +1,53 @@ +id: 3822b794-fa89-4420-aad6-0e1a2307f419 +name: Infoblox - Many High Threat Level Queries From Single Host Detected +description: | + 'At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. + +This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: InfobloxCloudDataConnector + dataTypes: + - CommonSecurityLog (InfobloxCDC) +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let threshold = 200; + InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where ThreatLevel_Score >= 80 + | summarize count() by SourceIP + | where count_ > threshold + | join kind=inner (InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where ThreatLevel_Score >= 80 + ) on SourceIP +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - identifier: OSVersion + columnName: InfobloxB1SrcOSVersion + - identifier: FullName + columnName: SourceUserName +customDetails: + SourceMACAddress: SourceMACAddress +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml new file mode 100644 index 00000000000..7351de5dc57 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml @@ -0,0 +1,53 @@ +id: 99278700-79ca-4b0f-b416-bf57ec699e1a +name: Infoblox - Many High Threat Level Single Query Detected +description: | + 'Single high threat level domain queried at least 200 times in 1 hour regardless of source. Customize query count, scheduling, responses and more. + +This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: InfobloxCloudDataConnector + dataTypes: + - CommonSecurityLog (InfobloxCDC) +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let threshold = 200; + InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where ThreatLevel_Score >= 80 + | summarize count() by DestinationDnsDomain + | where count_ > threshold + | join kind=inner (InfobloxCDC + | where DeviceEventClassID has_cs "RPZ" + | where ThreatLevel_Score >= 80 + ) on DestinationDnsDomain +entityMappings: + - entityType: DNS + fieldMappings: + - identifier: DomainName + columnName: DestinationDnsDomain + - entityType: Malware + fieldMappings: + - identifier: Name + columnName: ThreatProperty + - identifier: Category + columnName: ThreatClass +customDetails: + InfobloxB1FeedName: InfobloxB1FeedName + InfobloxB1Network: InfobloxB1Network + InfobloxB1PolicyName: InfobloxB1PolicyName +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml new file mode 100644 index 00000000000..8c5660eb29f --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml @@ -0,0 +1,53 @@ +id: b2f34315-9065-488e-88d0-a171d2b0da8e +name: Infoblox - Many NXDOMAIN DNS Responses Detected +description: | + 'Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. + +This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: InfobloxCloudDataConnector + dataTypes: + - CommonSecurityLog (InfobloxCDC) +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let threshold = 200; + InfobloxCDC + | where DeviceEventClassID == "DNS Response" + | where InfobloxDNSRCode == "NXDOMAIN" + | summarize count() by SourceIP + | where count_ > threshold + | join kind=inner (InfobloxCDC + | where DeviceEventClassID == "DNS Response" + | where InfobloxDNSRCode == "NXDOMAIN" + ) on SourceIP +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - identifier: OSVersion + columnName: InfobloxB1SrcOSVersion + - identifier: FullName + columnName: SourceUserName +customDetails: + SourceMACAddress: SourceMACAddress +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2.yaml new file mode 100644 index 00000000000..3d2f713f207 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2.yaml @@ -0,0 +1,71 @@ +id: 5b0864a9-4577-4087-b9fa-de3e14a8a999 +name: Infoblox - TI - CommonSecurityLog Match Found - MalwareC2 +description: | + 'CommonSecurityLog (CEF) MalwareC2/MalwareC2DGA match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired.' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: CEF + dataTypes: + - CommonSecurityLog + - connectorId: ThreatIntelligenceUploadIndicatorsAPI + dataTypes: + - ThreatIntelligenceIndicator + - connectorId: ThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let dt_lookBack = 1h; + let ioc_lookBack = 14d; + let TI = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() + | where Description has_cs "Infoblox" + | where Description has_cs "MalwareC2" + | where Active == true + | where isnotempty(DomainName) + ; + let Data = CommonSecurityLog + | extend HitTime = TimeGenerated + | where TimeGenerated >= ago(dt_lookBack) + | where isnotempty(DestinationDnsDomain) + //Remove trailing period at end of domain + | extend DestinationDnsDomain = trim_end(@"\.$", DestinationDnsDomain) + ; + TI | join kind=innerunique Data on $left.DomainName == $right.DestinationDnsDomain + | where HitTime >= TimeGenerated and HitTime < ExpirationDateTime + //Get most recent ingested indicator in case there are copies + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | project LatestIndicatorTime, HitTime, DeviceEventClassID, DestinationDnsDomain, DeviceAction, SourceIP, DeviceName, SourceMACAddress, SourceUserName, AdditionalExtensions, + AdditionalInformation, Description, ThreatType, TrafficLightProtocolLevel, Type, ConfidenceScore, ExpirationDateTime, SourceSystem, Action, IndicatorId, ExternalIndicatorId, Tags +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - identifier: FullName + columnName: SourceUserName + - entityType: DNS + fieldMappings: + - identifier: DomainName + columnName: DestinationDnsDomain +customDetails: + SourceMACAddress: SourceMACAddress +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml new file mode 100644 index 00000000000..3f0a8a858e1 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml @@ -0,0 +1,85 @@ +id: 568730be-b39d-45e3-a392-941e00837d52 +name: Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains +description: | + 'InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. + +This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: InfobloxCloudDataConnector + dataTypes: + - CommonSecurityLog (InfobloxCDC) + - connectorId: ThreatIntelligenceUploadIndicatorsAPI + dataTypes: + - ThreatIntelligenceIndicator + - connectorId: ThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let dt_lookBack = 1h; + let ioc_lookBack = 14d; + let TI = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() + | where Description == "Infoblox - HOST - Policy" + | where Tags has_cs "Property: Policy_LookalikeDomains" + | where Active == true + | where isnotempty(DomainName) + ; + let Data = InfobloxCDC + | extend HitTime = TimeGenerated + | where TimeGenerated >= ago(dt_lookBack) + | where isnotempty(DestinationDnsDomain) + //Remove trailing period at end of domain + | extend DestinationDnsDomain = trim_end(@"\.$", DestinationDnsDomain) + ; + TI | join kind=innerunique Data on $left.DomainName == $right.DestinationDnsDomain + | where HitTime >= TimeGenerated and HitTime < ExpirationDateTime + //Get most recent ingested indicator in case there are copies + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | project LatestIndicatorTime, HitTime, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested, + AdditionalInformation, Description, ThreatType, TrafficLightProtocolLevel, Type, ConfidenceScore, ExpirationDateTime, SourceSystem, Action, IndicatorId, ExternalIndicatorId, Tags +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SourceIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: DeviceName + - identifier: OSVersion + columnName: InfobloxB1SrcOSVersion + - identifier: FullName + columnName: SourceUserName + - entityType: DNS + fieldMappings: + - identifier: DomainName + columnName: DestinationDnsDomain + - entityType: Malware + fieldMappings: + - identifier: Name + columnName: ThreatProperty + - identifier: Category + columnName: ThreatClass +customDetails: + SourceMACAddress: SourceMACAddress + InfobloxB1FeedName: InfobloxB1FeedName + InfobloxB1Network: InfobloxB1Network + InfobloxB1Action: InfobloxB1PolicyAction + InfobloxB1PolicyName: InfobloxB1PolicyName +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-SyslogMatchFound-URL.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-SyslogMatchFound-URL.yaml new file mode 100644 index 00000000000..4b9fef235ce --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-SyslogMatchFound-URL.yaml @@ -0,0 +1,70 @@ +id: 28ee3c2b-eb4b-44de-a71e-e462843fea72 +name: Infoblox - TI - Syslog Match Found - URL +description: | + 'Syslog URL match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired.' +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: Syslog + dataTypes: + - Syslog + - connectorId: ThreatIntelligenceUploadIndicatorsAPI + dataTypes: + - ThreatIntelligenceIndicator + - connectorId: ThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1498 + - T1565 +query: | + let dt_lookBack = 1h; + let ioc_lookBack = 14d; + let TI = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) and ExpirationDateTime > now() + | where Description has_cs "Infoblox - URL" + | where Active == true + | where isnotempty(DomainName) + ; + let Data = Syslog + | extend HitTime = TimeGenerated + | where TimeGenerated >= ago(dt_lookBack) + //Extract URL patterns from syslog message + | extend Url = extract("(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\(\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+)", 1,SyslogMessage) + | where isnotempty(Url) + ; + TI | join kind=innerunique Data on $left.DomainName == $right.Url + | where HitTime >= TimeGenerated and HitTime < ExpirationDateTime + //Get most recent ingested indicator in case there are copies + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId + | project LatestIndicatorTime, HitTime, SyslogMessage, Computer, ProcessName, Url, HostIP, + AdditionalInformation, Description, ThreatType, TrafficLightProtocolLevel, Type, ConfidenceScore, ExpirationDateTime, SourceSystem, Action, IndicatorId, ExternalIndicatorId, Tags +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: HostIP + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: Computer + - entityType: DNS + fieldMappings: + - identifier: DomainName + columnName: Url + - entityType: URL + fieldMappings: + - identifier: Url + columnName: Url +eventGroupingSettings: + aggregationKind: SingleAlert +incidentConfiguration: + createIncident: true +version: 1.0.0 +kind: Scheduled From 8afabc983ada17149dc5deca462a154eddd4ce5f Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:05:33 -0700 Subject: [PATCH 03/47] Add playbooks & playbook readme --- .../azuredeploy.json | 517 +++++++++++++++++ .../azuredeploy.json | 516 +++++++++++++++++ .../azuredeploy.json | 516 +++++++++++++++++ .../azuredeploy.json | 517 +++++++++++++++++ .../azuredeploy.json | 517 +++++++++++++++++ .../azuredeploy.json | 517 +++++++++++++++++ .../azuredeploy.json | 516 +++++++++++++++++ .../azuredeploy.json | 516 +++++++++++++++++ .../azuredeploy.json | 516 +++++++++++++++++ .../azuredeploy.json | 434 ++++++++++++++ .../azuredeploy.json | 529 ++++++++++++++++++ .../Playbooks/readme.md | 140 +++++ 12 files changed, 5751 insertions(+) create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json new file mode 100644 index 00000000000..86787f8db5a --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json @@ -0,0 +1,517 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import AISCOMM Weekly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all indicators from the AISCOMM data provider on a scheduled weekly basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-AISCOMM-Weekly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Week", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Week", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "profile": "AISCOMM", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-AISCOMM-Weekly", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json new file mode 100644 index 00000000000..0de7c448a43 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json @@ -0,0 +1,516 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import Emails Weekly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected emails on a scheduled weekly basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Emails-Weekly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Week", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Week", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/email/" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Emails-Weekly", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json new file mode 100644 index 00000000000..4b9d21e1178 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json @@ -0,0 +1,516 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import Hashes Weekly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected hashes on a scheduled weekly basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hashes-Weekly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Week", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Week", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/hash/weekly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hashes-Weekly", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json new file mode 100644 index 00000000000..c083590fc2b --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json @@ -0,0 +1,517 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import Hosts Daily Lookalike Domains", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Lookalike domains on a scheduled daily basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Day", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Day", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "property": "Policy_LookalikeDomains", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json new file mode 100644 index 00000000000..806b017e6f5 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json @@ -0,0 +1,517 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import Hosts Daily MalwareC2DGA", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected MalwareC2DGA domains on a scheduled daily basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Day", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Day", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "class": "MalwareC2DGA", + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json new file mode 100644 index 00000000000..ab9df4794cf --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json @@ -0,0 +1,517 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import Hosts Daily Phishing", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Phishing domains on a scheduled daily basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Daily-Phishing", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Day", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Day", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "class": "Phishing", + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-Phishing", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json new file mode 100644 index 00000000000..5ec011b3a7d --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json @@ -0,0 +1,516 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import Hosts Hourly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected hosts on a scheduled hourly basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Hourly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/hourly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Hourly", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json new file mode 100644 index 00000000000..3dc68efcd40 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json @@ -0,0 +1,516 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import IPs Hourly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected IPs on a scheduled hourly basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-IPs-Hourly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/ip/hourly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-IPs-Hourly", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json new file mode 100644 index 00000000000..b9e24b82752 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json @@ -0,0 +1,516 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Import URLs Hourly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected URLs on a scheduled hourly basis.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ + ], + "tags": [ + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-URLs-Hourly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "runAfter": { + }, + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "default": { + "actions": { + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/url/hourly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "outputs": { + } + }, + "parameters": { + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-URLs-Hourly", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + ] + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json new file mode 100644 index 00000000000..3e4ff79c39e --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json @@ -0,0 +1,434 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Incident Enrichment Domains", + "description": "Leverages the Infoblox TIDE API to enrich Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "prerequisites": [ + "1. Infoblox TIDE API key." + ], + "postDeployment": [ + "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group." + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ "DnsResolution" + ], + "tags": [ "Enrichment" + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Incident-Enrichment-Domains", + "type": "string" + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + } + }, + "variables": { + "MicrosoftSentinelConnectionName": "[concat('MicrosoftSentinel-', parameters('PlaybookName'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "defaultValue": { + }, + "type": "Object" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Entities_-_Get_DNS": { + "runAfter": { + "Initialize_HTML": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/entities/dnsresolution" + } + }, + "For_each_DNS_Domain_Entity": { + "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']", + "actions": { + "For_each_Threat_IoC": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Enrich_Incident_with_TIDE_Data_if_it_exists": { + "actions": { + }, + "runAfter": { + }, + "else": { + "actions": { + "Add_comment_to_incident": { + "runAfter": { + "Set_HTML_Table_with_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "\u003cp\u003eIoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}\u003cbr\u003e\n@{variables('html')}\u003c/p\u003e" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "Set_HTML_Table_with_TIDE_Data": { + "runAfter": { + }, + "type": "SetVariable", + "inputs": { + "name": "html", + "value": "\u003cp style=\"height:0px\"\u003e\u003ctable\u003e\u003ctbody\u003e \n\u003ctr\u003e\u003ctd\u003eID\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['id']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eType\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['type']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eHost\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['host']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eDomain\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['domain']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eURL\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['url']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eIP\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['ip']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctd\u003eEmail\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['email']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eHash\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eProfile\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['profile']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eProperty\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['property']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eThreat Level\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['threat_level']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eConfidence\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['confidence']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eDetected\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['detected']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eReceived\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['received']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eImported\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['imported']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd\u003eExpiration\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['expiration']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd \u003eDescription\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003e@{items('For_each_Threat_IoC')?['extended']?['notes']}\u003c/td\u003e\u003c/tr\u003e\n\u003ctr\u003e\u003ctd \u003eOpen in CSP\u003c/td\u003e\u003ctd style=\"text-align:left\"\u003ehttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary\u003c/td\u003e\u003c/tr\u003e\n\u003c/tbody\u003e\u003c/table\u003e\u003c/p\u003e" + } + }, + "Update_incident_Tags": { + "runAfter": { + "Add_comment_to_incident": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "tagsToAdd": { + "TagsToAdd": [ + { + "Tag": "@items('For_each_Threat_IoC')?['type']" + }, + { + "Tag": "Imported: @{items('For_each_Threat_IoC')?['imported']}" + }, + { + "Tag": "Profile: @{items('For_each_Threat_IoC')?['profile']}" + }, + { + "Tag": "Property: @{items('For_each_Threat_IoC')?['property']}" + }, + { + "Tag": "Threat Level: @{items('For_each_Threat_IoC')?['threat_level']}" + } + ] + } + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "put", + "path": "/Incidents" + } + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_JSON')?['record_count']", + 0 + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "HTTP_-_Get_TIDE_Data_(Hosts)": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']", + "rlimit": "1" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats" + } + }, + "Parse_JSON": { + "runAfter": { + "HTTP_-_Get_TIDE_Data_(Hosts)": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "runAfter": { + "Entities_-_Get_DNS": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Initialize_HTML": { + "runAfter": { + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html", + "type": "string" + } + ] + } + } + }, + "outputs": { + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "connectionName": "[variables('MicrosoftSentinelConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Incident-Enrichment-Domains", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('MicrosoftSentinelConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('MicrosoftSentinelConnectionName')]", + "customParameterValues": { + }, + "parameterValueType": "Alternative", + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]" + } + } + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json new file mode 100644 index 00000000000..1f09316d43e --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json @@ -0,0 +1,529 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Infoblox Incident Send Email", + "description": "Sends a detailed email. Optionally enriches an applicable entity within the email with Infoblox TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "prerequisites": [ + "1. Infoblox TIDE API key (optional)." + ], + "postDeployment": [ + "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group." + ], + "prerequisitesDeployTemplateFile": "", + "lastUpdateTime": "", + "entities": [ "DnsResolution" + ], + "tags": [ "Enrichment", "Notification" + ], + "support": { + "tier": "community", + "armtemplate": "Generated from https://github.com/Azure/Azure-Sentinel/tree/master/Tools/Playbook-ARM-Template-Generator" + }, + "author": { + "name": "Infoblox" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Incident-Send-Email", + "type": "string" + }, + "Email Recipient": { + "type": "string", + "metadata": { + "description": "Enter value for Email Recipient" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + } + }, + "variables": { + "MicrosoftSentinelConnectionName": "[concat('MicrosoftSentinel-', parameters('PlaybookName'))]", + "Office365ConnectionName": "[concat('Office365-', parameters('PlaybookName'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "defaultValue": { + }, + "type": "Object" + }, + "Email Recipient": { + "defaultValue": "[parameters('Email Recipient')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[parameters('TIDE API Key')]", + "type": "string" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Create_HTML_table_with_Entities": { + "runAfter": { + "Select_Entities": [ + "Succeeded" + ] + }, + "type": "Table", + "inputs": { + "format": "HTML", + "from": "@body('Select_Entities')" + } + }, + "Entities_-_Get_DNS": { + "runAfter": { + "Set_Entities_HTML": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/entities/dnsresolution" + } + }, + "For_each_DNS_Domain_Entity": { + "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']", + "actions": { + "For_each_Threat_IoC": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Enrich_Email_with_TIDE_Data_if_it_exists": { + "actions": { + }, + "runAfter": { + }, + "else": { + "actions": { + "Append_HTML_Table_with_TIDE_Data": { + "runAfter": { + }, + "type": "AppendToStringVariable", + "inputs": { + "name": "html_tide", + "value": "\u003cstyle\u003e\n@{variables('css')}\n\u003c/style\u003e\n\u003cdiv class=\"title\"\u003eIoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}\u003c/div\u003e\n\u003ctable class=\"table\"\u003e\u003ctbody\u003e \n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eID\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['id']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eType\u003c/td\u003e\n\u003ctd class=\"tvalue\" \u003e@{items('For_each_Threat_IoC')?['type']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eHost\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['host']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eDomain\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['domain']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eURL\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['url']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eIP\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['ip']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctd class=\"tkey\"\u003eEmail\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['email']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eHash\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eProfile\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['profile']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eProperty\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['property']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eThreat Level\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['threat_level']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eConfidence\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['confidence']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eDetected\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['detected']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eReceived\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['received']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eImported\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['imported']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eExpiration\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['expiration']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eDescription\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003e@{items('For_each_Threat_IoC')?['extended']?['notes']}\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd class=\"tkey\"\u003eOpen in CSP\u003c/td\u003e\n\u003ctd class=\"tvalue\"\u003ehttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e" + } + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_JSON')?['record_count']", + 0 + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "HTTP_-_Get_TIDE_Data_(Hosts)": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']", + "rlimit": "1" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats" + } + }, + "Parse_JSON": { + "runAfter": { + "HTTP_-_Get_TIDE_Data_(Hosts)": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "dga": { + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "up": { + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "runAfter": { + "Entities_-_Get_DNS": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Initialize_CSS": { + "runAfter": { + "Initialize_Incident_HTML": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "css", + "type": "string", + "value": ".title {\n color: #1F2A47;\n font-size: 2rem;\n letter-spacing: .04em;\n padding: 8px;\n border-bottom: 1px solid #7B7B7B;\n font-weight: bold;\n}\n\ntable {\n border-collapse: collapse;\n border-spacing: 0;\n padding: 0;\n margin: 0 0 20px;\n}\n\n.tkey {\n text-align: right;\n border-right: 1px solid #7B7B7B;\n}\n.tvalue {\n text-align: left;\n border-top: 1px solid #eee !important;\n padding-left: 10px;\n}\n.value {\n font-size: 1.4rem;\n font-weight: bold;\n}\n\n.tkey, .key{\n color: #263137;\n letter-spacing: .04em;\n font-style: italic;\n padding-right: 10px;\n}\n.tvalue, .value {\n color: #1f4728 !important;\n letter-spacing: .02rem;\n}\n\n" + } + ] + } + }, + "Initialize_Entities_HTML": { + "runAfter": { + "Initialize_CSS": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html_entities", + "type": "string" + } + ] + } + }, + "Initialize_Incident_HTML": { + "runAfter": { + "Initialize_TIDE_HTML": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html_incident", + "type": "string" + } + ] + } + }, + "Initialize_TIDE_HTML": { + "runAfter": { + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html_tide", + "type": "string" + } + ] + } + }, + "Select_Entities": { + "runAfter": { + "Initialize_Entities_HTML": [ + "Succeeded" + ] + }, + "type": "Select", + "inputs": { + "from": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "select": { + "Entity": "@item()?['properties']?['friendlyName']", + "Type": "@item()?['kind']" + } + } + }, + "Send_an_email_with_Incident_details": { + "runAfter": { + "Set_Incident_HTML": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "Body": "\u003cp\u003e\u003cspan style=\"font-size: 14px\"\u003e\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e@{variables('html_incident')}\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e\u003cbr\u003e\n\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e@{variables('html_tide')}\u003c/span\u003e\u003cspan style=\"font-size: 14px\"\u003e\u003c/span\u003e\u003c/p\u003e", + "Importance": "Normal", + "Subject": "New Sentinel Incident - @{triggerBody()?['object']?['properties']?['title']}", + "To": "@parameters('Email Recipient')" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['office365_1']['connectionId']" + } + }, + "method": "post", + "path": "/v2/Mail" + } + }, + "Set_Entities_HTML": { + "runAfter": { + "Create_HTML_table_with_Entities": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "html_entities", + "value": "\u003cstyle\u003e\n@{variables('css')}\ntable, table td, table th {\n text-align: left;\n color: #1f4728 !important;\n border-top: 1px solid #eee !important;\n letter-spacing: .02rem;\n padding-left: 10px;\n}\n\u003c/style\u003e\n@{body('Create_HTML_table_with_Entities')}\n" + } + }, + "Set_Incident_HTML": { + "runAfter": { + "For_each_DNS_Domain_Entity": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "html_incident", + "value": "\u003cstyle\u003e\n@{variables('css')}\np {\n margin-bottom: 15px !important;\n}\n\u003c/style\u003e\n\u003cdiv class=\"title\"\u003e New incident created in Microsoft Sentinel \u003c/div\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Triggered - \u003c/span \u003e\u003cspan class=\"value\"\u003e@{triggerBody()?['object']?['properties']?['title']} \u003c/span \u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Incident ID - \u003c/span\u003e\u003cspan class=\"value\"\u003e @{triggerBody()?['object']?['properties']?['incidentNumber']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Triggered on - \u003c/span \u003e\u003cspan class=\"value\"\u003e @{triggerBody()?['object']?['properties']?['createdTimeUtc']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Severity - \u003c/span \u003e\u003cspan class=\"value\"\u003e@{triggerBody()?['object']?['properties']?['severity']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Alert providers - \u003c/span \u003e\u003cspan class=\"value\"\u003e@{join(triggerBody()?['object']?['properties']?['additionalData']?['alertProductNames'], '\u003cbr /\u003e')}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Tactics - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n@{join(triggerBody()?['object']?['properties']?['additionalData']?['tactics'], '\u003cbr /\u003e')}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Description - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n@{triggerBody()?['object']?['properties']?['description']}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Entities - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n@{variables('html_entities')}\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cspan class=\"key\"\u003e Incident link - \u003c/span \u003e\u003cspan class=\"value\"\u003e\n\u003ca href=\"@{triggerBody()?['object']?['properties']?['incidentUrl']}\"\u003e@{triggerBody()?['object']?['properties']?['incidentUrl']}\u003c/a\u003e\u003c/span\u003e\u003c/p\u003e\n\n\u003cdiv class=\"title\"\u003e TIDE Data \u003c/div \u003e" + } + } + }, + "outputs": { + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "connectionName": "[variables('MicrosoftSentinelConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "office365_1": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]", + "connectionName": "[variables('Office365ConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Office365')]" + } + } + } + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Incident-Send-Email", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('MicrosoftSentinelConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('MicrosoftSentinelConnectionName')]", + "customParameterValues": { + }, + "parameterValueType": "Alternative", + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuresentinel')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('Office365ConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('Office365ConnectionName')]", + "customParameterValues": { + }, + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Office365')]" + } + } + } + ] +} diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md b/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md new file mode 100644 index 00000000000..a4a13e26797 --- /dev/null +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md @@ -0,0 +1,140 @@ +# Infoblox Threat Intelligence Playbooks for Microsoft Sentinel +[Infoblox](https://www.infoblox.com/) + +These playbooks integrate Infoblox [Threat Intelligence Data Exchange (TIDE)](https://docs.infoblox.com/space/BloxOneThreatDefense/35898533) +data into Microsoft Sentinel. + +Use these playbooks to import data from TIDE and enrich incidents and emails. + +# Prerequisites +1. Register an app with Azure Active Directory and apply appropriate permissions, and enable the Threat Intelligence data connector. +Find instructions [here](https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-tip). + +2. Apply the **Microsoft Sentinel Contributor** or **Microsoft Sentinel Responder** role to the playbooks. +It is recommended to assign the role to the resource group that contains your Microsoft Sentinel workspace. +Find instructions [here](https://learn.microsoft.com/en-us/azure/sentinel/roles). + +3. Create and copy a TIDE API key into the playbook parameters. +Find instructions [here](https://docs.infoblox.com/space/BloxOneThreatDefense/230394187). + +# Installation +There are multiple ways to install the playbooks. +- Install the solution from the [Content Hub](https://portal.azure.com/#view/Microsoft_Azure_Marketplace/GalleryItemDetailsBladeNopdl/dontDiscardJourney~/true/id/infoblox.infoblox-cdc-solution/resourceGroupId/%2Fsubscriptions%2Fbe1e61b7-8dbe-4986-a9c2-d85f65524d6e%2FresourceGroups%2Ftme-rg) +(Recommended). This will not only install the playbook templates, but the other Sentinel templates as part of this solution as well. +- Copy and paste the ```azuredeploy.json``` files to a blank playbook. +- Click the **Deploy to Azure** buttons below for each desired playbook. + +# The Playbooks +This solution installs several playbooks that fit different needs. +You may wish to mix and match, omit some or modify others. + +## Intelligence Import +These playbooks import TIDE intelligence using the Infoblox TIDE API and send the indicators to Microsoft Sentinel via the Microsoft Security Graph API. +The indicators are stored in the ```ThreatIntelligenceIndicator``` table and can be viewed from the **Threat intelligence** blade. + +Because there are millions of indicators provided by TIDE, and thousands of new ones detected per day, +these playbooks are intended to give you a starting point for importing the indicators you want. + + +You may wish to import everything, or you may only need a handful of threat classes from a single profile or provider. + + +You can modify or create copies of these playbooks and tweak the action **Get TIDE Data** API call within the playbook to suit your needs. +Keep in mind due to [current limitations](https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-limits-and-config?tabs=consumption%2Cazure-portal), there is a 105MB download limit per API call and a 120 second HTTP timeout. +This is why you may only need to import new emails on a weekly basis, whereas hosts should be imported more frequently with an ```rlimit``` parameter because there are so many more. +![](images/tide.jpg) + +Use the following TIDE endpoints to see what is available for you to import. You can also view indicators in the [CSP](https://csp.infoblox.com/#/threat_intelligence/active-threat-indicators). + +***GET** available threat properties* - ```/tide/api/data/properties``` + +***GET** available threat classes* - ```/tide/api/data/threat_classes``` + +***GET** available profiles (data providers)* - ```/tide/api/entitlements/profiles``` + +View the list of APIs [here](https://csp.infoblox.com/apidoc?url=https%3A%2F%2Fcsp.infoblox.com%2Fapidoc%2Fdocs%2FTIDEData). + +Find a quick technical intro and examples for how to query TIDE data [here](https://docs.infoblox.com/space/BloxOneThreatDefense/117014574/Query+Active+Threats). + +--- +### Import-AISCOMM-Weekly +This playbook imports all indicators from the AISCOMM data provider on a scheduled weekly basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-AISCOMM-Weekly%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-AISCOMM-Weekly%2Fazuredeploy.json) +--- +### Import-Emails-Weekly +This playbook imports newly detected emails on a scheduled weekly basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Emails-Weekly%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Emails-Weekly%2Fazuredeploy.json) +--- +### Import-Hashes-Weekly +This playbook imports newly detected hashes on a scheduled weekly basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hashes-Weekly%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hashes-Weekly%2Fazuredeploy.json) +--- +### Import-Hosts-Daily-LookalikeDomains +This playbook imports newly detected Lookalike domains on a scheduled daily basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-LookalikeDomains%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-LookalikeDomains%2Fazuredeploy.json) +--- +### Import-Hosts-Daily-MalwareC2DGA +This playbook imports newly detected MalwareC2DGA domains on a scheduled daily basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-MalwareC2DGA%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-MalwareC2DGA%2Fazuredeploy.json) +--- +### Import-Hosts-Daily-Phishing +This playbook imports newly detected Phishing domains on a scheduled daily basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-Phishing%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Daily-Phishing%2Fazuredeploy.json) +--- +### Import-Hosts-Hourly +This playbook imports all newly detected hosts on a scheduled hourly basis. + +This playbook will import thousands of IoCs per run, which can become costly for your organization. +It will also create duplicates if concurrently enabled with the Import-Hosts-Daily playbooks, so use one or the other. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Hourly%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-Hosts-Hourly%2Fazuredeploy.json) +--- +### Import-IPs-Hourly +This playbook imports all newly detected IPs on a scheduled hourly basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-IPs-Hourly%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-IPs-Hourly%2Fazuredeploy.json) +--- +### Import-URLs-Daily +This playbook imports all newly detected URLs on a scheduled hourly basis. + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-URLs-Daily%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Import-URLs-Daily%2Fazuredeploy.json) + +## Enrichment & Emails +Enrich your incidents and emails with TIDE data. + +These playbooks can be configured to run automatically on Analytic Rules. Find instructions [here](https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom#set-automated-responses-and-create-the-rule). + +You can also run them on demand when viewing incidents. + +--- +### Incident-Enrichment-Domains +Enrich incidents containing a **DNS entity** with rich TIDE data. Will add a comment and tags to the incident. +![](images/incident.jpg) + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Enrichment-Domains%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Enrichment-Domains%2Fazuredeploy.json) +--- + +### Incident-Send-Email +Sends a detailed email about an incident. Enriches a **DNS entity** within the email with Infoblox TIDE data. + +![](images/email.jpg) + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Send-Email%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FInfoblox%2520Cloud%2520Data%2520Connector%2FPlaybooks%2FInfoblox-Incident-Send-Email%2Fazuredeploy.json) + From 247c6061306bcd709a8745fd5d556a8f8b4eea9e Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:07:36 -0700 Subject: [PATCH 04/47] add playbook images --- .../Playbooks/images/email.jpg | Bin 0 -> 93122 bytes .../Playbooks/images/incident.jpg | Bin 0 -> 123035 bytes .../Playbooks/images/infoblox.png | Bin 0 -> 15597 bytes .../Playbooks/images/tide.jpg | Bin 0 -> 46346 bytes 4 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/images/email.jpg create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/images/incident.jpg create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/images/infoblox.png create mode 100644 Solutions/Infoblox Cloud Data Connector/Playbooks/images/tide.jpg diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/email.jpg b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/email.jpg new file mode 100644 index 0000000000000000000000000000000000000000..c856805881ec8189ffa98778c48474f816bc00fb GIT binary patch literal 93122 zcmeFZd0bNK+b>L`sVP|wr762it(7#Eh+_rlyqU zlp;=u147P~nmH$?2&U$Mf*LLb@zC#_=REKHp6C61-apQB_6^sE^X5j%~ln&h6W`?U2|hA@NIgNlHuZ+9kD1LPAPLN=kaSxJXFKf@OBg z{yP5kBfl>Hb(Q$NdzZwnUp4+?W%E5qZr9eK9TMBN90qNb+p=ZXiN?Kfjyhq&pZQHhr8@prsc5&@!@p;g8xgC2Coj9{|pW}6j!=dsg zA0)lmrGB=&QQ=At_lUub+YcqB6qWWLP}b1YI(qE5p^>r4AE!($&ska9oVUH;bk*6# z)y>_*=cccpe?VZ+ox5S-5va&}j~>Uw#yyG0B|m?WlA881JtHUgZC-vsVbQya$|`a- zrKYy7skx=Kt^LEtPrZHp1A{|fhZ!vP#P`Xm=^rz*yrt!ppZrx|ZT**CTR_|Xt6KkE zv;Tu$a$>!!JG&pM0=O{%q2l@p7h}QJo?joS&QLZ=*c7VVCTNE; zH-#V1PUx0*9|JI6TI`*~aaFx$hwAzvvMwfSr&%7Qs)`aga-#Udha`IHJKJcwQ6Q#w z6I50mFK`qFaTnv!wo$6>aVrGrxokz+myC{1ZX-f6Hse}o8pGLLc`_WGR5ffkuO>*9B(%1-*T1^=Q-=zm2-aXTFcYKV4 zgv`!*w>HA=9J|A`{P6=j{uZ{wkJ|@70Sq7M9co-vI}MNNU3A}xM~3pF;w!&zf`~Zm zXajwHB}7@Hw1Z{Cu^fjz^FChFgVrv^1_vqL)68NYdu*I0Egx=*GaJ6(dsA*9<#4#$ zYGkIXh7}6d3IR0oNG;Lo<3i(mLyv@Dt>&mA*Q;c1+9TJCy+21yqeh}SGIt>?df7c1 zsl(DIB1Qfw)sw&+eVhO*J58TI#KJ4Mo5bT2^vx}!kl($GU+H){^yzSJkju;3UkV0y z_0Z6zQzevaIrK5-?Vyye?^Qeh@p?CK)H$N3q5G7O_1bt)&`yzcMTx% zvGZQE2!6(S!e66&eA*|bs2i*sC6+HN3(>~NC5OIbQFXUUTjai!zf(Q57EYiL59AQC_9Dv~0+5ncxF zOpxSJy{MH9i*`1qU>qyu5on<{pfwPdi8_pPJJUCyL5*s_t6xaiJ1>{@A=BdxZ&kQA zXRc+;kT--gWIn+Tk7@G2E%soxaa$MXNN5RIbAG{5wi> zr|dg1Q;Z5MD#}GX{&rXckemQ-)&9)Zp`p|zj>e+v)hlC(wq2qbp2Y3WdYM;6NxF<{{Fk7p#jGi$#spq#< zo>5(|IGW>&C0FHW-1%NTY~k@9259cqoxn@ZrLI#RnV&Q_8PAGp($7OVG$!N*p0p^^ zoT`gua&AYem{vs*I{o~{>dRfQ{v<$C^hWT9&<${6Cu+63m?Vzt$5wBGc9Wx`h+9Sk zw|ga1@7BZ&&R{<3XV6)zN3Q zJ?-@tHi)|FsYkPyCW-8@Dzdw#m5I{MKVFotiCo&DV4=J^OQu8kr!VhZ2a;QDmw=S_ zwn)UJ-t%hN7pV{D$Hsk1o$h>Zhf1G(-g)-Pr&$j|D}7j{#p1|DNfkZ8TZT74di?V` z%a!X_iHv%^2?`<(JZP|cn>s)RXx(8dk&WKYHSyGe(QUzNHTvS2u2I`?6SQB{frVJ? zpY_&DcEcE<7@MFro_BsSfu~-Z5#^bQ%2rAmoH?A)s~Oz}HImlbXZG%Jk-JwM{mV~P zCH^9ChmDk+U8iM+vIUEP%}>LgpY|u2jUL}JrUWh8ydT}xY#LHK0hSd8dpUD{j>u?Vc`h)SztB-RKNGNcB>SHE9rgW;e$BPB z#5-z6;_EJ9o33+l&CN-6Txhd_8>)1u<+(c$!E)tC#0t;;eMaZT(A7R@l_#gT?h1># z!uUkjS1Dp{$Bw^Hj(e{!A?h|>*Kd*0^Ma4-6|kjW)YWop1#0E+k}k7vf9mGcJ5<&k zX>=U4alYA|+Ogyk@3^?(DQxY!%+CUg7f%N^IAIgSearyz=+#}LQv~_vfe~ea5w0!) z-V0-@XIP%63LaQSCRrJn20y=@m`M33QouGk-X$;~{1q;~nGUjt7o))5T$eX&+n;6) z;LByTH5t-{F^~8a6*;a;s~rUXp`Naosb>pi)PPr^>a z96b}5aq;5GDdm3u6)$dcsWiPN(J<4_BXw!SZ;@RLt%wlrQ}N!&#uy0Ac-CZ|=}>Dp zR$8bKI(}NkA+8xRoVT)?suVMo#<{YXrKtP#)4OMHP8X5Ol*P_0H_Vup}7lkwtv6n^&;cqd?VrFPC@%pVr9$H%X1h@1Fg@#j2fdEC`jDj zpgTl;#u@Y3;Qlb_c&ZUP15@lICB}7sjBA zBpo+FGN;+dL`IrWi|`f8t*LSV|7etr=M(1f^Tmx}Q_~#D>ByQ9%J<=+JJAe2_7S#n z3t%NUFT4rFY}9VN*#t?4tlClq5?_Ucc~aR-j~iz>f|5z^V6HlaaOfsuMQN3jJ#*r} z*#vDbT>i$@kA-mEI7%%TvyInPSOwHshh4)$IlOyAWrJu)3C>QiKhBRbD>%30v*hJ# z7djb|mRY4z7lP;C68FN~IYQM%@m%0b`-0Zzw#~I^?GQW)MKkRe5 zq3&#QNez>qa_(!1LVERJL?V4WURl2dx^E^UyI=yIScY~OL`M~!k$o;+py4x&ta+v6 zA9oZ8Qwd$wad)W;jIW6iu9o9?;7AK*FK;L&ES?&{|A98(8MI*K)P@8~p9FsmVlqoE6jj{;})%O1x72vQ4z6j+y5gvvLPw}*#`te?+()Myo{?1zE#Lfg{7fpVKf#`l>)V(K=&QLZ(#SllDOglyc z>w-Sq5FmcmG17zoI;nm9Ummtn2&6NV7J!t?`6etu;Z#e z6DokxrGcL^p5BzIhy2NvQN{ID`?6S+H%g5yI_mM6*%g1FuPY^Dx6h&;su&C$V>UtL z1MjtDLxzkHL30;-^wDSh5s)~e^Re{6pb?F}lNK-_83>cuE%qYIy=BKn-&qi=h;pZZ0g(6gSH$S?ZM~V3_2QLm&T3}>wbGlGB55PCBdnXjTe{-8% zkBFxp%+}~zw5)R2(bUS%yq%`FWJS}|<1O6w(DY6GJFQ~MZ4jgT7 zTm%bmP`O4-9O)2GF|(8bgz&IsVTu*y{UIsJj4?QwA~3W!{wYawc13)8Tk$(gauXDH z9EfVRFyQiwbH~u;Jge&GEE%oFRb#?l;TENYmZZSJ-ZpGI*d9;d3JY3B)~qBC_&dX+Z1qIl{F}*M z6Mi!`FNd8ww6{z`#B2U|igMgD(Oxu)t4nXumN99DDpTReiI=OWz-d|!(q+z}Cd2qS z2bZ>o&cF8#e_YeSFu6N1pP3+bj+xvP6rt_cG>!G&1U+tNXUFr7S{r&XeMFy^pkFGd zg(75%h%z}+zhHDFQE6zsPqYie{dp9Nq{pmxw`3A_&R{f>Ct9+@He&KO)Yc5U&hkGS zXmk-91ZS($_BE3!t@5376@OkmX*`H+JOvHdxWlJ!#M2qDIDW$@BEq=|Oyzic3M|Cl%+b5};l&9>3egQ8bFVtRXwEdh5)oC1HnrhlQde_a zmU0GTzIKM%Y9mGw^&Nip%obXoKo--f#Xq_6f~v%&3y`9{4uIu+Mz_Fj9_u6U^Nlo# z^kn)o+e|1IK4ZG{Zxt>xod$p8;99;M&B1~GSC;SQp}f9En2b@tyt(ZJSQ@~rpKqB# z7R{Dsb&AaQ%j7}Y{)bJ=T_@K>D~GtQ0rpPpK1|e?;6Q15aA-4nZl#8k z!W|Tkc!3(L0yTk*%ypF(S`C!2Q{?W{fu%E5`HaL%KP5@#4iJiBD|u(wUA zCi{x4`Z<-Cn;_=la*I9a3uK_1OKP^ztt{`a8iC3OhS!lB^4}=iL?GpPI)%ya%-(%? zH*v_lEb5EIrRlAYPbstsuLB$w?7s3&!aG#Gv*=^lK$xAEVlS+s3z{BrTW}~rPF>;K zw-D&j1*K+I&++a&n%Q3k$W`#y%Q=TELM-nOL|L)TJz|1Pv`)J`*tCZN@OklX40SLS~wn=k? z#gKD?2XNyqlVe+|o`~=lgw`nT;DZi&`i~b1z>Y^_7gHmjfloo zfp#1=-T0QOk7C%r`??_wL9Hd=MT5T3-u;zLXlt?DTTzD6fNScSPGYH%mcdm_xjBE``tIs@9c394LS z98}Zj*U#-Ycf8Bbu+Gd6biGH*D>8R9>|HZXO|mm934P-qW?y)srquP&$z+epFGowd zrBJyJVz6{&6n>%Z+3Ljs&W(o38vMdF%j4R)B!NzeOyI)n*ZFCAGOdwXar9uY^elAG zUApA#pxRMx+7qEITgK72h!|V?ShWA!djzkX_HN2f2Tpvq8 zMg@s{8@|I09Uj&v#g5;KE|f(Cd*?4sC2oRrBatnH5io10$>G_UJP^nR@72qkK&ohE z=FD{a-|9fsXm+;c?}Cd5oWp&Wcm6r8!j!Wx2V7YuIH5)k@aU>Q zwrC>Dswzu%3&M~dQtQTWvH$S2=&=jpvoprKYVGf+^NV+?WHJtvdm{u_F})s;`6MpX z1$e-=^YU1>>G7|8h`Rfs*E8S5^%f(4Aj0Z5TT{igxKAoY?D{TO7fMf6app*od41F$ z8G*1J)j5fsw@%0WKIK}D>@3*#Kn&-ZVFt$}H;SvU9O!lj_Gug2WQE#Cm#JJ@QQok( zb<6$h*$ZPwr@ljeUi?bB?37J5o0m&Yu2WsLGUYv*ev3%i@B9+txt9EE6sET@M zhXK1hAo&#S5Xyzg$;eI~jF2;wyRq|I1@*=;jOUZva>HqzMN^Wty4_b9M;Y23n;?JW zhy<&fgG90=F={}Pxg{iqB<{LK#&&iI*O3+`e?|5byv)028saqk&I`&<`w|9aWL^QR zQ|su$BOb8Wao$CW{Xy(?cwmUys3Q!s2{O57Y~58Kx*T56`G{dXR6Fy+u`aRyld`;W z#08%{P#iU+kG}*sMY5xv>|p!OE7{c4Ro3)po^P;M;wY9;R~2UpUt-#IdaUG2dX98X zd`z2MQwbi`{dfmAn*B*7%#=Dkj^vyk?`E8wYf%&_^phpYV98M%-;$a2RD9IiAmzIi z))j3U)%CH*QoIdnJ^cpP$}aVJCpyV+BFu>cGNC=i63G!IkFSP%tNmxacUc85VCxyx8I*MyPpBO*#+_Bh5dZ&9m?sKX)@6_>w%$ za#jL;+YhW{h!DXNAY<#WF&2=qp!NJzzG!PhM4fWt%152XoPI^)ssN3O_=(ZrByG?3 zR8qC@I``R}D-e;7ifG3C&eLjM={dOzl1pl*>Jdr_H!^UauW$XYbC6GWB!>>f^`0?O`(edDIS zPDdR#o+9-L*=YyV9+ssXVH%v8y?*`Fa^+INpW=Y1KdR$BY?~1Lb`G{Jm>Ly8kTg== zij{RA{V}rW=<#L(3TT?N1yX(4z=BW}l7L1K zM*zj4X6(Mt<$iQ-;@HgZUrXNYyXD zH_}Sj_DzoFdnNZ^#`-zEV{lvR>5E1AXz}E{oxhQeMsm~mN{`-;9ik0dr~-LpqQ@d9 z<7!>>~rqXlezKtrNU*NKIHmOCgkL$ViD+Q;>G1=0=-ekKO%?Qf$k}^D82F!2ASP@E$%+09%d|_P6^?Y-o85 z{x*QPo*`{lbv?(ET7Ld>4?0QbhAz|Zn`e+Q{O5Ct!KV-p@3yV$DF#cqYzg5$BwOj3 z;auZ5^AVj}Le;;O4X$e7;`#Y$N_^tvv)6shpc-;5N-21Ed5Hh=B*Qagb{>63077Lp ztwURM^&J4u2|K$em?~U(u^C~NayVAoE-@|iQ{u7~_x%_$ z9Wo=P2?m)6ocJfeh3|#!c#-5956f2KfZ<{i$}M2EwXS7QO)=cr^DS^b&`Kcqh;#49}6*oh4Nx{qzNI{$IPey2l>^#r>LbLhEy0}sz1#fc&B z_lambWTE9=0<_c5^L%x&cZv6zct;EOypeT8RZmsV{0)c`{?78wc9G;VPkTa(lLASg z`f|w#D!2rFxrV3rreL-%KQoeYFK=^RMz5vxy)vMwdiOMX2*Xa0$O3YXrjN$)!_{SfGOW%an;%M^8zV~!8-33pV-VoF4n}3bVgRXPDfUQjcU-BwFLCR~HIIt5nqBWWY2Mlk_wTE{Pzy*@=(z6G zn5U$;3O&969nXfT8QO7tT9W|ixgoUA1U}Y;&P~>xuS1Mh!t3zy#4wf29kDFN0cB~q zBcX=x`1Qmb7e9xTN}-rMu>C!+Ei07O<#Y`&Gj4c;@@I1f$w*eiWmF(3vw2AQhE0p{ zl2v{i9scw@pC|9N2|8Kq6Nahq8G9PlGrxzHD?2^8*n$PL=q;puqEAdks+Lw$Jc)J; zh4)OJnrQn-`r0Zceud=%8EyO{PW+e`Yc98FOtOwOSpB9Mby{JieZF3Bd=9n+Z7(<< zsEmx6M;na86obmfP-gahV`D0c;5PpOZn?Hf;0 z$C=$9VZUgPyvwuwj`&tvvIzoVS_z64a%dYa{+S^*HsVopoqqz=Ke7O|wZpmZPz^Uf ztJvKN8C(lbsXEU8sKMshTY-t)LV_$(B5(^ta#huAA2-1I`Uch0$X^v4N|*fDf6Sw)2?#QpW51uct{C#7(=l5FYQDtF$ zgf<3?>Bp8uw3{vBu?iv$v_TK6l9#fWfEa3yxXonfL}XYkJW|Un{B-B&&49e~zRu_q zaNk3aNm8HkuCA-E-y&Qd2WcBDk*Q2s2n=LJ9Z zc9(cuy43J?&I#r*9Jibqw03Ow1x~ewZTP}9W2nao(ZK%IBL1%F^`~Zpml&muhayvN zp;b-IfVsN=2A=301Xc7W_Zua^Gxwumr}H+dOru)@^`_2uRwHQoqlkpX1%+t~6>-CF zq67L@Mz6Fv#3?^}o&z^6c!(se%#@lNPF8dbTRj|4QQ$`OKypnIYM7D-J%cAk1B7lzVu<@%s*47N9CL|2_? z=SyM+iwj3Q&vj@5!44@pw<#aIG9&UaEfy+3y+B^nSxuLk0xaL5Xv^>0U5qn0+4Ovm znK6y{$=bT=6Oj~1z_TfLU)-_nyu@CkP5?YpzZF3K$2I3*r34$_G*UW)kziT}XOKToG)qq}3%MO4wU9BAck`dYIKT zNdL=`u0M8PF}P8BqN2QK*U{ob0XevwhyOzAexY^$8Rg?3)ioaoU$vw38|gwF2yS%( zS%OT<%s%F~$SZc=TlNc=A{{RXl%_`ZQLK!Jf9_DgvmI0dL^7U=17v#>J5hf<{!*pD zxAzRcqv+1$8MP&oPk`BFbl1#Pp)(I^#YHBd4c^R}F#QLp*TalbpNEuD6T@^|mcD)b zRCLuDr-bMx-yz?rO*t=NYo+j<4UwP8mLtbbxb#Kw{gVEtxWs+DphRzc@h zudQ~@VQ_l-fVJ&wnILVg7TWP%p-P@EpIGD;Xsn4sV0t2N|9#Fc`)cg|)l=Kh$#vGn z1KC#29Y(j20%x>-0-G-U4Z(xF*Pg(ei38r;XM{Z-*r2r-lX-#I!!QYFW`;29yFm98 zmW z5a|*!Np^+;*^AyL`(|SQ>zXgRH+c#$5?=Q^&#e`;>>DdwYzJ zfz6YyF|SK>lQE9VuJ_&07QhI18!NjZB5w|&Ahc(XU>_@^8RWq?*ys|Sx}O7mM=ECc z&kY*+nSbam>_4*=`8=AQQ9*szy}rZB^@MrB2MqWN+UhNwDeJ`gMo=LM^*8cLfY@26 z^4P4M?)328{7MQr{U>;(=8ZV7K+{bx-NZIzDQ8y-yb&!4=h6oC8vLQP=v-BPUKvTi5mL8AA4+*UIp|)fKrTL;oey!1fz%jnX_=SHMx=V#V1p$Z?38CyF9&$legDd+DslbPQQl z`x2M@)O4v^rX?bxtW~x3)7NH%ylv2Djykfbu8_z%T#Bz z)O>FQS*E)QeSth~EYFe+39Z?`eWA)I*0Q2tlHbN=2=aPFWQJ>0))i*3 zvbyJjb&5$-W>RK=3yEYQ6*#5|xC%l8>mW@dBwPlinWPA(Y4NmL%p4Se(<=??RyA3J zZg2Y*^UJDJ{i15a-v;XTR-GA{bY9lxaOm@2P<)~GAAJ-jDU`Qs)H78v()V>v>S)gW zf8;-EgA#%iiekr`jtdSWg0GYf8fIPDURO>lueD2ne>fOo>ysp{ovVNR)2*iaMuq=k zmL~Rt9IXSoK=O{S9P7ju?@}oQsipz+*7$>zfSgKh>yem{iKPb_>2F= zxv9VOUrP{4A-GXZ5M|-EaWEKo-h@%%?aX8A9}HMG&b(7JGq~zB!#(}o)g$ij-dy=W zo#4_voVm97!jf~e8o+>ehwV&%j9g*HiE~=E12_7d(wf!OzTBPj^s;lhOQYBCJ@t6) za&$WJK(g+$&n#if+GDzB<&Bu&z8WI2y9CoE_b~P#4Eg7kF7-~GpIbBq-$Q0;C;=Ax?M`s{$ZqIYNS9HfU+Z6 zRA6#q6fN^gZAAuSN?Q``_zrucs(PWKQG4d$#QaI~+d1b;xCWByHiAz?G5)i=c6`l3 zw|OG!rO>trJ{aK;bu%LkXJp4QbErXO@62Gd!Q-kZ&p#!f1Iu4<_D!-jsYa&Db*N7| zJb+fa;%P_G7+zdF*&$wSTd(lYxD#8Y3&xtH(S7ceGG^BAI0PQ3=^MFZSAUG!kMqx3 zoJ^R$x~DM3{Uqk7sE4p$v{Sef&_}YnaqEhBHVK!i<-(JAg0{tqllAPlbB+Gn6Z40! z+2(t-JnuNdqW8Yedg}>K%(k9fqMt3dayU6};T{3~Lkw(ef*6(U-aEPCwA}{ygi)y& z6alkhQuFe%l$#x*@HmgDoFT`nu}wo1dvJ;RH6@xRqP z10Ty>(ik~j?jGI2{}V`@z&~M@YsCni@0=zjn7fzER0J9Co9)d{Q6%n8{=mOtuTdhK z6q!1;wOf9-1)>oe+t7q_RmGd|@CoX@bU#jn8&H)2eLPPztS=H;*IlX&3k&oKezW>= zp~bk5vQT!rTzvsiTtDe2Eay(HJ}|c#pW>w^6r)dn5lIWJfmT+QXA1#bHEP{v4{fqg z#YrMK`GdNg(brX;9fcf?>;o3(!eUe@kxvK}ndgJ-bG2}vZcY78w8eNuTV#!cCV-$ULq24~QgufhWiaDvSjKBT@Mzv~lQg4N zCy6dSI6=HKZnVT0iyd=Wx{+%X5Eagd%`qfx`{CcJkM$ujKPTJlV@lV1+Q9>I zKBP>(`1JSj%Hqg`J=j!?Q6K?~*(uz=fxFRfaT@~-MIn_&Xis!*)YK}O z%%}+sUFIJSgg~B5B=~>mY@&Ns_mnx;MHps7(#NK!^;-zT-R~((uCvU&=| zrmBiavYjj4Op^l|askg4*a#y#nW0NdSFF^d+&QxT^h;o+Nf%#ruEIBkKY0}^?V2HK z<*+=Nd(mbB=+h(IBdZV@BRt@ht=<>r_;%JbBv11V zhV=Cs!muhzm8>*y_ksZH)!m5&GzslqTFp@ICHw<#RW81@OQq>v3&x~>C8CE@)jy;; zI2N_x0Y~WhEF0moanE&IGBIxJthsiqAAJw1&nA=Awfeq64I+mQLv90-Fq$LHI&w^G zutSk`xqXRIbBw^crYlvR$7dsTMbQu;$2|dbeCt@`{+Ju(y0^A||yT zalSf4stZ<$+Ij!Pi2TO0R}}5px}(f@+~KP@5YPr|AK4O=AbR z_$Ohj_GeG~MSHtc51MNu6y6f=CV%|i8d7vnr&!*0dfp{yqn+_~CD&hYxZvwr(odD2 zP<;z+0Mlo^QAqcX`bgH_J%?2~#4}E~PWr(&zN7Vw=pU`YuA|k|XSnBO+QwLR@-(Qw zpIq4BPu=)NnD^qQS&HZ7Krgck1Ca5>7X9rg*Z0b;-L3ixD6A85&&=2{<~=>#QX?Y2 zX>jSA~2NsZf*|+((F9%yx`iuG51Y~t>G>yd_NF#A;0Vse?YnK(^}umkh9>Mp`c`A581b;u zPZ;|hU_lcN=S8N?kZMmOhDHkeOGH7VG%e$ zAI}rVVB@L?3fC+iy$xDM>pIAFPnbnH9+4s<-(C9}P<`ve(#ck%=@*riA8W5131`%& zSbfC?!Wd>v5Gl=C9`X_TP##dlloB_sPa?doMocMZ>& z@SD+Jj=x)@Ulhmk2;AgAZ_P586c91*Z5Vlzw}Z~VYvEF})N=U6X#TfL-WpetzZ*~P zH+P9>-UJPIvlg2g6g%v>^!q{;R)a;eBf@*I??MlvWSra(@KkeVuc5R1(~CW8kEX=l zKkn4uw<{+d7<6`8OFH@#4{p;dbj%O**69^fL8JgFrdQwV0o~VWPJ@dc+Hutt$`786 z1x!%;#*U?AqeRi4=gOTLcxjyL6WuWcr4g2SFUsH=k6+}&8b+I#dqfWq8^lg=DYDNg z+cUg2)e1Mrbcm$6dv4q~7Vb}q;`uj1cLJNBKZgvXqna!Z3>gySuh~Qp-Gh{`DY-CO zcsj@ADZ74j7(S^UoGn>9US_q?+U6e%_0N)MqAMFg)U5T8MjeUAA>gk%#Zry0X9}Ge zpL^u?-Mn%k$92qWIA!Oe-q9r4n~HvM&oIBuj>+>Z9{CgikXCQas)6aH(x18~qm9kH zKhbYc29B}`=llg2L(UB|lQD*(*+W7rCybt9aitW4UG^B@MoOm6M1y||I!|S|>V&=-FH^l)(rh%&z zWO-K5?N_IqpvQ%_Vg}9;UN}i`H2^9OA$hhA z5v0R(rQ0B1X<+5Y{B;a*XH4$M=a8Fm3nB2iguIjUepe~5hU$juZjsa$flZ)=EH`-U zFc)EVt!dp?&EQd$@QI zaGQB1?h+UJ_%1-zmg%D5QrAycY3H_wwSMy4;qa}bX07QjD9^9V5dW1lJ{>1KMnqwn zSu&H=+Yr1Y>&VA1~lRLy`?-Q>04&W}{px365xlNau^%eY5ZF7>e_IFdy4 zF5YJnJEn)K#Ks?(5$OVbrJh0WD0JW0h2Ex5Gci@6-`Jdk%KMDB{5rL?ag}y_leg?3FBExqHtk*)+tSp`CUmK-{6k4XVn?le0x`PbwWyOW zBQzeY2o!tOXt{#w>=65+>Mxuda2WYq(zSU8K|fR8@ogq%z3ttwl(vEO##0M0>UJaX zt~ewtPAMxve3z4m9cfm)+$Oq8L%TaCK#tI2VAV&k}Tu0Xf(gr#}sBc<$a-A$n?;G3X%XKL4%;~|XC#2LaqtPdm( ztA^3ikEi_xL|g0bsJWH`6xGRIQ?mFy@7#l)dk}ivl;;m z(8M->!0fkYN$Q!~8skJVG_Da98yI`aaKm)=`?o)0k~KySm&IItl~~;q;)3WLSa`m; z-(stHny(U`0%EwN*0JBqdd=PMf+{;%u4z9F$1 zDK45LfQKrJdwx{k)69G8H(WLHwlXS>k~a1D+mR#i4`82pFc%g6pYCf^a;-iuNNPCkhGSS@kFNP})TV|m;!wbsRFNJ+wP>j+D^Ru7LzUf;_R~5Y(s8EG%3T^#CgZAQjt@2A!bT6FL{uVgw8EL^#3 zR~X_gjgn*e+80l15NTbro1ob=3@^#1PL017^Jj* zzJ^Sz>Jc-V95N)6C(R2dYQy3_-%MNm`$D#BXGJj?{8ihMrzG~V)B;UcpPEOqWun-I zE~)DzT;&rLV{C)FjX(b;^VAonI&Q((sP5OpE{mz80{~1tC`2DbO;2s3fq{M|# z_1VR$KJ8FBq0Ku~v3*Zf+aOt`7)%KaoiVxM-jA{+26%?Dg8)5QkHxA@W#$Q zez4LKpoiRt>S)b2rg1fEO`hoJ{Y0&N^=7l?7j%03?Cj2~-^7{Kx*O+IZoh}}M(F)43kZ1{)Ey~iGCmuyHZCnqqM0*^XhkmP2mya{^SVJzmDMNN^M z&HGb|mTZLbclay3h%T6{Q|HT6TwQk%q9m#y<8-3A3K~9g4PclFHVHIq+O_qowK6E zPuM|B=C$w0pR2Er+}qa4dBuJ0v-oW)jWUf0b_O1ZJQwXyOSUuO1McV`!LC2&wUN6%}7Wv_-#GmA;aq1IGZmk!5iqVB z?6ENnG7d!X>pO^N?Gfh2VbW%!7M?JUB4yd-(3V=I?tR8ztv)d}2whmhhKz-)3GoeTW>kE}{qQc{cuN50y4j)H9cx&{q*ZhSKyWn>ni{PmZ>ju&pJ`^TZFisi{hxF?oC5)3<5idWJ?< zw8YWD={}!kj0Uzb_-;LEnBvUye@K;>(2l+#XiTH&af^Z2&mV)s0ua9E^$w(}EE?*_ z3bH(XOx5>OyFS(hV#kZ%TuKWg4Tt&7W`byDR{?~+LE%;#tJimCntb(d7)ZQdAG@I4 z9(j>?#GW6nb@Kv|V3cu)>5gqYEZRSUHsZF&X!Z-QN4`ZlH8LmYET8?+-@}XxQ`RJO&HlRZ!CE(7nXld_k*opgE#mR}riR?dwC+@JiJSJ?( z^`2>!cCCMZYgpyqJM-Owvv`-9NJqV^hRzp@JNM4#eA-6MJc4?x*vpnncLT0ut3SF} zL#DVB$>)YbN;LgbOsXf{%o~ce&y7Una~kn?CJ2Bg@)6aC=i|wnB*miNkcA3v_$ofrn4nA(uWpKT=P@%7kOVo1mLn&_*caFpw3^#w((7+q79n zxOa!{rB^&Nt3TI}%Duqz7&-eedg;Zdz=iyUEi!diEWg(*h{8tW6+o$lKVCw(N zgN||y{r;U1aN-xU?diW~#{4D2)newrQl#x*Y z*`|P3uls9ki_L;~Px3G4EY2+d(+ZN;vUjdd(2Qr+5TF?G1B?cu;e_Yh#EqvFf=GGD<*-l15& z$71t?09IPZv(oWaLx+bNJ2N$ok^#d+PvIXoYasWHyS!bI1`ID&_tEis4$YS_wrR7I zXC^r%hxW?9C7W%mF}kwFVl>3 zBb(tL9NrY-jDb)NO$OV=+J?l!_6<_xQJM*Puyl3T_h|HqMthKh?e)QBtidx_+YDs; zo#dR_ygX@w))pU-;-$LqX7fv&fmGYN%7L$>YZGShBEzf>R-vCR@dl!LbucgewzriI zGvxlCBNa}(@B}n2h!d%MuigB*viqeIhPM`!Lfdmf{`#?tVIBF@>K;bmWq}FUTD9AG zjz7LgtXfWPMSFH24{nSs-KiaTlM1q$46~xj%1Y0quSzv6B&a)<9Cya|%~h40j0n2Y zUEh>0{U}Sdk_WfpNhhEOxQ7z_3t01;G+t^;RyNAxQh{cp^X<~A>h>yw^E=?vE>n`W z%iXB~JHH6P3o;tn4w0o*5;$NQ^z=qgAg!7@EI^V1)6~Xhm!gOScu<3*N;#M!A@BzQ zYdX~BY9%*vQN`MN(6g^14eFMVD%)q2MR?J8)(+WiS?z@& z39T1S!k_Yk%i?HD$PL1%zwAyzIFXS(LnsqVv4cvEuCpgD6ko4^*ONsTSpPQgtN~^D zwC6-#`huNJ5qND83O50yW5&&i!fQoQ$}HW=+zZDi>ihbfZyHSBtCm`}76<{yd<#xv z9OYsW!3(IrpKZ;|;|cOL|%qI=%yEqyb#K2x>g-erJ1y-46$6XGWK?NsZC zE>01T`19vgkJI?&^+l*nmX4#sw!z|q-#fj~u+byrgT)oKUf%9q`NM&?$^($ROQwc( zyd@J1UCR7BTY3x|Ch2cfaR5~PI1#+M)*759cJg7JQUjk>b*$xZ%Z=fab{REABi*cf z@QiIC!)2$CFjYp7#_tyW3X(1;rl4TA>~c#u#7lTYDew)-8#f;*pTkHa2rM7ell>d1yIbY5Q<8>jW45wZ6*=q1(hEve4NBaZ_G8ziQR#(>Rpov`#%52zskb#I z|Nmq}|9^w;{NLXzgR6f3JAL(e-+#cwe<@=BwMqZmZ~K3}8z23jpqs&edUOBzf&cBm zZ=e6qe%;akwXyfVe(wG6yYMfY?LPCIJ7_{f$VnH=5x|%!wLOsUvk?`i~ew^ zcDL3xTJE7}%Ub^8l^Grwa#6PJi$+#sLjw! zet$*iGU@E%@F+7at?zBx^hox<~Ow z%}_>1gLEuR`P(*{Vtd}nxwE)?r!XkE5^AyUWeD`w(b^7FV_-l<9N``ABbKQ(WAsz_cH?`6ZKhX&&UA zVV;r_5-*|9p4YNlO^~s#`4)`0d(8U~tH)hPvv=i-L9_3Ce$&Y4^`jq*AM?IfUYyP* z!CO@>bGm>oHrMj66|)m_<}|?){&)=<`Z-a_5>c~nZS#y;wbb~T%4Lsp{6>KhKZEY> z+M#+9G~s+|X*)<_9K{B^k-m^jM>zwbHU?Jlqv>5Mp|#<0U>1-aO_wYG`c!7!n9d_C zUEtbyf*!D-*4c{VT-d}H{n#ZFx}(?StVybEO1N%gVEuR^_lVGPblM`bFeEw)J0zkt ze%QRUv~BrOZ1zR0g|%h4@g_<6*e90ei@Yn9{Pb$lAGC;xbXdg@+3qu@1 zsVecqTPyZ<<`>j^bM+N;)6z4ed_KRnna%%9^X;PiAv=HPW!hTt7}7^XtA)3iV)i*> zQxNgULwUTFck7nE#n5L<(K!RH;(A+*foDy`RxL532`8M!j6$a~+LA}dnpLHTX&eU@ z8+Udv#N4CBI?7?2%WfN(&p6vq#>&1TJcu}gsFw+>S}Q+Lilj92EJbqG9SK4QtRuIe zDRe5^^d*0v13#Vgc7AghYFv8`@vg%&FrA@M6|ugW=$-C(Z7uzO`vc_Px*Vb|G^ponCS8;a4zi*om zmJ4~ow`n9&El|m0&MvI|*d^4QJVilxtsx@Pkku#S9t?PAe1$;O;sGS6*M6)mx>~pM zk4S@+Dz-K z0H|pVYDVZ(B>Hm4L(4~o6Nk9YzE?k(sLyN63S7gyoaGN&R);N@(0on_(oE%+!M20` z24)^|7ruOsH$y$)0bImIO{MdFvXYG^<96y%J9z=ma#7V|tLrij@PAS$`sUgR09g9$ zISd#~fv(JY{O9n)X8PPjXtPN`KtmcW)(CtC{F5(=n`=+~Gu;!Oc8H}P0uXK1)BDp13nZH7w?$$qCw$V9E(xS%mEPM?iK5JZ?O>DY-&St5^GiDAi zTP%^r|Ak|m#v3uJXd%k!KM^b1OhtKG4&`!f4BT?vZCNX~G2cCfvGJ!Zv%Y;!X}Az` z^FSr|z$#F#l^bRR5++6j<%uzeahDwdIC^j1PC6f8-~2EzRB$ftraFJz8ht9nG&ap( zr^7DB(tdal?yn#F(Dzx0jplSmt`vF5%*xA1_hgrQz^I-P%JyhmTZ7_+j_a-Lhk?@@GR!Pn zK_Y9M0(InDj93?<%69o2@PeH3xz#{HP7_7)z8~SczVaO^-@9Q69z1xgp*7l83ehUo z9ndGKILuma=}h)2OJ9I&qUGeYVa(HKq_fUz&!WS{``7s;Z6Nu=kSOU9fRrrrthFO$25se*XTFGNX&=9 zv;agtR@o+TCJSE8c19+Y^_EEPuJ!&2sy7Q6FA}8bzSXoxk>0{8`v?IQF)%e=?wbm5 z@t2`UM!lZ59cztz@46^RVU0F*UJOj>s;E?Qc=_{QIQ;L%;5rAbX8keKW{47XPXI(# zVF4itINA*A-`CfpSm-F64q#?Tq176<%9PrBiP{F=)qaEP;u`tgf-C%tHUx0mw^hX! ztt^DJ;?=9F`TF$is0&(yhR#M(GBe`Oh}!PmR)$HN`?C*NYIfVB|6XA41B*UW@p(UX zbw07RJAn}Mz>5f6Wx>5d z`Q>8wZ&8>?;a!o&03PBDG)!|dS{n%x3yMB1!>+0HFzZ6M@m=(mjJ*imfA(Nr7;|cv zTFa8cd*6r>)IEN=#yqwFlbqU?HJSMuc&KZ78&S2W2ptX@v#gp?uxCL{XY6T1FOk29 zhmcjVZO9nfuP69M?Fq$E)m-ChuDhoT;unjkA}7Bu6aE5Y2`{ol9@2W2am<#ILj5Ox z>1yXaFHfy6>>9KE);*@)4&7#&rf?02XDt=a_g2 zaN+s438j=q%~TnFUX$pvxSSA}+eSt+YBj<{2g$1u4#yG6Z|mPh`(c+1HYw(%!Y z7Np2@qTy)x=&%)Ug*Y9_K7>_@BD9&5SC<4R#Z;>_nrDn~$k5@c>tmBvn>wzHPPxOy z7s?$4AYl0TJ|LVfY^OcTHRBPUQA}S0F>8!gM~?%Py1GoS{tdL=EN9X>+Q}W45ziTz zVK+twx`meee?M025Fa*-`~t3mpvu!8^As*CJ|VjDWp*f^mqTo|&IkJ=B1`jv>^x+( z+qlaLsm`B%$?zMOXE`f8rTQWWmKSEVmFy5BD z((sO%t5%(BZrH7#b~rN~F|qn;$$ey;eQK6!288~Lk^vuRzlzkj3`J~VbCp|wQVmRv zKQ?L;Y?hIgn*;K8%xXCti|j6;d$}OPSM>1xfpJF(?kb>G*nx=4J;HZWJ;~R45-NrA z;Hi+GPKrUNIHmTooj2jCjsEYO`m7VswKomVn&^`1P9-T~4z=mC5S4jlF2gtBzk}); z;3komv;q)$>*6!(pfV5wya!iqZm5v0y`#KIr0uMB3Y*x_Ze~4F3P0YUpF};r=z;{J zng0u2RfRWM35_Me75uY86kY7g-^d20|0MedCVvEodlx^%bqquXRO>$%_tAKN>{xRP zm*HH7Ty5+d?C?jiXA zv_lXGR14L{fr=KY0y4H??$JiFEE`DuV~}KXeNE~{n;s3%Jnv$8zmK-Mc~x&u*RmCK zOV6(B;cQN~AWh$=#+32+$FADmXnrIY)R9O>a6lg?E&8PNKp82a1TJHVg5-GqiS%wU zZ=!b<8{@i9TPgn8m7J{#=e3F@)uw*zItny$dgIE#VJAvb!)-;g8Lb(&3>_UbTZI>w zbXEd$o+BjPKAjv>YUljHms)P1u)*!}Czv@-7m(m<3te0B$N2l&R+H>pv0B%!6t}<_}c$+q<-F03^ydj$V)R^LOv*6J?+w4Hrm zxyIeIg?fgUL3dqt>0fU%#;cP}!k(x^r%u{ve|j_>YHw4Pk=zY2Fv3lPt>xYS0L`3V zGn{yg^*I0bq)h6ita0 zke4?Cn&Jd$f=a;#d-*6&&>~qs%b$C~iAD6k9WKwc37BvgLuBmOFM?Z$F34IqShfcB zbY?j&2lEQ)O0_i4LJh4hG5o(ztwEYqkxi z%Si^*2yGV&fCmh^sus_EJE9hhHs!Y9&{-rF)@!3=jq=jn*Av=kT{o_LKfp-h&-NNK z6nH}_05)H%y|q`>a`X5x2csT;yJ7gD#ol#j&S%Jy8rk6qpaYLDS3RCJ+% z2M~-(g%U6>kxpfzLY5M7Ihz-Iu}?SDnjH@sUl?{Tc9!av&+&C%{pse`mTa;+EERPv zd*Fd|X86I4Qg>IuaNoeRanlq-8bGv98W5Y;MlW-t5SMC5xs29+ckh=P&RSM;q0b|d z(kpL#Dy?_#K;zc=ieiaSt~=O6;52}5H#N;iLA zquWLO)t6Jb8V>ex4LnoEU+k)Vbi}A4H{*E*XM*-9kRr+ddCq1~RoB<4Nr-v6a)NB_ z`YO(00xaC$uDy-RTlXd5O0=P--)3JH)|5ous-I>6r{|vH<*^xb7i6611YfRo{Tp6> z(9GKl6C!l_v5WkD%$Ux&PxM>&Os$Kb*JZ2N2Vf2onr%dqIu9U6=V7M-mokn6pY#OC z)xMhS(0?;9Ju*V4T<_MqL}y9YY8@c$0KN4$J}5H5w}3_pxWDB7>T5#&kw zl7QWHa0r-?xEH|dA4HC$WNo5C(&shvgVY6r##;)#Y;;vgpw3nfei32Va8!7GN9H@R z8O~}zJcmBS4d9G`w5er?%K+PMAT;V>Z>P=*=jL;0LS#`sDa`UvN$4^4=)0S*%5Lu@ z(E^Ek#beuuI6aC6NK{(pWRH~jJaMeOrU{bOWg}4|k4;xd4{FW%g8S%28$hE;(OQu`vsaOSNmr&$Q7#Lkr!!zuTkdyfLSt z%Ui=NxDRdQ7v#<>T0kUH7SvURduZ@9HXkpGP8YEjAG0Kdc6YiASF7{W{yA)7DQB%5 zLHliDGyC=XF2|AggJqvA<1EZ(sp_vFP9sWuGUPy?@;AVJ)#}>~dkU!ov0qV!`nm&~{J%SHtVbZ1wL8h;P@Q)F!zAYd6I0S4PE=(RkDmr1Ab8W^S=E+Hz z$BxiF4YGdUBgmok~P`@Fa6pVE}`#&E1z^B#DT5C_k5o2h)L{V>)ht zll7E!UADI)pZ?Ru{KQbzu+tGLTulv*xb5-!Oqx)&Qy4CuaDgse=CJpX=0s{x6LwN4 zP-9~}?8;a23ky>FdBB75XJ1z*=I5uAi*n2U_dKBSD@*VIM64oAe~@C#K5QllmONKu z50aG%US#c*O!{}qu4K+65dMCa&}~q>tPcMOqbL8tmXQVf`TK=ns@THP+qO}MAcE^{k0v9Tslw-PwsZzO$3gUf23>tr?iSzi{{V@tsP%?1acPyRA=T z3j}LDEn6j2dou^<={ALy;UD0mtm)5dO!s%jJ!2m}ZdN=o^9NtEI8f(m$GM-SNqUdd z9w-N+?r9dZRdRRDP{qpIdNE_@zCLW&peg14x~;_Uy*xBVfA&sW>d?RBnBS-;2(3Pg z5JfZnpefgHWg?KXoqUZaC?W*=qCyWUNejF?{^5^Vf9VTF$oiPHZ6P0R+67#A)2@wQebb$v@%WCQR?us<}@M;0N|HY;9Jgisu6*y|+3q#gH9~U6*|SwS2q`SDi;_HWURF z5Sleb7#>7u*IdG7$V@EAIgkH7e0cusyX|Dw3&@1wv)u%}p{p$HIQwB9NZp^xR5czj z5_U5ODUdlgT<8E^vos+nXjbYBYd;q&83E_>TbB_V*x>c@X-mWJU({@?YI9^ZX36}H zX1qKR8EeOnjS1PJXkp}M>s6Q~yKV9=p7K0GK0(|(#c@T!hR}ubAYP8Z84Zb#BRHnW zXLyM^zD12q5G?snW56c=YGp(|YnS-m`{%Lajw_;x3l*-y&f$1JAkV=D5^*= zcKRz?l56&2o}v2>%Qz<-Rs4JPjiRcfN=~`EC&%77kJ>xi&r?;wY|0zplU5G_zPD+- z`yLWJ8r|KKyBl`0mQqKM2|(VrE=zwfMrxoZG%U(~(t~_pZhI` z$ONzxZ4SL&J*WvJPC4BVmHKT#K$b-@6QqWog+8B9%V2$34Mm>AyVDOcrP~=}h>tXo zH0oOmyl#jUX-vwYgi$8i6;eHz_d5NIhqXwxt&*b>rt$>h%*gbr6p2>|jwDNhD4PZI z2v)qZ_99+YkC{HNe~}{~8k&@S?|HaNKtISxneD;ldp#?;LiJ(Vo3aTj;?|vdn%6Q) zkhqiN$YI22efhq8NwP=D&t{CG5Y*-!fiZo*HXR00*SL*dB(L<(Wg{+L&39DHuQ44Z zpemjU#Ci>1-T^s0fq5_@X~nwf0>#3I9M*}N-O10@H+b;OER)jGx{0@2X=hfP-pPPZ zy{AcwFW?S<#Mo1y1e6e)btn(4lp5|Kf&PivyK=@u4YKdFF%S6B8J`?7WEzZDPz;I| z7-39)VT_q~VE~ckA&0ES5r)KP{@^j-S=;Vk4X(TZb+5CFa~57db~%#p!h0X6a)f3h z{2AOn9=xS7QA4Z@6w-4gd3YK}%K8sxsC8r1sq(ysfwl`r(|es&(*8_JJQ6wdH|9vB zl|U=ENg%E#Lc|p9NB|2#Cn#Xkhp!KT<;^Kf z$Z|mct!z4@wU`ukIE$PkP!G-u@%to_?{IHU)9+6yC%ck*cz05zjpK zSUc(HhDLasY!tt9aQveL9nv!!wEOcnwbYgR&;zbU?f4-`Z4I&tU(acbvgWYq(z4D# zwL{ex!wJi)saD1V3yw*hd)~MveDikj@o>*u%XlE#30jjPi)4sghs1p?t_kKC4katL zx%*e2s+zPw1qMAlcoE48PY);5`&dijqDkN|!f)l>s$mtw?Ap1dp>lkG1EJ+xh-ulG z9*P`a?J_^=$F8yb6u5DJdsu|6?lWP&H~bX3WTD$7*s3fs?RwRd{?A;IH`s5m<5fHo zS(ScM6#oo7r=I>IvIJX02W;{zRsSA7A7C<6R96$HAq;;RjZCrhx3^F3a>fT_(}}#> z75f0Yt69nw`$fOUwmanN4T$8zrv&6mcOS;h!ONt$FjS@AogBLde`H9hO5Y;YZY3{+ zVY_<*NSns6;O&zz-tyezz*Gk?=c_p8{}7*FG~p8Q;aixdb?aH-d+!`~e@C7acFe6lA@FW6e#J_`y^MzRDcT{lUH3Qqa2ID71_?!aHM6zR zWxxCmU49j#i8%Gw`SW;}`r!F4e>;|c=T1O!zMLQn2-2*4J)#e4oJpJUugUd&=$Lxc z>;m5{g6Nwv0bR-TUdtcptb@K12G=m7VwdB1sm{EDrgCR+FAooWi*@HDI}e`ZYrINt zu)Z#KyTrYvH{#6xdh=^w;69@@_!13#dN24Ht+MH2tznApk@L7;seqThVMZ3JL^3-d&pL+mz?)<^FzYu<4x;#AGmCQAekxfz!xl+J10|xj!d$ z+U6HqWPHLy7Oe7a$*4_!yY7R`bj)v_J!u~MYqeLipf`@9-tigBnN!3VWX*2&A<@MM z&DaPuN5TvhR2m?65tYXp$zO2(kiz-8M}6JPZe4GJ)|RV1L;MTEvjMI9_TZ0$o!k(z zs>GlXLISiG_Bb(UILFt^H&NDou>Wlf(#CIn-0k9re|n3(7y65Q0u~8ir4MLf5@`Xe z391Ie6w_j?M=yg8mk2c56PT4q@6-uj3t(=(wUm&2v@cCk>SJ}F_tv@fTRqwy&C6%j zplAdF04uLOrhqQbvgM&qbR*W%f4YP^y^Y34xSGDi zqe5V+yry(SsFZ1Aa zfH)yN3|Rw-BdyB#<*M*KlDQCNLQ8}vn7zw{j!BqZz<;?y)5}n)uWIyjKPv0%H^DvO zwrA_79#}KO1GHKE6+{I50;#9Ixu7R1THW>9(U)5uI>vt*q+rm6V;?iJy60mQa=E`w zPblSGr_4Hx$(GMbAsyR51HE%~K&IB?X)rms%76aAO!|!;&3~t$Ldh_xfKAA*ziA*t zj@~V(U?ggb_h;~JTR9dnG25H1f<_Y0;R&bXZd63|vI0yEZR_hGG!8SABDn@mYjxe$ z?{QAdfef9zCIr58Qq>W53IXGFg>epy;c@13@NLKoP& zw4S>fB-f=rQhrP2aca(cgr`Fw9EFKC#_s{eyHGkKmXGyyYcO^RD;J-vaaFl==bGP} zzdL6>O_kt^KjZC?D)Thnb%Y#B$@i}neF}7HLYY2!l<)g=!^ZbE;aS6G+%R$=BqOsR z`X06RXSVW>U7-ik5t9wouW!*@FM$hKAQ&}4{O!dKmK`V=hO*3@r*$tH>Y{EoK5h%y z2`$Ui(5bBw@8Ek|oWkzEL}IdF8~zMfyO>G#T>1@UMM(eL&G!@^J~xe#fG8Jl#kSH| zOi(6VOm)mAR%6zKW<*b1pV z#yt9k6lX7Q3#7x>=x*sW{I6jCY-Yi0o$jTTx%-I~_|eaEp;SI2W&`wNMKuI`gN7ge zIc_KV2;!djc8|_=@xyA@swZ7(82g<9xHlVuXA&xNGhSn#IPj8U`JUGrKJa%dy0|&Y z`bm~J_i7~?cY{@MwW(e^JSse})e{Btcm9SnzhPNWm?tvZ$Hu}Sh|mGS3gZ?!V)Ts!6w;TZKaSR5nyO6K|;2O^gcz1<@c zv0FUa|CI*_y61Q_iF$X&;E2dkUU(m(4BVJ1^XRBeQ&gl0XlE}oHsJDP35*LwQB z$@gRHlIn@!kR6XL0;wjiggx0)*jd;a$aA+;4=1Q)kkcm}9;mvV*k{%#$r@}*5rc)+ z<0wU*viN`_FL;^(Qc)rFzj3J7Sl`x?NIhZ*&Z1=0sk`t-b+@cW$7-gUzk{64MWVi( zwrAE7&PwQoQ|EbP76vGRUKz0_Hc1se83L#xUZd)<_F}k(tzXX9pRbL+eB2-^tJ!w! zChUVx<*?q(N$J4m&bu zy`W>v@0?ElQM+0B`aJO{VL#5Y02R(6v>{@lOuW)Fo04%?Agjx%=9T^j^JZsbI@Py3 zqobz{7Yy3vs}tx_uH25N8&Obuo>6WpM@aaoRhPyJyhY<)R5R+OyGAuSJLw?L|JX&U zD#sGV5{>+1(8rT?rhTCW!GO{VfS(rWTG z5XM?RecgxZST7Q5e08Kh3>V4TabNN|{DSJxsU47P!Y9NVO<14!0#8_ZTfF=NW;RixcRp9V?e~FgF;ACjq1K3!W8!yn41K%ciEpWYMi%qw z3s`<(Yglr4VJRm|AS&eschtNV7I5^5BUlCTtZAdkpdhD}s@({@3@Y|#%i{IbJBvL$Mw+N^yfN}A z{$VgL{mP+q$b`7!6w z306%;IQ%XfqqS{qeFU|8@mS)Y;pCh(SU75ghJqgHAKxCZ-gzrlU91g*D!@#6Q8U!S zf}T?6?n7kENq47@K}Lh#$hpVHoEgZO&68EJ%P)D)Q6?U_YM>z{8`EUN&ED%tl@5P%29dvjQ@nGi-(@G=GIPgwktf>5ABf zf|ne3)J36D8sizEHn40ZZ-6@JA?QL$pG3J|mw4;#Wr^~Q!QP^m9vTV{TQ^R$T3aqE z6gq&3mxV}9Xd;3!jnIm>c^yec6;h~&VF_h^wfK`Ura8wZCdz7se;{W_R0S2$XEzejctmTARwR?unCAsB+0BVh`p z6C4JI8^Lb_aRmzxRhE1^8j_za8(zb?mjK@7Iu#)$D5wvu@)-m3AZ4rsZShj|f{HU0 zT?5tzzY4E!HYL9X`{cl>*uUUj$$vG(K8JIT^O9&K#z{s!`!2!M$t1AF-YCx!6wdjp zd83=BE!_@$mp&-&&z0cseN@P{;<68nH3{+$J^oT#9q3~2;FNAZfZr5FEr;$fwp-q* zfbE7h44|%+2m#CDM2Z2}RkQ@|f}f>DS9qF4PV4{)c{so&S#%Pr5FYG)hK10`vkKi^ zaePJ;lgQ&B@3l`H`LCjag`um!+J|of1g*#S#pnEq3f{Ern-q83t1-Qxt=NgcTB>dI zT7lQA-Z8#XRlzJP(h7M;K-#JWxk5L=Wr_GN%@g+M&0_BHK9K=$v$cU1J;y&b+z^|1 zKNodWjj1`XTlfCr5vtvn)jE5A`i7zppeJ(VA}H~ zm|_o5V6V^SmsT^^(;2hq%#=$qj{{lbssZd6P=G><5gYM~0Z&UH zb}G@8{#o;MzB8(}8hJKuLW6#0Mr@g6fytQh8&SPI{0WRcIYfucp?nVEFb>);(&y3I zYgs+LZ;BRg;w*-ZgwLWs3wpx5pta8%-i6<4t6!eAj!J2kD_w39Y$2Dx40-nqkjY=a z);JK_tqdxfj`rg-=L~A*Mmq$-G8EVf4uX5!LIL{*1F`Z2h3)akN61@{%bcTmEAYO(~>vp(2 z$B!cS6F&~Cg6|~pkaBC-aI1B;gQ`ZA@F3J1nh-|(JW{p1MQIwVU5^JMxkQodW$ti$ z@}noMtmxrZ{X+|rN`SLJZ_Fafz^*Ba?Q%NGH%NDA+9=CVqPFk)r3Cn@w-0+wG_koX z2VNY5znX+UC%VBWMEmf{a^{|eMuCf98XbRv`lUhy4f1|xb!YgJYovePM7qRRGusZs zLtQ;`XZjeh=H*4g>5X^n8b)gfpZby$1EQsmhv~V;$w{l${Ymu!`lMeqc6aEUU1gs% zDLT`2;DcR!J#T%w<1zkhz{4KmQ`}t+Qr-g_X8**V+;8L>IUh25G{;`kDd+hgE*JJf zAPZx{0xF!BA(E49ONZB}f~K>|mTyEiEBOkfx7d_T+wAu3;aJUq4P{g8$t+Gt<28@2 z<#Z>r5wrG$0CHNI{e(xRa6i72APe_V)>rb|POs0K$4gR^WH?d3*bJ_OmPGBHyZ?BW zdsL4T?{_>+M0V9o;oL(Dy-l-&lv1hh>u$fFe7{j9DQE?(xJ^)3O27CN&SY>IXZm4b zfQ3!z^84PjI-`}_t$A`n>l1W37}w;l`(xLA{ikHuPZa)b0!ZTNO`gU=uWSmbLpi;c*9>3B1>hze{hrypw`s?1hgR3eY9 z##E#5!_j)WwId(+o$GyKj1*5`*9%d_a=}vmK;B+K>WCQa}1#U&R0!- z9S}}d2qOoL`t{Ebs54Y*XufIAeQ!dnuFCDPQ0M`FTh+q!p=vJ3jE0S2meC)g%p?^?py(>}YWbOn%Qs zvi)aG!(2xK1NAO#^{MCDeq1R2{3xNgR)Knvmn@R0XlI2#6aU&B!NnXJo6o|R6+s}* ztO+->hvJMK3JU~I5Bptp1_k==Z7^r$gKYZTY5#jAw@V67!g7F%;KgeK)_mv`A{KuV zrK&lASN=AsRo7HqUCS@X_syF$WM;@-JdgIzJermYSF4pD{tbSrOn9Hre1)PYJO-RD z5cl&K&nWI1?YXsL1rRokku<-)B3bf&N_fdK_Ql(h>aUihT1e)@PFAf@)J?k|3VUf#qc#0zIG`E(oC*;IfqtT-lGS}|ziq8#9EOV$`pxA!YgIFsMJ0Y|s=LZg z{@B%R?{i?^g#Q@`piW*&o_>?@ZgdLIP0~QNe-UKEB^E* zODlcpByGaG#+IgcwD_Mw0=C#l+hf2r7aZ3mK41j)l!-Ntf8mwq8_3Z(s}d~HxuKsl zSj(4h7zb`%L}_%U%Tf^ZG~QRwUF0d^F_%tq`RuSJ}5giv`E`{Ux&F z<`Ay&)w+XVmEk*;QjAyYt|aoSs%D)RE2^l{5~Ur+DV@JTlo|ASI1BP6A+nBc!)AJu z$N4_VoJiDZjG1pKHmK={&GQnl^CVwyKpraB#6T{WE!sy>i*Ei9Mm(kpk=WY$XQt4hlq>XGN zs!*h-AjkYwj}Du8a-tyMhIz-ZNmJ-RCQ}Ei#`dL3)}^?SyVstqJAQ&I5bjhYL5|V_ zAmB}L9yUA6I+Qt0l*TsQXFMl4#9pnfdVCJVP39N<(lZVXY(39NSxS3#CJnqbTJP|E zgv!li3P=+N9Jz{*Hp<{FXIrImGr3YOV=fIb!dv~G>ET(;-`5Y;lJ`(%&$+EWc2c?u zr;MZ(nl&m%UeEd#xrexn=2h4Y;w(@YK9nOGRy`c=yfKo;m(PPG96?k$*5A^+bDNNs zWz*>TB)*ahXGL;oPXc`t9DwMl96f6 zcMTJ#dJZt+B>#kBW&9Q54(HGwnO)|n$l3R;l>654cW1?y23bc+j$N(oJNZ8B+Ds0m z{a%?3A1;zD;r`gwhK!HnVq|)F)GpAZ$GW@F1>EyqX1mK;;Ro}-R@*F}IeV&69v^lU zu9bNbTta;};@MqMJ+DDJsWi@xy9{mJ_D!NFzh7iAbF*rR1ulyY{gX)NPq_hZZL-wO z=+rsqBl6n4LCz0-mveXoXP!qM7X=3ibt@ETUblRcxI{6o^j&3Ty2nW?ALlSNIIjef zO~UR=gijGwf8)aw#HRDwp;PrZHGY+UMJlo}CBkS`+D0>J8yl~T(dzbg2-FZ>ucEIN zFo+MfHb9zkA$^#=FOSs3BShb)o^TrV5Bn2{8J<>*ThYs0n#ws@SCbogRos&zF`*f! zp#4lx^YVQ8l~-GHBmMSg1TcWN`8A9-aB&HdfgNRGP{SE|2a)#;$N!pnh{ShlnFj^40 z=J+Wyt*cuHo$h<8sPlBwmm4)ph4OC%WnhK^%AzbrFfbjF5lQy?iObNqrPSa|?`Ow9 z6C*#9bI$F2^HRB0Nz-5cY08=q-v=B*C}Sztvz;B zPHo_1lDjdQ;0#!St4}r)rX;#aOLnU16Q98PAdj?i%k&)wDWT=_!%Frn7mJ@eH4_dP zC647?xov8rY-UrL?I(HbD5LV9AbH{_>@(Q-W;a8W^9Gecw$y=PZozJ3 z@i2RQ!gOMckk@g(v=RLVd0P1xZe_^!pQV~J_QmhA;x;)uAE=$&7fD_2~ zCyx=T31m1&y;|HObeLfK3N15dw(915mPeL7%sKkN8A7x=`0Ip8{1;W7exENjrq*NK zG6f^-*2p027o?TngqTJ$EKOtukHu;00WWpJJ9imVlOlwUl7YD zw<%RE5ImczoTvNK3I@F>~_aKY0kQlfO_Zek{-uZPCnvN3Okt&bkTes9g@#E=(MHrfW9--_Hcr|Y{%=k zF-Yn*B|e+n6SLTQwllc&vL?;1%Kx0jnKrfYpSR*{9rk|~UaH0FDC7}}%o`y1M!dPh%8D**r7KvybloTm`s&YUXU~cH2>bR0+B62x=t!X0 z@QB=|=O*Ns>0yd9KL@Yre^U4AT9;|}Z&^ccD;pc56=p$>ZRk1n-gUY2RmS-F9$0JQ z^_^SaS4xCFI0!f(=N*u;&Ly{I!~X|+-yPQE((Q}7m92;<2nZ=Nr}`*jdZ1m^b%TvfRsQ25&{X~POxltJKwkObDsO0 z`yKxh=Y2Ep%v!%yW@gP=8^#)x%$!o7fobvCEmjhF2J7pk-ihunUoDOFs$?LUo*+0i zfob583W{fDm~*y`%!ro9MJGB+ljq*Pe}~9BvlGLQn><#U?KR(ChZf|-dG!gn5&}Z) zwRrHrbl$$gI$FRg+0h6kIeLVS${#sHz~|lK1(u&E-_zT-b1vNQWvSE}z5U^E*h1hU z*G1S?b}f7>)~qc9^ z$hq_=w@dJd?a3j!B{xM|;YUX0(eyHgUOz>=`gEI?3`)Hz&DH$CjF@aHf&biLUP^Z6 z*%)biE{~_Tce&2#o-v!pQ3U%T8&EpUMG`3<1Eq8=xi*8H&7aLfF89hGn}fJj1@&O- zt`fyon?xry5ma&}86b?QvcbPkG?wZV@SJf5jpXNnYX z{9t!z#B2h4RSA1=Cpx!hA{v!?b_(Re&MCO+ZajR8fB-wQ=(6qP5btWU;Tx#cai4q@ zi>T=#3+*8;%qUB}8Zok4n1y7~RN^dC0;{47i!AX0D;$CS)dW8DMes%T#^xca{BTIg zX4VNU%>tbk1$mdA3);QU#{?|WQ){w3g`E}XH}i7LJ-L*x7l3IZ$^5J{1vCs%<6xRn z-^QYI4AKm+|#rxq0%9p?uJ7t9hwO~<33qnXAxcA z!2%UZZHhemTWOHH>HM=Nn(pUbQOrHCb+7LE+vulqSCR+MZBFUxeO%B^fq?B!tUx+S zFxg|ev`uSYkqq5u<$zgU@R`@W`=aEZvf8@UE_mXevNxeip&B++C_R9xcvoW;l0@(? z5o}JQjBCKG6B*fttpjaxJ94@ruXptjuRQI~Ume>bWbP>>GkEM~K^~G~&*VZ`F~Egn zgK9DloZk*_#gj`z`WGEZGV5iep3Sxt?>p7e?lzWqgy&qho<>kpdPRD%$0=b)+2OD} zC3@IFBm$PE!9yE(15U?^bkgm>IemnmhIT5$>5NeNg#>UrE<)6N@=~XUbG}{FH8s+k zxyScg2Yt5#4&3#SM>}G0t=On9?f0Vj!u>OX6?+4AHwn3x z=Xj$MN%^ZF^eqdIihP(#jL9kk2eU*>5=*@$TqXz2GtyPrmX5Gb-v1V<(C?URXud^S zeJ4{m$|X=P`=P?m4fP+;rCWWa#(dXO6>rVxJCfKDu?+5VtG(3pyu!rp9^IFYdmUvC z_>;*(_~QdMwlI}Vvi|!l1Ro6(kG?!r8zx|w;3%s&I^3;>s9#fYe52de|-Bkr&9%eznzMXW)Cm9xO6Q8Fm}DHD(jFB!VW|s+5DL@e-=| z1bQu%!o%?fI@giT&UWB5{HJV*O3_MZv7Mn6rCKJ*D2@x0#>l0us`kn&2JvDH;R>^G z0uBWZLiCc(0h!5xzKVUVuje9z%siQ{I`PogSfpprr%Uq%lc%e#`N;SfU)Lj2OcJ?X zteoDrNrUG)&LgNvc0u-JuvM;iy5(ExD!YTd zj-f+xoLtW+L-LzDG>t}dncUs}`cZkd=}rXQ^LYq-_}ciM_xDQ7ueJ^XKcaMhuI)k^ z>l``V{A9Dn1rlsU^gwY{qd4%(E6ma<1n+K{-6pZL4?X(MdbXP0!G zf7)@UD^=`L&?k+x1A5TARsvaVa@$*kXJTjzVg3$K%2(|z?`QFKhPaB!HiXtaR=!YORpss74+9toO$@WPR zF;X0g-X>5#=jNH7>i`3{Win%MWI`Z1haQ{A+TDDCrdkoqBQH?yyEjDXb+4XSh*sBo z=9QAGg+VU%$ZfMb-A ze80$u%p-58-&UX%i%d+2c~BTgbZVn#o+^hZP7a2>Dj_Jl&Pe_!EAy?a%s=>7(8}jm z9^;BfN5ovqUz;K6#W>c2Iap7(KIb`W1gChz=jQQ?T!d7eA5Z?r(crAx?4};6Pdz)W zo*MTU{)-f2f6lf4pHzQfwdeUzlwhRY!ehmm%?(+)?G$%ND4M2x<=HwaoUwZahyqR> za9;>C!?8o(8GbgAG8_!HeeDwpn`6CZJzC@nj2{n0Hw;#P#Ip2#&$E;mQAnya-GHHL zP4%wsTjN6UuI^O_W(1|5j5~%Pesuj$!h}W6!lY$pQB`TQBT8HBidrl zz+Bl0k(N!mg@YAIK0e!+LcYyd5npL`X9V_V4Wo2Rm~^R9YgAQa)QHL}j3Cd`W+w0b zw~vn$H1;C9?{t5d4m)sBIb*j+g1o5KFmpY2dd_(c+~yI`=>SVWY%S&;lo6S=L0d4h z!}xEWW@~f(|Mlo_<^w*)SFEHeonC#!{+F#i-M+w2uV|#}Zb4V~l(N8?eIQP9p^z=a za3o{Lu>+}S0fzfwnqbMJSoo-$fkPz9B+%Y{+cUEI-8(_0l9rU*_8~EhMmxBL#3)Vy zp0p|mMFn2eWF>61U6&>P4(l-KI0a>$VDBZFRiEb2u6Eo<^>p~zdnYF8$>G9s!`HfT zv)9kPPm*mJPPHr@&4C(dRqtBliYQ!SfmXH5_rF<5i~*)I>l%Xx$7m>!%l3QJc6!+~_i}0T; za;5gY$(!f9f93>wg~x5HTzpBJ(iwX(&+u?;=g{a7iPaXVes{8MN8|V&#Og?&to^2M z`@*X~L6(6-s~m)IS}ako^U-zv-ZJ<_{W41A}E4s8I>GQMqoz54vD@qnbdMd{JdedKecl|!qlLc$iaKa7+iZ@X*FC8QCopL$F;%$0FqJOX~a{cj3?gvEX&hCBATZGP@ zZ^Y2iX0#|YaX-nX`j#@n6{jp_?jvA`Z*=<1B&>H(DX4IdSRu;e+H8Y2uMRZ|6A|2w z7A>VgX2SZiA&5xbpz9Gfg2f-T_;peJeZzysl3PG;FAee1QoLgVBbNZrw z%tc$V_WkwZAH9#eYgV6+KabO-DON*QdK~F@LGvpjDSf4nOo^ig4#viYy*_a~Au)QD zTX#+A66*A0H$Qr9ER@PLW@$E}#1h9M^4PmFF{T8c{jlZ?4T03kGza0e0w=~cJZr;V z2{Yd5uJCZ5Ur3bO=H{Uz!Wu@tJf%l!)`Cu7|A|PZ0=8 z|7ld!lUn>cncQ&g2*+b@Ye?sgZ&88gLdqAcNgJXD>i2;fepX_wIH^~7AL-J0aCK%_ zduQVb@g^RV{6J$pPlIT(QTJx2xd`XF+cBCAW<9##B>f!|%@V_u8_ySvinhG6P{w#bK<+1#2p57y366`~#9yXl==<_iZ(PTuHekcJ2KD;0CQ1fol>*E48BuvA`E zUM;vGvs2(jf-z)Q2C6D7Mmgln_2ch@VuN={?^|uiciEM>T5PqaP!iLKrP9pa>|s(> zdp+5~3POu6ayOH;x7tc*nN*DRI7vQik6hLL^5?3d%YjDwR1rH(Jo`hgA7%vh*GpH3 z%7v@l55b)~lH6f=^hUKSa<^>t4%+OwEvf@L`+lxbyzBz}{qbP<+ziLx*VCbE<5=@V zuo6f}G;jz?U3loY$fcFH$Td4+$9@YADY52g=I5Lh|8F0CWbgE7E{FbHBrBCqmXZIw zAg_>qr3;;v(-BT4%i0}lF-At($6E|IOmw?tm=!3FN5ST1z@Q0^hlG+}5;}zl(_=`G z0y-S?+f4u4pCnT#@i~|)&MzF>*A+UP_+MSBUKYy;!8!D9p>D`bvGd}s4pIhQ=;h3& z9R)#6`X^k^WNlJ*WbmyHm~;pBT1KFC z0wW$yQz&+}?S~1Bc$ow%nH2lCy>B|0aVbBj=eeDHT~j%4MNo4!sN-|g2Kix%S4uRS zetgj5Y-6UZ|OduRuW<`5^e(YBM-i7ot_)&C%zs=&Bv*LG1W z)cVBHN;a}jzp%M$*930HJeBq$zV_PFeC>ixLNM|n!Kdlhgv14nM<~A;b zca5X2(+G5EYl$F(ugnWtR;)^X5hK~il5{7T<`(mu{veTEpnLKfx}uqR_AS%uqe!H= z>CQ0s`VitR)f|*;P8-1%azhPzo5F&SkwW_59K`Eb7(yjVAxfCF^VEYhexD~6mX(=t zQ{YmbM#Ao~%mhS@rjH3imbc}aME3w?ZvbEPq#k>2C zw2rfs2fVk5ow;xBt#sEyN4_Lw{q@ebRyG~8>xd86;w2mv8?jmV+br;1`W5P_z=1VQ zARCfYlZ&Ib-sk36f3f42j`C#f^gj@1q`mI-eI;1Lppk`1ykF%{mmgbSC=0!7pe=a$ z=3i9ll)`JM@BVAi#<_RG6Cm%HY+%&&EL`p8eJZLpd8BI< z>*fObbxL{lsv$Z19lNB<+nQ%!e5?!YGd!Rq4b0t^*&}I72(sLZ_NF()ocnbFTf7}0;yI{u%{#U#@6mjkAkAN7DtS7&tT zBhcaZ1Jf|}?i+HAMkPJcthsJqdvGLb@Z-t^C92sQ;3FUP(n5!~PI1+f&af~G+0cYAfApOXCvgZq9>yHg zyO#ka63RO`^F=$JYqQ2yH_KVEvuZ~TZbNXGu^@8O~F4_T32qL z1MQC$wY{bEHnt75e*j^rv`zgOw$kdC?3`>%Rc+Bb&RZrV`>uu-IJw)JdnDL}tH=eV z`OPnKVfr#N9)XJomDe5W$(St+!-2CO5~x*qN+OgvOLu*DTcK$s>WO!mF+Q9$$hfYZ zbL@#;{#o`~a7Ae?tO6rgo9aQRa4X?%m(Nj`aoMId!6$2pZzl5$!ac+5XsLTXcIgQm zzhCq5Wn6~g(5LGJM<2fAn{VT8zKP3KyY+7zi}6V=WS6MJee2QL^!Nc@l{T^35U61j zB2q@)wxEZ%Ey>YQ;*Ta9B?*72)*uK%)+!r@jInU~ro|)coggiTrAT``8+1s8w)}vRU=9Hc> z5_v3oTdQA%fo_6UgwJ)ftvjMXrD9C8cDSxjZ1>B@T^3r`hD-bfB@AaVGx_gE(NqI{ zK5aWCB5sw(RC`ss_%E>aAm&T9_WeOCgF41C>;-yGE1 zwQ%DK%aS@)!4@xKgwR%!VOvj5F|cQ2`i>S9&{l5Y@7WGc_=ofE?}|J6a~`#F+9vAy z{{8MyKIr9WRT8q&@=QgSIG!x4u4%2G3zBUKdwaUHJDP_7te~nP_3^~3xFmtOD+hO( z4<$_oX*JEqL}_m}ivDNz;y-&2{2$Tc*sl7&-|JcVZwSwS;ydf6CCec_y6e%C72pi) z^5(wXlWcF!X&5*msBHCD*Y+Hyz-W>1&SAP6Eg%FzK_EfQ%TxJ}r+f52nrA1^X|z|r z+qhF0NjlxK&M>P`ov^%v4;Kp;xnkPD68hsJ7tM8wK+$0yVx3=zVr`2bp^nAy(%do1 z7g9zag2beoC=@8jv`X^46hZO*<<eI)lZ*&cpH^J9WP@N{Fs(RhTAq3kP2qQq;ii*d9ABZ zz_yS&_i$0o_wjOj>bhP$>QO7s48+h~_S!HWQ$TgI9CTNFr8DX%2pX(}ZSe?rvp0RV zlowuUW@hIl-#ScJv#_$8(q2!EDsF#`NY0Ay3N$^gQi*pJZ{(+K(qc}5ySl@ZkVI&8Ep6TVDOwSq4@nOb*o7&-9^YZwjYh=Yu+kN5 z?-Ko3J>=;|%O=i2l)Mx8GX_Ioc0u${^X2afmNCr5(;YtD)yHOG*$Uw5n=K`bcDsTt zOue6e;R1EIQW!3*A(86wsLX3k%%iTJPt)c{*3;?js{6WgOb9gUgBp@tm{gaRkv<-9_K?x+=TT@ipXnK-q;kcJ7BN8F6vQle>hNcao zMU3vdC|)Um*m$~Iv(3MOvT?B2cER-v#ZWj}Jeg3bD2BSk5RcT1Nul1?)T?x-3rE@p zA>>`9T3cPr$8MZ+sW+{n?XF(a{;!~{R#8n^Dcv31W#l<)$G+0Pjbth{fmdamt` zo%s#qiXeFhNQQrEAt}8`IDX{1hj1xds-!U&0Y8`D@;T7ePKvqV)jT``fj}ld*RS)} zLFb;zoD306;2koNr4s2k+jA5Hv0K6ATJflO(+;>te8pwNAq&a&z@VdngCkAm^^h>S zy++<^pI(Q+{*J(*v{CP)ifKBq{S&a|!q+%x2`bMyqM1`@MggPSw*w-egb*JyXl^fc zBtd`bVCYU#6w{HD%9Q4MMmKODmn3FO@B3c^+gV=p1B zcfTUnJ940_m^RfZF;uhUzD8oS{YS;QB{ zW`oUHcRa8ZUbz#W-p3q&PwHU(x{#x_6Q#P4=mJ@r#FAi3eMom*;41?aN$}JL`Xv>7 z*ByhB4kyVr@rz7J-3nbBwU-BuVXxYr>H1~9Y~06l&`sEte<)v0&ydiip?!ssX_H;>{Z zQ4P(DsNm!BZ54&wv9=Vhh!MrpgdUP0{8rke%p`5cWJ1U!)NUKN33qb_#?3&VE}||B2P))lLm$T) zpWAV3sH^)hZ;q;4(xiox=gAjR5|$xD6Q@?r(hF$aRvJDR1^Tg!UlHt`mDExF6=@St zyhYK7BfZg`j*&Tc>4Ak0c04`Gre`R_UFLnj?o6GQ->IPZn%`+}T2gsmR{;G6BPpFB z)CbFFs3+>sL>nxMvi5)S3M;ouO>Fq-_$8tT)JAd)u|opttmAO{86Pp50)CIN~xS`u;tSO2L%kcYY6Npm(CRTIMN_5U-6>L2NTKOTzcT+(L z!+k&?juBN+fcDFnOdJ249dG7f?@@55#c;4@A#c}d zM|_uWF>U4h_b_1(m1bSqQD2GIc2Z$BQh`F-0VBJ4dZyEdsNUorWH@~Ca@=cw#C{gAXgOj6Vnev?9Wvu9^w z0bYA*!&BjiZEce(+JR=M$rZlseVb7x?j-EW-chTyjo=PmS4EfG%L44}$tx6;!iSMW z29f7N%JG87SuexyJ9<|H*YqxO?Y&!7ttLy97;D`20W$W@xPIDXiJ3!uGraJX9z=Qt z?O5~-e$(aUtlqnYP@ z8-11AlyQO#+fv_M)V=_n+bkG$TJ5%3gR6u>N_zF?5Bh_a<;*O?<;y2AD!saK(6KgC zj9uV-g{xN4-;?Rl45UlC+KjtOaU(OSiRTLLdHd|E}rlj8)y+)_DT|mNaH*$Kd0JkpBSc-_2JeNHTsi~c!E_cAinfUEi(oDu%MF5v%?|G)G~eCn8H zKP%)OPVG6@Q}v<#r)2Si5B=MIS4L+cH zS3X*W6dPRUbJy3Xmw4!1MpjVN4xeYK(JV5%>lcPhyChSd`C6GdrPIAU%VQYc@qjrDcI! zKd3#l<}F%Y)z%L8Yh3Uzbm#GFXdbYiuihUMA{Et7Sj(_26TQ;p335>tSg4`)L1%-G z1|<}aJz>C^zc5yjbnef<1Wg&&bqi>|DamjLe#drWp(%%lK3VQD<}UfBZQ3`K?g{Rn z^_m#7O41fO{7$_3**SI%gePa3d<@S(_U|&UIvfF?VnOW)#GB6wd5UzHtU@8J%aczY zoiS(E_VFT$B;r7#_yFHEm~ysQ3A?#TsqzEDxIwS5yPke`M`xCd`|)8fuFlKDk)K6( zW%1dHSF3{BS8#t{g-`T(bWo9MEF-e2ZBX$-UTfNpB7c!)b;+}j_XSu)r?Bi;lRip6xRbIYtjs z35uPHuP-{xltRhTV0V<$5}NO6wIx#XVRoim-E${t zsk|A!TfH0FJ{lKMBm9w~>iM}Fn@6tZn?EJnU4CW*ZF?tBpuR9ZwrlX@wgZ}t zLnT5B57;33{aE|wdOi}Sya%FBJGrCpTy7SXl29a?bHt6G#J?w75nKV3{fMe=i*{s! ztYEJ|mW8x(YWth3W1>H8G_!YqM;g=4Z;rij`=`@yC3^Uep1or9i$ZIaY}2l|w+AIU zhI}Pi+o{+pEVw&%kx^YP4gq(LhvYyVxHhFvNXp6JXxv~;TA@GeKtsK$F^Dm5D3?VF zjYP7b0L0>jaYSP0$b9H0p<5GGTewVj1X)H69KV%OX}Gc%E?nL;{!#x`CX%9B{Hid5a-jU6?;!RN|&LzKzVD(Pw2A!u^tj-Ac>7uM+8V~ zVXUTETzofQm;Y?kyQ6D|7S~4M^ zmz$>3rHIbC%x?RDKpu_II%&-I_Dt@Kc4xqc6Coi#QAu;l)(*WJ!clV#*3-#MvOpD@)$P2 zm-{u%hGls8db-~8u6M~j66GJ&G)rN7!(yd&q;)6N&U(D01Mc&cc|-lDJyf9nP(Ev_ zUu7TtUV*5`wGZ}L7X6Ab2o^!E*3Y0QV`8c&fIc7x%18E#| zKrtr@&DW)E?JcVQHc)PNj73n!M5*c3_thyl?Rv4~tPRKM2Q01W&LHoMBDa-?_h~BM zt;r&2vT~uNeT1lFPM*6yaforT({@wk%(!ptz43*%Qo>S+;4;@%15>u4YXJN)B6|yE8gdXYyB45B=Y>X zD;dijnlE=iF8@1MG&psNzn2pJUIF;8_WAZl?*CRfdD*|5kHjnegFs@D?;lw{ljVPN zKK_SV#eY`}S)_9L5C6sA7Ly>v_EX8)c9v@5XhaAvShl)yH+_C$xK`3J)h{<@B;upt zrlUg5TC-gQ1yv^-<4?(4aakHVpf32j^uU7Pvk&@ub*zOuK92?0XF+@HH6EjPD^BW3 zbu=@cIto-Ra&2*$TnRR^;C>T`8J-ZmYE={CHUv^s$+#BjC|{RVcP_%=f}qyv`jWGA zZWA_KRP1PJOxqn408UDa!FxP#P^tF9^9dWXNR*|O(UIDI5nFls2Q#Rt}A0k>f% zS;z7ixm=ndT+GzRzbacRfOJkn2{vbpYVQa3d418_<{6;5}g z8I}0a#K@B%2~NO#PwUIR(j>;CN@F#nmbSWy;C+=E$rKTfkEi?3Kk2aD?Ocsv$O?~V z!C235Z}?aTymS`1cAE5av&5eCKTAnuRkzb_5aWG9C+281J6C6=pSO`ad0<^?1lfQ6;#-sfU6c0`qS6^IuM6g}t z`pT^{Xwo<|t7eg_{tJb_(k92?JQSY??so#ZN&k*+-0XGbOgZdaKKurRarHBXeH=&T z53&HH(P6Ixd|Cb^;WzgAHh@gyS989;F2_xu1GxzQG#Z1yYBZs7YoA^s&TTr#tQ8;5 zSONOwJHE*EG3dyb>3aJ%_5H>v$<1lp^x5xSeFxPewm29%W-k9LuZ1|g7G(X}sC|Ro z2PKWevl-MYg_ej9r_%X4Z6QsL8kj9-$fFM|11Za}@wxcjG}cpSrJ8HR|BNVMzyo@cBPOii4g#OLG8lH&igKrHUAWJVA?S=OCbF&n1(>LbUP00r^i#4$Oa98;-moh>P7D!CpsT$^rAq@hZMq&Sh$D znSgRkh8_@KDqzjOZ{NX?K7Hq<>@xf;frR5F{AN&vf{edAKY#XRfCl<~qb%cg+>?Lo zJ^&pG+=nkZ6gnQu@p3pe126yx${%#D!jc&PihVpA^9Nsvz;S;rLFNuFvq}6x2M@7( zF-tD2dq(?YLlQ@82oBshL8up33< zSVfK|!_5B%lovqn1Fr@6+23sk@UuC6|3h|taXrJqFvEWHoKJDw5U_Z_Fy1Y9?m52p z31En@e|Fm;e{KSv{273@F9Tij@xd-o@RChldYj`#EyD=VoJ;6jGH933%O8Q)fzvg> z-Un7b%S;x>#{C1oU+@t6I+h3B9}DFwIl!2xF6&*(AW_j(;!>>|4VfdN()V&Gzp^K5 zLlPd<-V%w_A&RO;KPMRk_6t~*!ruzBLfj9z?=B>y}MzoO?H+Ld1a-mRKhSsOIh07!ky zl~LZWQ*P1wh+uM_5UIjp3vDWhXm;T$fnNRNac*Qdcw zP}wPDuuY~A1uCL}ST${Sh!nv!&HkEW%s!gsz?)gGJ9y)1y#iQ|KHYO-n_KS3sL<7? zW#_=5A6Rp?^Z~~!hr@0-aA{jGdxsKDU2wNrK*jU zd#T>`{l&u#y3M2EFkI*`Syw|fsYf?{-bV~>W_`K3%8p;TBH zz8NL_q8GK9I(b(^06}|XO5+{&N65S2By<{ko2K5sKOP%%>E?M){+dzKi6m#2tSsW0jU%nFA$1#1_?5fJ+jS<%_p(2J1nxay$En2b6 z)gA+<8GTgx82rNk4O>oF`$>EYRUwr$R@kvRFCT&6ZOI-D4e)7}FaDTUnQk*DZOSu; z+<97*2_Zwud(5l45`$Hu2C#x2$F?b;)rN?=_-316)044N8N59&CQ_!d*rYgQbP2K$ z&j70kpjVby3*oHNK}`_WL%pT7M+)K7Ajn$+*4CWiohEwUGS*^&Bx)_E(ETaC0GwGS zNsC+~eWtj#YU5hUAd8CDLV|`7GJ|!DR((&yC%vmn{*GwC-I=Ip<54kJcUM1~=$^Jc zQ^!kJyxF(6%5)g>{KAi00Drql$=wI|;fP@+!TW6&su#ItAT49_3%HLwY+j)49*?os zFLJ#Gk{3T8jfUqe+kf4>f^`Gvibm*EH0(Zn7BH#>t&h9mID=$wPywn5g+ehv->V}S z@5tEIEIvjtNOZb>6x~6vZv6~fGpgq2*MT|GOhzks#9s2rl88rG`ybS{J$I#P8qmSS|ROo2BMW2QeY>_6yIU)LssXFuH&B`VEbhL0~t70j@<+ z^cT5~HPbjd6ud*YMXtA>3Dl9vt|!0<<*+|M7)WI_Tjx0+_7e^bKnmmN9|RNvi1MX- z0MZRHOQS&pkg7%!7P%xoa5sE5Az&FhLGLG_L(9h*!QQ6HJcDlhtFAft|M$8E3le~N z2jsj876WFnG{kuJHt15%EHKV;&(uY(DNQawlu0nu5pcNm1YMuA>=9(CF^V0M#L=5# z_3%Zmho4rx+4WCn`A>%OxBU4+Kws#0cK&Pra7IoC0Q)vmu&t@>4fy>H01OU8{iiv0 z%L__s?gOe%3iH?^pyf{d+Ki zt*<}pr$gc^zQ_goi(*_(2KZl~=!OYyyE{+E90aCaj`VZ=u!_+^vEve`q zeFG!<2eb8qCO>Gh3==> zS}tv{+f7``6M>9z4BW2bTq_y5$EXu~@X=7id_ua!v1?}hqmub_u?@SnCZGbG!HQR@ zU2B{9SU7s4@757Eq&=Q--G?S!?mVI;`wfYRdO^iPrsBX z=2)}ri0ik|DLx3zH<#Q7CnL+QJopRTa+_BpIo?IbUK?~2$ey?p#a z4|dO|df8XQ`W^G@f*7f0VA-89)+>_9NFY=6NIth%G7RXz9E+DMf4RMqAC^`=sQemn zSZUy5X3>g_*zQ!PgY>_kma1>?UtETtyE9)HdV`3g+5sGivns@s!&vl zr5vBSIk7Jn-zgnY8$z$%Tvzw@?HXEMz%jk&*CpCihoa%~Y;b%@J*&8Z-9%Vbba+6o z;b+Fcq2O}%_WTbqHO=Ls?=v;qBQ!E~o4Ck_;1WH{Kvj7ehrcz`48Ak;tm0Y`LfU~*h1CiOytTrZXKo$ z-6YI;XP-mQuyj;m9dYo2)?^>ix@(iW6Ar$BDfyW}1XT!h z<2_U>efLrc!8wF=_9~)M!3vK^!68B}{%w$*xwX1JF4^iYD}1%@%9xPwyiwMiD$8KK zp-P%$Z+1hou3;FCXg}!ZGbQ3+S*c^Y$W<+)_9!%a!%<9>D~=&4UQBj`1X*orDcNOD zp(YJ*V}@xBcXJ%!JnzHqTlT`|fTw#$QyS|h@oKCz= z{@i=u!-Q7tK<2>Rw#l+z2Pz=6LBS^=2TN|`qJu=6r~d}wNX_9E9nm{ph0JG!%$eG8#KG%~E=O^6BUqp#Kn zC)9zyO;OeJuHh*p;o|H_)qcgSfv7PfNX<;d_+zZCT3_*=w65I;9lOx+6B(7 z7=x?mxxdlS7|`%>>WLHeVWRd9UXp^tXlff6JNi=+N)ueLzu&OPb>9Fi43X3%cF=Eq zTsHXh*d+SjnegKkKi>S;u=qixA6WXY6~_;R{6NSLg#4XZ{UIGcq~nKl{E&`6JKR4s z!~ZzVU{=D-80p6adgX+Ri_rr7SciSKUUtVfE1N0|9e?bnV6ZhhfA{{;vKwmiyW(zq z+eY~D@Bck5GzituT=CmfuwZ;dZKD!TmPmATo6WLoqXyX9ygqIjseBqU8$gYm zhIZlUplU0Hk7>d>NDB+kOdPR-P#gS;U?hre*Ew{K;EbN#bANM}vmHbc5l{tQlP#L9Du;rGlW9YgB(l*d&vd&kPKYn0Gy7)(=|WWsRJaEojALY(a6 zW(PBWthl-Rgxv6JZ;+(t0>AUrXL42;F4mwpS46Rzu*#gJS3tcIv!D9RYEO2K>a3{1 zD1G3Jf5$Fsb>if-kY<9pr{!y942h4(LsG31kR^>bzmpax$*!NMbiiJ?aP}m<(cMwtQkswfuxPo4AR- z{zCrF>GUY#6OkRx6(!!6g~JtP`B_-yKClVAwM3QC*FRh(uV_W%zH^FZ+<9%V~l%Uu!b>wQ3=QaG>MXueM%#acIewOvZ4d30pC}Tz? zS#hOD@S(;lAiglFOf;bci_Cz3G7&Ctinx?Fo2TewzY3O=!!$59w;Z>&3~(rvzuLD3 z-5=g3RI<*lZ=LJiOALFmBEJVuMa5kdHPAq$!H+7giIi60PCYxY1j`S1mTt^+lzkdCyNqKT} zS4G3eZViPU;YjKCRV~sEyd~$wXFdxDu`CljR+UF|wdJRb%&R;~cr$C#-rg>QMA)q4 zZIBB+Xmr$Q@ag?EveR%l*fRc=<(9Q@kF|-4(W9aLkU7PWHw6uTGqRGj%ed#J8L{rk zo*zba#@)udLUpb*Rnqm+Gi8rg4|R8f-KVZTx>nRN(1{P~B<3WhD&`kjPjxvDmQUg7 z1@bm9lT(GS^_3B=2&KHI>9@0w7MiKMK71PNGmLnDc4XQc=XRjRt!17YT%F9BEk}yk zSxL2ghTV<%xlL(ubs(fd*w}0)y+V{fuJB-?%QgA3v}=2(Rr)2oL{n{;mMG~~En&FF zXgfKeoQV5r1g~e~N&Xq7Z7UVwc(CIq*tINAUFk{dxpUdfN;VaDCkM)qRITK@4_~c} z&@+EcwY}w9tV624qah#r$vCv9IJ((xb`yM6N<6WmjqP~smD11IbL-59BQCdnMsG!z zs-k>oPSD_(U9{B^x5ioLXtEV*TIsg&pR5#Hayn32T{d^Z+q(SnG6h3xB7+)!!FqSp z3dn7$cuT~`yNuv+6g=sgwP5q^)m8956J@v)x z(-BNFlq2?z8lewLoJBOs9&q@u@Dgm&VgsO=0fDSl2_DRI_{JfIUrI@ojYhlMtHYO4 z#MFB%a;BwfZRU)k-4XT%&eJC0tbGe1Yy}TY@FbQChUzPsP~d z`OKsES5{&~N&k*C0!Z)G=6HS9LJ%36L$HT+D4MofGjx5ZZBv#fm?X^o0owIW2C>Sl zc$P?J?rduS`>{NoWM*TSej=1mmMwH}s%iMdz)&>Cfw1sWOW59wo}XyJI!+bLizPj= zecgt*Oj{iXdr`?9F|1i8qIxuQE)!{6)u+5ar1s>ig)}XpQNp^(B2Pz}>>E|9)lI`f z?J+w7DpW8px=x(|H|X5cRBVujDv2P1a-fMh zYKgSTCq-XwCQbbkVn{X$sPl)1+L+w-)*hNX)+<|ABn#?9W-u~IsR(npIc~KA0a8g3 zBU?qp^)bp#+R`U~$;wi}*|?`#cI6Uvr*l&FA694!fhiq$b&)%}T0{pN6p_w+oiycOZMjr>NUBVGS&h)do#k@3!urGduO7QCBf) zU!Ky~okgz1M%6lZ4Q0SYB8|HWvxX&4bH$eDU(ryOF1y6=e#ug$!7F^Om$e&jtaP*S z*9G-DY`t@1WF+~C7Q{;YMyI1Tb`R)#vfTOX<UKyhB{ph5mJT)ndLSSS%s5&hH?wTh4>`H?tQj`CB@Z*Wi>!M<+&`D4IPqdG3^tEvkGw?l66}!yP*Dw? zluv9v8i0C{Nva)TYGYR8Os)A?Fkh7Iq@na>SQO^T2FFU&Hl{eEmgG)(I)E0mH}2)3 zN#FF{u0smXe@zpL^>j|R*6mSHZUy2~(%5%pd`%!{kYxPhPV@JEvTHKoGL=t+r`npPE7h*_}_O z`^|+_*UFMX6kQIsyckW+9lkNH;rV~sd+(^G_HAEWw_Dvx6A%y(P*hN9Tcs!^u~1|q zMx+S{Q4lbM5S11r5F1@UKtNzal-@$5C6qv<1f=&CN+1YGPbeXh5P!>a&i$Qz?!9Nc z^WGb8y!YQna5brM_2|}|)1IMGR z*#&hccVc-;ml%weWx-9m)(o6 zRu_fF56(i*-FuCIPF*^VxKoLB`Z~8$Tf29q2F$3c6$QpL5XMzk018BWAApnH^NAF( z0SBy|Q13bIGMQw~sjq?P52~PzGi_~Eq8kPa}Aru}%`-H-hktM#%MyUWkqOPEUVuko;k!|uBftel0bl?z90e1Ek> z5A~Bv_b+AnGUiyq42gO*$pz~tG!(LdrG4{*?-UMbE4$$nJFNJt{b+ejtHLdzx7jnT zCCkcX7CEM9{u7D=GT3E3&b6=P667bL!)QaMOi^CI2lma+G>0oWhOze7lPnwER>JLO zc?!04E*t>R_pk$ipyw@5lKFFTQ8Wu25{EV=4Y)p+YU(l$o;vnMvl(XlsQ1ip3}N!3 zr}WfLc`x*xeE8|vFst3My@iqG z)-#;e`FvCVrIT|QFV<=Z0CwM&6JRGc$qM#zjVH087(sKoX8hwqwk@YIfdF+Ga(prF zVK2Ir=qqv!JTls`RwSZGEv)v9EJsd~m)FQ;YW0K6ke9V0+&hD1{-4vUdyX1q+5yI3 zs;#uV?&X?rGq~fRy)#rlgYghmarOUt^De6uDwUAVsYPs9-bWYAZYf$u=xk z8oy7vQefi50&DB1QHPcWTPkPP;%9uu3T9Qu+kqLXP?jLTXE@CXtiBCQRQTrPdDw^OE25adyieMUSSoE+gu&)W67~GjK0P#TRm3Il%4ShQbq4fg2^SxmF&0fFf*B28;MnU?x&$F?m4zb zCi=KGmSs8@p-L{#kq}LVQ>4-=XNVn*P((#y3p8cLp#16MPlc{+?caP?ygv03G9AF6ptZ2Omt+-pt8N}DU49HW(m3!I8p z6L5j;7=}5J*x~`^RkF9aQAQlO-)K4#Tt5`3P{X)@YU*3IeHdmRqnh(ZaU>mW#EVhC z9$Hc$tCYI)8VL8RFrN~c5}~?I0#P;7c_cHsitFXdXuE#ZvT<3Nn^yN6%icwxJZ>00 zh^6e?sZR7iqw$3%1OV!9*at<&y!>??7Qx^(U!_I&Uxe3i3co04bN| z!r!eV4m*-xQi{&q>}k95m5gg&y~WY02bW`CXb6BmS=An6`o7TB0$MEO<~5VkQl{pB z`O%b)IqIQb?F@k;d6Q_LFE;mYmmpe)QhAggs*C*vAZp}u?N?bLsidRmV+(l2mnn^` zEveU!Z0t?kRb}p+$h_@$g;?fq-OlM4Bn{QcF(A-zD1WUgS7?ZP0r!Kq5OtxRx<450 znr{R5tuE(C^Z6KWZ1rUk{NY(@mG7(9Ra_#v&>73Nb3CAMx9%+3pMf`FD+vr1Ob(_@ zO?;THuDOp>^#J#Y-i`7q6BhNT9?_!Au8tDhzWGi){F3GByW?i9-j!Y}!=sUfJU|Cg zCKS0tBqzqu6d{iuprT>e=fU;Pp15-G!rOLhm^|gNER)y~J)_cWy9AQw{Xm#`LW=}# zWJI6>8pNp0DzM9%i7dj?bxb5z@A;gKZH)a~__aOjni{`l0ev+{j&U6uDl5Qx#6RX}i!uOo&Z{8B^;OS_@C392`B>^dZNUB)yBOd(gR!O7lqBy^?wJg(B=Z8>yU{j(UU+^8mt9GF4vw#G zMaJ-WplOWH3%_W8fXYm17N>`KfV2LjHKAONWnroqMTw6Re5=~6watfZ+BrT(r|PjP zGDKCe6i*M^8ans@uZ<_nn0Q&}Hb~yHk*Y{}r+sR9st>VT9$9xMAZa)#2limlGNx*U^N%$iFN~snyjeQIe^J$sQ5Df>>m(+d<0PBlp~mhb%0XG*`FMYWhC1JfgwLvYs#=+FmWHAu6I!Hr_Swww0j&~VzE9^xa3P= zF*1?`8bm}Ad%e0wv?fNqCiNhFl6P7q;yU>?C`A9>njqhI(sUX^(bHC%JG~K5U_ERD&sF zbLbUFVifiA&I^+i8C5u+I*AmnQVXZ>39RH*`ks$YR7&=Z#JH?J#|Y@2^Tn|v>d5?M zG7=EeE!*IX92+W?ntgR8*7{a{b*S70-}iT$OUxY9=#Y`sNv)UG#t5f+FrQaEbMMkq zk9QtR?(ca$Rc|jCAO&Y+-HURUaw}b^!}E4nMice`_-iss0$A_~Kr@!XUcg3C*)<$6 znx8Qg#sz24*n2(=QWL|AT*`Za)#_EC0>`5G@_Nmy3e=poiT4Zv1`ed@dneO z&QRkWPyv?o@Ld}nWhr}6vUmoK1@Ep^yu()D7_&8;rd5o8COqBSXp6Q@r5P0t z|0ufWaS-yiPl-H9*PEqGvDv&2T#asZEZ;(iLG3{K_&&W8CLBjnaScf#(adOXLq>!A z`MML|+*582X0?X_IyhhR;w`^*^gOLpu}%iwpt(Je_yQz7@sOC%=D(M#?VLjG@Mx)V zF}C!1Hv&Sm`owhjnI<-3hNm{{H8}vANRZCdoy`c#nvWqATW@lRDjspCB&*+QYn~s! zXBiQ9_HaNBT=Vqo zIg6YkZ#O}dC0dI#i=J9c9AZ0hw9wa>gz~AHJqB#8B2-92$&pQaHAn=cg48DobviI* z+9j=&2Te87y*(>;UT+~~);bC(ghR3=7<~;APlrND(u}q%JzngsaW|=`R986MEr~Db zl=s1cis$P9ADg$SG|Qp~BspKJSp$8p8OT4VDv%mnqg(ahsr|;MigN}}np^!Y@RO80 zc7TA%J9k#_0TC26YDoQ-*fb#%H7RVR)1~=y3&lNS+xem&H$@y%Dy|pCzoV#DTyjS|82Ek?@y@p@bruwyNZF zor>|`+%mQ2z_WzwUdUaP@(m6=>?UOxt;~QzM{R9PkPjHHUB=F4YG~yQ~2k;YPw&2I)ELN1&z@H2Fg3%aetI|J^{)*BfIyfn>qLbi)H4Bp%B>g5Mgq+LjGc{`ce2wr zdf%5Nr8^$U&_1T~L*k5!BwNI3s&8w?{&6G?>%8B=fp$Zq1lOY4v1^O4q*&Y#FMq%0Km8T1@ExYWPzkS z+cOt+;r2kf-J-EnyRDl@wZm@&A5VdnpKpnihQmk4MK`wN?&bb|>GeX7`53#j-r*us zi+em!o;NlCx^x$1WXcqH3*u+Gq1B1NrY+~U@fGunJ85rzC+>2$s@lo+MB!@!?M#}3E$Q}7 z?B)Ep#C5CVB8`E(x{bs4whvxHx3GjNnV97h*@S93{=hI>%aEPonLi9=yKJ{zu4Y)| zP0IlJxH7IzeohfKla}@;y!IfcneMh=b>IsEpIggB?@cv-RrVQT( zJ(*?o`C^R_RvIqva?4|H_@fl)j#NvdlCElDiNjd#*&b^$ztr7(k0EdH&P6%1M!}%{ z?CMEy1N8aRMg)`G5ciPAkHk#{NL)>%*hVE4wJIBzCQ#RUHw)9_<*C&oN2b>#wHga8 zc~NW%jB}N^l#%CVO(ndkBJqy)*_rj|UYPne4T!RNDaVSVvH<-pwpE_v`{tva(&|IP zh4U}I@3PpvXsGwpqA5NsO6KH1*E6&vfFD8+ePPGvpyV2O$NEWo=@3zv=Y%cStba2= zVX^V4zU^ZhoCtlTcVVM(C_Hr0TXy!D$)Uz4`VH+|r%bdPV{XZLQcnP_HjUp0AC#3D za_!4u)UyjLDw6>M8xxkvC0yCOyAvUPE71l&`0%izp};YGKQ4#*EIZl-GGOibMJ=>y zIVy+)LrV;1Gcd2AcBa}ZV9`ZwcM};M|jsZ6MN}R&>ptkl-yBN3M+)| z9}pl!3FRG!0jO8FP$<5fBV)B#pA6Tl%@I#gKBv>{((V51E6&ehl}D6UO0_ircA~wK z&`4WMaM`Gi9Zkdml?E1aBij1ZOsWZ?vQ$WaV<0E)L4F)v{KPmo-kLYY9|qG28>xxoRDV!NEjM3$&Ejg1q6%f z5goc?ZoYZh6ImJ35%E#*2LVHej5vK>r(#k%VG!D@Zo$*60ORedn$;Z-v?oIc7_S}& z=ZLDl^z(Fn&$hk=fWsk-{D;JDRIFHaMQvqSu+CRx-_lZ;M#;Ot&UQ^*yWl{(Sgy>V z!cI&eKUb`{mwR6(BvKi7j2W=ZO-zi;oPRW$)${?bJH)>%eU~tLGALyx%J1sg!i!M+ z>737zdg0~KuL4hU#hKE9eQ!|Kby~JTvmtrh+r3_K<`1rB$pLBD)a?7_t&4*KpsnIT>3F0baTv{=JdZ~h45sx#NiWI1* zJUmT`^lE~u%e-rgeW7}sYu(qRX1+6G0!(oWldxhy2%C+>Gj%(q_$codY()y z*-1NrJn^l7pJ=1pqv_X%-wUsbjy}aut`%h7V;XVQ?vNf;5m^HD^G3!|sFk2OR&36Q zNkAm1WkwRcLsRG|-?9RCo^Jj|fgX3D_=3S0=hcIYR9dsp?nMXnp1@xhk~edLbg%4h zbfVkqSX6Znna3{^DLIr!xczaeZO^6dsJ&q-o4gn`c)EWnk`Dd_2K|M121cEGrVB$( z`9mbf7B!#htv1NqcZ#K~IC4boY-*zBeRQu+$s3{w`<)G>3zm+NdV>Hbp8xj#y_{=_ zdF!iOQNacJ5KD;dltF`mPW5O2aQxE-gZ{#DoXEOy1+nS{^;EpR@41ZY;mxvc9+8C9 z!eNaK8THq~*Ss{$BI6@J$ll2W#$e^2{x5@~{3{4i{yOC3em?$Q|2*gd4D|P5@3;0Q zpCyiFe&2=FiS7Wi^Zys0TBrT{_+};W?+;_Wmo9{5B`{JOG+QzlgXL0Gr>#;Yd)Ub; zY-PFTuF-c|tL6`p?{fENnEek7tlvm42&jU5Td&{(Da-JTjHZ`(rFm)FCZrO{8!0Rt-dZ;YJzhiN_k`>!42Zm#1abiJ7`R#_C;J>6(aM(@yN z#BQ$9@mhxW%)s(nuv_?ql8@Iwx{VZcBViq#X}Pv*c(h{s^v*VYgZ9cQO^#hjM;@iN zc>Cc|5hlgG$x2CPi1)!AMPGtWoK5LgPxQQyKx;X2^j>@DTclGL&;^gg>>Fo0s@S;e z8WL!X$VJeZ8Y{wUP#i3)M$oaTo9?a|k_H!PfNe8>#5u6-~dPPmDur%F&J zc9$^lAxk8)>c(4kc7&`Phc;#L(#8|1T!P>IGhfEOozKul>USND$8$xiZ$m~fbgd9m z7FH-SP|XeUn0_E(d#X^q12k=!yb_?)*FKQYl+e;FRb161v?Rs!3=G_{ zY7T9pQSo&c)>)v=YuhG$aIOKf-%WNOqfk3AhmP~7Y{gu-;P#YcWoB=h@R?ub7%_xz z%WybE#@D-0O+*vpMh4LT;XFJ*2HYY=6XQ=_<`@u*SkIKq1kf684xr#+8*$?8;Ku=nAWN{BLJ zbs5TZ?3w}tSb9YA4EZ@`Y8P`QFN2~Mf^b*O7${Q`a9mJ=D+QC`3E{IA@D#&@Q)REw zYeASd7slC_IM=vl?6zs77|Oxae~R{;YY$_!ML-1>9Yp$5%zF{<`}Kv#mf>H`t;&*B zX!AZeezVpd{OXg|8l&gmcijUEvCnX|axnGxr^n4d@%Z|k`nh^je4_=BrBwNcscHR6 z&F+bDM(!P)+#*$HgArlsjqBF$84^oz@F}72Dolh1L>jf)r1eywd^tM^UNlB+6ATfU zZtPP=ijmAaeHx_pS0(sbLTf6MlHJ>1{gQ4S zv`SK(veV-ODp^CyQj}iOLx^Qqvqs0Y)~U?#$LM3@9xdyJ3wBS?acAyyW`46=3b31s zgc>okUn29rQZuy)iRd)vn(_E=X?#JvHSJ5cLGkJ8pPQM$qh0&Hi)qR5rO8$L;i z5gSm2f#*(ak&B&ejoZ9#Fr13s9apVK;1|43fZ!CDI$8_kZ7f@8I+w*i2Nno zuYKAsD>_SE&)kT4r3#^C@$we0t1`A}acO84TH1*XRHT02r5rJCH!If44x`FZ&FeMc zy!`0~+kVRD_7Aa(#=8y#Zs$#m#@oRU1-*2)ueAX{`3g2%=o#46E+PpLcnns1d{D!G z5$7>V@zo~989doC|4p~7U#PuW!2tHbzO-b;HKsx1X;*0HKQ1|zlJ<88fB!u_MF+d| z8AArxzMhLdAC|rIbW)vkTewDGVSNm<9g;yWmP$$Jb8R2!^TP<IIl69_7VcgH<_m>X(e%8Lac_dGV3#$cM63id+!t>oKp!a=d286{Q`4V+OAN|?UFZYIjHg%!W=5`*sL zx-$1i0u#PP>4MQt1zf9s-tn)#wMS%+0Kvv%?>o9mGHn#Mt>wr3xAiiA)qb%mo^b-7 z(A?q@pXD;vTcrC~vH9YuSY#wng?i{Xv-ABn_l3+&$N{yWe)|CIQcsoU+wZ%+lJ8SL zDnT_meP436(e&*mLNQCTG!G!Sf=pj|N#sG@qR@z~q;bnYN2T>awUA_DMD4-( zGjtWL>BLZFUB2lWc{-=@%@}*I%Yu1WK-ezjvsX$8#~c5)OMIq$-SM_P{lO01Xa!0j z*2_tvrYFV5l395Hbf_RKO@%Q*%$iRV>eaxhHHs$()Dq#Rnz1Lf*1G)FeH`H27=8Mk z1dA(Y4T?Rh1vN$iYPt*#=>PYZawEl}yprkfyMB`6!l%`w*g6#P2|4yMy+%{+wbamX z+>MV6t9Vc~UFTwN%SOPjCSD2M9byBGc}neT&uB2%v3Rlc_%AMW&|zYu5+ryq!QniK zP0K^;64_xGndOy~EH?J$kYaCV#NmY3F&dPn3Ic{I_wcgYjz#m++Rg3bv?rkq&@zT1_ z!`Dy3$M$)}3q+wMp-M;T{&VQo+o5J{a4_2Pecjif(FiH+8}Z;jzP1kDKn9Qn)hYJ z-L=0uy;L}>XsnRrI9ehp8Pk*K1u54o@*Q@d+DBJMB^}`@0r4N;3N#>A$;}PP&Xk?a zx#1=EDZe6B#j1yNVx-}$uL~kS|9xx+H0|jR_aKbgVzs>h-%%ZY`>AGvUHEvYW_HPJY8qP-auR8wBv&{QcIu=SB0I&w7bj>%VzgcXu_wM zhQ(7gK7GIz3gtwR3WyxwT=Ye)K){E}+>Wfi|6xnlt}&cWsZ_Tp6<|E6;6^seeKQw{5DfW_{8MwDk*TmC#TAV>h#o4-< z5+U)+uT39B1ZaGyK>3fggTy&&^QT2Y+=^O|??& z$u#APA&swGP#{RPOg&P#_E626A;aInPm*{;Y8<@Q^6}b!4f2Ga9VWsX%9Qwo1g4_U z9TyTEPOwK@s<4!l)U&hF0{*v4OG6rYzBuD2sp%7GE1begvcC3;>_~}}!%v?Jhs~98Ex>5(w8YJn6 zo(~2vx4Uo}{hVQ#XYvoZGgAxYqwekk$h~7q^ zG*e}~CVxKgn7>}f`TBxKLk~4Gi=y>NW}k~!4DYp&gUf+}=OUD+HG`|2mDm7{kVw#~ zm8oEQV9(pYiirsC+yzu-}v`5%DP zh$8pf7>4#^rLca^eE@uK2+DOzHtsP7IR!n6BJ>$|tB_1_ZRuBBiC0Uj##zX+fb7|$ zZK^Hj4ujmEDa=}086t$jzywt+Bcm}*moy-1QQ3{&k4U#2pJ!<+Vlk>8^6vUQK6xJ3 zsemZ4!^eIsPy$&Q`-XPU8Ten{(j)%;y*zR_F8zHM40&Me!crPo0B(lM2K%2cAB;80 z{;?I5QxHDHyX-@3bG^Ws}h5~!_@U4HwF#zDhUaGup_bC8NKwCH_E!Px9%3_rh5~zrFAEJw~Eb|zmq$TK_iF~WX7uT^AJZgw{&~y^A zn`_Dt3Rzh$7mudjh9N&dv$HbQsEKCrj)cb#wjy#%{G!BCRU{>pO%T@3mwK>-5YMk_ z|NM!PH?gBW>i})HY^~JSKrvwB7=h!SD_~Dsb*p)Q!zo9_(}nM6!UgootG{(VThf*18@amY8;iIG}+5f5I?AaAnCs01u6xAY7fJU(y)CDv(}$ zCt}K|dY2V*YUXCU=EJ!w%OA$J)&5{3a_)aI;?+#RiVNy>fdt#$0}Mb;#(CEe@7bje zjFk|Dq#YbR@~n`R6Z;6L%^%4xs(TQvf1n za%6Mxs>V02iZi{jB-mb-WB%;7Q^ZISAJR8xVw#W!E+TV?Uk z^Ov0lG*1S_-LpxukvXcZs+6&l4n{_*eM%F6fn;0Kx%y0pM0$r%19dfIBh|^YsYQ;XdK*t{HEJaA=t#3Kov$UQXKBf6%m0WP_vPcqn4`{vl1*CzGsnXsuIHO! zMW?#Bhw=5`BY|=w3joQ)Y8c71z|G-!1!JHnDBB)p?Q1Qe$x2^yF?m~~?H8ufN={zW|1068%?)LQ~{!-~F3I=}gzP29duIz! zRT@pHQw1pZOcGbHkR`S=(R1qfx=p;P36gz!ASz@M0a}=@4^(HS zeNYTp)iuYcKF_4uG`Qy2j+^{ks(lwqkUXfi0>r^_K3@zQ3SG68Mn7%a{WI;ULt6u{ zYj3xgS{Q+Mw3jP44HdnnT9Ew}Sup<+5>-FJ;*G1~==VK+`ImXo^1pQ)y^)W5y|UNn zKmhQ60Svj(Kx*XyJM$zolw;J|JKE)hK|K;sqr~WD;HV5h*Ed zaj7DUSG+;xoCnzTIUs!%@FVSE^he+OEu?DRmhiMRCUurn?zVfk{DoGo6r4^%Q5HwsxDV)Em-!(U*URu zTA(hb&ag~qB>ElLhCav&X*_askJlE=_R<_F%-1u!`1h=)>?E$V;D`J7A0X5;f+AAL9oQbl;7@}8&6w`uKYiczS{y7JC_TcCgA@;_ zSFEUdEaepU4~VSQFAOf&*`@eh)yZbh1zYIIB+g8Q7PZ`*vVcn}6ovkw%ERpM-(J{r zxs~?!$Rn5I^+PfKV!2ii-yi(*)SuG$w|Mp6>&Cp_2~B~*=`kRuNzebkDAwNx4f9fC z8|#7t?hR>)r*DrhQ~iA`lMhW6eHlBrA~}6*ebM0(;{r>#rmyh_VN|COz$@F#BWq4DbDBkQa6K)j)t z69PH{^C2kFS7qT=wt_D`r?7l=xntDBjQF?n#e;pV1k*J?xX1wy(iWdcBuzbK)0;eO zSFb(vs$AuOx18{ud1~Twl|b20M9!;#=o=v&UGY^4jU|QEGAU2u!}anrMFMJW8tg4L zl9wn69@O1W?^@bBMUF_*8Pte~K8&In^^uG<6G6ovV7^u#VbtG~y~0_uR|l6b+UMqe zjmk^S3m zkMf)xN-NAN%s#&yxmNrceU@#M%{^H)Ua}bazH6h@0DpDA##}9s>5nU9KzG7{;$&XJ!*YWqpQ_Gi zBwa;np?>9@9&SSosq1>t>v4GqJ)3kKd@mQ$&>`J$9(|LYx(ODEuf=^66}l+$NCP*~ul4Er{K58^h;iGyg%ytb@) zsg+1p8_$YNyS%J$5hCwFpEiRkuWvE^5jxA%1% z4LxCaVEn`^O+2vP6K%qtpWg9rlvN&DCdp0n0Z;%^aNhS&guSz}W5fZ!+0nA%Xie}p z?_{-e((YM_ZbdsGOIjK8JS|>#G=-;SFW6^a$pocNMT6QnioXpguG_4907k5Gt_8CE zvJbWCzELh&S*x|+Te*4qijlnHaMKpZw**-JP!IF67yFE-@iL}#@*&iVhQ>J52ghEO z&C^KbxCi{j*X|`C*N|4{M|HHx?agk8jnzo(&nkhJ&?<5D+rc;-5KPWnX)zWELI7ruP!YweIZG=e0CL=a>V&;kGk^+&ord%h%ItyPxib|q#u&WN59Ih zU?(HR6vLD4HOfz~%zli3B1H$K)q9ain#-o-s~(3v4nH{tyk1m%*OJlu zarD(v=G%!AOgOu@a~e{?8#h*wC#5U_NRVrS;sK9hKWiY|YHqxuOSl&mA!;CMi1K7f zGq53OJ@4$%1zCBxKbg;gZ9ui5tFi0~!dzpTSIC0}t#x)Q({f7Qcm&Whe)`Lmr4PgG zc+4bL?hy9`#|2>VRP&o0_F{X>Tv*yJUl@VpjlvRGRtdi1X%Io%1V_8QpJ>xLi*lUxvIWtCq($anpjA4 zZd>q^@lcS2$?O|1s1bp_wQ;XtezwGhR zmfADs9met=3oXhXuM0orb@=Y}oQPJ9vao;|$Z4a^0Y&m1Mmq^8R5F$57S!MmAJl?3 z3%=fr`#p~C%7j;W-%x(z=tdf0Q5{lUc)WSQB<4JP??@1!did8 zYqM`KK-jsQqfCf7Nr?XWg@^aj9Ydg!s-xde94r(2|bZF;youfJRm>?-k-Ri-yd2RQh zA@QN)&H`NZSXJ2zgwd@^a+2YIS+R5FqnDDuNGLZek2^+|g^y(At08^@vU`92{Xqu* dvD_v6^q%hAe^T17P{~y&W{Nn%s literal 0 HcmV?d00001 diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/incident.jpg b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/incident.jpg new file mode 100644 index 0000000000000000000000000000000000000000..1dca363414635c6cc8294aa34f50f1de827364a9 GIT binary patch literal 123035 zcmeFYcUV)w|1KD%2?$89RviV_b!k^k8}Y6Arz@0 zR4IXk8X$z_dw2KV=ed8~yU*_a^_!eI|K!X(^Uj%>PkG;S{r7qWaPNhtjwayNty_Ti zH$TAj0ze%=bo=&yuA4%9bCKL3At5Fvp&%n8y>pl1?p;a>N=hnfx_eaAwA7T8_n7X{ z(lanJGTx$(rX4FKFCxf$($2K;}OTeokD z5Yv*-@kpwX(i?mr2SMhF{voE1aByiJ66!O+ZlSf$&2aSvmQ~ zPZZRjYiMd|>%4gL_MMTjiK&^boxOvjle3GrkFTFUC?GK6OJr1ZOl(|Q`qzxitZ&&l z#U-U>(Wd-MV>sM6>`^ zz}1`bOiqOyVB;c#uguBolG~r?Jqg=oMpTp4J7#6jba%nFbem>kjd!ABgT>WJCIxCb zwv}o%X7TZk0{)DOUu#5&!fPv1)Htb(Me9c0$Q*&0bI>Z4@6+lZ2`%`C16P>FQ`uKV z;ry4+3zn})xSi53k%g82N~QF{I#&mO3{GQJJ1;1b;sEJry0D;QhLB?YgV6Aj;!pom zgFtOJX!!|!dicAE(tN{V^$F=@2#v?l zft4?|8D&+1HQzJy3i<3)iLNKo^%X5bwR*E8**$0Rifj7#`xbK1&RCO6X3OYd4LC4^ zUA}%WN+Pkt;8HXAc@$FXNYu5?`gcqXXQn{}0rG2Si#zrw2gSw0vk8PcBJHo9!0&7c zvA#hG(Jvd{PuEX5sKZ;Y0g-UZ zys>G6G+;Y-e57C1YoiKI_-M{_)u_{;-P5|GMTrWWLt%yKej2O&hX_G)hWSI*Gzt{q zku_*U2NSYfu`;qmF?`q~>|RgW{y}!pYaq4RRgD45X!GYfv`}?%2(>?IUmy{$yRK_FPd8s4||o zJ$&Gcez;%)P3~3Unlcr=pLT!W-PCI3q4)-uZGg)oZ!{8Da{38F7U5w7nZiGd=g;JO z;{b-{?>u(9BjA|5s%c{D%Gtp4`tM2(_R99uAD8Wm+3MxG3&WCr_W??fsG~09oghIA z#1XHxgPXm|ml*d;K0tz7*&YGL$oY*KSAXrRI)Z%B9JrdEhH6km_Y9lwSO(~frt+$K zegd8H_i0rwIK3k4+b~S1ig6+~?Nv!B)FZABMA;@FZM_wA_x3jY&;+yz8OTl-v zc!+(=E|s-JUruiRug_uy2OCB)Y;JtjuWqg34lcf*Z7jaQ!pT^n#6o$qCPYRd!JjEz zo#uj7jil>tOl=JHTl!7zwh-wR?p|*CV0kw$WwXuY!DlUp%(|G-%o^`%^X<=!5#Q>? z4fyYzzkJ4Q7o=hZ`RaGp9x8tg5D8d56E{;&k->CH4eIjAJkWqX9aCPxk>mKqPb^yBz0U)*2`iwYLaYRl{35}gWGriS=BQE zhxt70e36+i1G?TTlFHGW{2`2UNg=@c5sl6YW9el(1aeH-X}s)V^jERUAV(;dIH%$PEOBiFgB#nh<(J#u{1APDw~^<%uqPE>rmLN7hgJu;tVI362NUnp(1Aa5N2u5JuxNkJud;9(m!EcBuSp zU~^_uTDb2qEK@e4qqoOR9gg$1mKj1V8K1UeXXD~rE`*!(@0f4*nqt6b%nEk?Bb5Tf z&$B?W<<|g1%9x&Sy`R$-XT7fhciUGLnpF3wz}*6B%+3Xq6|QwN(D;mxoIiNOZqad1qU$+jP6Zd+T?WH{kd}bUt9$4|gVn5sWgX9>|xvN1m7C%Ko=s znm?isY$8Q|Pi{|g86A&>n8(*?D)VVWJK}~t1nR{P65FJS@2=R$D=`@$h@*yBSo^Yi z%ud>6bQr&1*h5Ri8*dLPh7_Bc`-I=FEqZ!nfxkQlP?hk<9&`xQcB8I@UN-A0KfAT5 zQ?20*I)wvM2@WItuU<$uH;a>k$oTFzG;du4sICEI7-s9;@nhJkY5HJR!CaeMBU4IZ z@eU=hO-KB6vE#FoosJfzIaQ4FBPJ#C5-CA&1T zH47*N6=G|VtFJm2D4r|BWi)CyzoYJLSM(XQdNsUnc+1LEjViqKE@z0@z}i3;Wh+dQ zQ)*{JC(?m<&pvoy><(F8we}z@-*VOb`1Dmb=QKXSO?@>uht1L)$ix&FTE{V=nF=jb z`8C2TEt;sP+0GE)Mf6qZA%LpI=n5WF(KTU{IV7`yHZn1?gTSWzpZywzfwCN4*b04o z_3X{NJ=XbZG3k#7#A#!?k4a~ zf&=a&2GU^ZHA>Aj9dsf(UXvpXUSDh)BfYBqwp8WF?02u6uPl^_UgN4S+!Cu=zzEj{ zD*})l4wkj%os>(|Wim~8{zK{3AyImgq@_fxlA3QJ$X6nBj6HWYZTXhRX?SBm+HmSM zp!V;pKh{s?(#T$ng^yeP!0h}rbzHkcmtV{Qby%NNv z)5X2r#TK^}HmA~;_{1+VnJhrqVN_n=f@H8OMzYYf!y^vs11CfFk*RO@yxq zJC(k!IWSw6zQR&QUeKh_mQ6vSQA4~`m*oj%LVnAZKY{*1?qEEsa%FjSsD7j6h?F+s z0WEq^h??c_5yi)&m6dI{=shkMG%JpK7|YWJHLr|&GzOG)mykiGmR!E%D;i@7OLR44 zB&#gE3rFu^px&9suD8xNb5bo`3`Hz%F+B9*wcZJuX~={xF@OOBuTy>yCA?GU6uN+3 zu$Ab14UZG~4R@xYaLRvx6Io-L@d;5i0#b2Z>`XM&8QOYCEp*NCEm9A1etRERpsuZz z|3Z0Ouejs(?4TG1G05g0-64iTOU?e|c2jW0I-4oU0ZFisfH}tgzs}qnMm%B^sN@5w z@-|ff{yEmDZdHOpz0MNnwK~{0uRPF9(v`(frCcmAH>_z{?)%*)nDyBJxxp9K)#BDJ z?pw(3n%kCM@dnqt zh#0o)vwt_HkZxLKIp?Q;U>J7kF}9g@#)v$rH6|?KxPcSalxCnHYb^S$fnBDT&z1WEi8@>k2 zo-CfSiFC_`u>vm!T34!RTf`urM@ihgSxdkyGuTZ`x9T-EdF=~;XF=l%4_69}bncb75U z4+<4Tu016=se`nAJZFSEd(f&;)vB`kD-0(x+V_DBxdg;K46GIA$bXrN@;jU}bZTK) zr}KKco#d0Vo+XiE9n|FDnI-cCpL>~c4S08!pQiyL`;5020bOe# znCGT(7we;kk9ZAJBEa|vKcbBpc}&u1h=~glv=chbzA4yrfuX#n?ugH z8Z?4O*7Vtc^JhPiw7q3Fb1aRzqS41Z_h-%tGW*4*4>tYv%p9F+v@8I4NY}K_lSSDq z)QGtT^wV(cE-Sag8Zq$fm0k9sKBL+z;OA{q8Pw%3@l@(A6dc6yM;|%p@-+RGA+?XW~_+|2n zqHXW5=AHDaWBs_%T2tJcp5fU**ZHl}Jubu}DDT!nAx?5Vn z1x8tG!-TCXbHgWDo$C!ai{oLD0k=?bP;~E^*;g)}F~4nyf@w+dT606uGtGb&0$|dgEHvL;aK;;?BF42MLUI^E=#__(9YX+pz8d z{a=s^b2$GGVIWn`bHW=XgKWE&eDw{wnlv4LXkff*EaAbQlR6uTdpr3YQ!-0}7dK~vgyX+{nu#&!l zvjj@EbILU;ox_mxd0mbLtGg0b@V5ulV=2Hw2MHb1!)*6v-&sxMZvdkVtY23(t^LpMDt58-+*bZyIkvK zFP!n`wiPc{Khm~oLPo?*KuNZ6C(to!+MOrIJhxABp>~7S?zZX!Mb6(1?IZ8s+IrG; zv<7b9%qTSyv;Yoh1LA;$Fz>zpAk_MD!p&f^!^Jy;n(AP6tJ{&Z0vcQK!6(YkW&S!i zxuHIsmf1ww9?1uMwgKSNm?eyl;as5dwSi_Flu}tjzj4YPtal6CzMiJLkZDJ+&mqc6 z>_7wgy`B-$!%F)1lu1B!ng8Zc5J%?ccNw|CeZlx^0Hx{>5)lOSD1OiYXvEHRRybYs zwQ;x4(h&*#mbk}l8`Du);H=YIn`EN-N%PJU&)>{8Ul?9>oq&cIbGOZh&3bh09vu3e z+rPY_YK3L0x81%~0 zi*UMqtV%m1nQPD%u-`TA$na^QDoHAl4&Mwl=Aatne0vSJ*AeDXqf=NL%GEj}G;50} zY%vd*T%KoY0#;F0eFcx-qx>ZqD}M_ry8p&p{36U+d>LM~Aqsjm( zFrOyPE$l~i(wj{Qc6D}5yZf~A>#RbuT_^Bg@>rMk+9SYl-iPAs_Yg~JN}e@9 zp5sW&e$A>W_*6@Wzb#+UT$&>(vD1i_BQu?|^o6{2f zEnk9T`-Bw$ zwy=IU+b)+NyeYiw$M&u8}IefAM4795H`2SaY6 zSV!FUna_v$d8CKD-SN3%{(?sE(W*WhUUy1K*tZ;M`LB(us>Yd#>urv2M(;@ZqUB=Q z50d_#eTOB!8e!`PMVl7x%J4)b<5e-~p9G;FtrG{lQ+3D9RPY!^v9-p|j#ML=dp+WI zdER^pqHzkeEf~GW?TQ}N=XEE9j?a&w5QJWc>+H(7esNdOEEq{1Oo>(brbJfg9Ozf& zSU!9KNy=fG6t4Swr!MDUgk^D-^$W+5jNj+0D?w>i2%N>iKsO-1Evz;|U(6OpARpbaLa-g3JMbvl^e$zMv2EON(1-2yU^QdS2Hk>*h?@tuUwBW)?@5 zHJn-F>w^**SLeg}8n|~1O_%4L+vJMutGcW8%eOz4rY??hkR;ZQD(Y@jrpP>aUAfVF zVDWACPbk|iET12fSVt(TG}|#wq|`Kn!CUSByZxN%H0;kb+y4m93cDJi)1vO82X3qF z%`J(=ImN8(aTTVgN>*akN%KPg?mz63OO|e#N!?gwb=Hws6IsVQ z%Q%6@zduO~%R3S!Wn@(2B{1%tg@2uL3ci5Fv@{UdQ)Pu+y(se_SE`bc#IM!wIX;px z9{I<1@w(iYvQR;M;H=DJ*NUm68WfOUPmL4RhaIG(qy4&0#_v5v-TCkej%LI%zr-q! zmRH=&Ojpr|3ef&|_nEaF!riSbU-8Q`p#;e9aJgqlpXj@a^-sQ)$+Ofg!B3GxqalQ{ zktKKPe}`vPW7s_R0BxZ7iQ*`b05|W=FxO zwQeUza^g5w2k|<_tah)N%z4Q?#@OrJmVIh}>$dDwCEl$9XZ&JTLaalvvLdE~uL_j= z3ibn*NBwPPB9=)pQ(8X1BCyE!9{y*7cVATnmoM}h5a@+B^uPorXCYtj!q!I4to3nZ zQ?Q(n`l9ua>Us78-go&D3XcdD5s!U;p`u>h*~%H5A#mZ$`{sep^Mg^~5MzB{dZ3#` zEpHCrNAGMusnm{rk6hOCWTn}06<%y~-<5hl5+E*!6;J=b94nNwvoo%T5I0e@LwH@~pT50Bq6@Z1Fk@541iBxrh*$<2Y83R5b~6E-uhHiu%e z#0V5K6BZTqYn`%{nHqna?Dukc>5K~Z4Gy-AdPp@0s67SAeS3&Lp&YqW))J}4|4@6_ zRMRx+)_w?Zqn(BkG_HX|uW=e3^yL#<`gVvF?ZLZrYGuGt=B?7~4gu_=Jb!tRQDWS~ zQW}99mrt^I8}KFj+P$8mwDs_;i+3y35OgF_zCdyKLYsm&(~gi;3{B z@0R9aId0}#SN?)@38iaIP5y^B=7nft1s8+@TGQ&U-U*g1>1}w`y*bVIBi6n2yO^ldvw!3^li2a-pXC0tM!@h4cZqm(}HyJdHM5X$ACjV0yyRCv-K=w4R1fPagdKxtrR zqCF}=4L!4&3h;zryC1dEA|bilbMg1tH=Jp^e11KDdTU70rG!yvI6pVIH3weN?tf?o zW!{;A!pDXdZtQW>c|O(y!-r$G1k3My571lm=U)DsB2J$P^2I^!wF>{u7~#Es!0B20Z8`cP=%RPh$GaeV3* z%9tu>=|<-h2DVa+d8T&+$fmn(7d$#ZWt}i-hJTLBTM3aKRG=D5MOFDw`5j%dTLlF$ zqdoawG{MqE8=19pwA5QNhLqTbMivc2-gs<`o^5kao~Cp>U46#17tpFUuQ2&Tn$_{|GKip-uv8==konY*0*wOO?Mo01%(QZ&K^ z{@HBz$m{HK+{Dv>htsFi1m>w>u@}qEs$CZW+vk5z|KU~3dQZb7^qQ0R&giVvp~PGk zhaN`)R*(IT_(!Pqzs;#iR&#M<$fA_^Dy@p z#j$bYKFTyugBDg)qh#5Uw?Nh}r+na?<~aYc$>W$pSkAJt-lRUyt4(b?fe}rU#NX#* zUdE0~H^J;@FM`GHl$W1=ZgZHw^fh3?y5vY@7K$NcIX=on>NSU3BZIL&rN zKVSwqV9T>!CW=S!x4rhvvV}xT_h(wzW1)>owySwIvukAW9hOzwW+)DyG z;`rY&nz<)X>}RJXUGFRH-mwHT-dYw>r&`?%lQSj?e*mj_eM=*>Eoa`jZZ*f;QA&+J zhPBwHOjlUd2kpSh`7P-L1&3IkBqyjkTmxbfOL5sSr&Aa$QZPQSV0SHHAM(B4^r>iB z35m{6stf^r9&Cy31mQkNtDA6ZGFa8IF8I~-F$@0q=w&j6C$Xhew^S0qG$ZE_28Ebtq*T>lX9GH=2kO;hAM~ zjm-UNfe&{J$!$nJD{=r>1La7)Ev9FCLWJD&%C=_|G!s#Z0VVA%6SXpZ(P-(ue;B%* z?sv4QCiOig)xq6rMp$I*GBW}%f{j4Aw~H54%#W(TNxtL@PcG`#?D%WWYbSONGwMOt zc@}$gwCBk(TSXWiQFyUpCo2lf^E78Oi}_atRItfId`AqZ9g z8SRtXKxG2WaE%-AwZ8a~Vbm~x zYpa!tDL-ZF;P7MqW3G(;;HS8vI*^uG7oyHptllos?VwOR`N*^~O+#GliRxqPH(YW{Y)GVW}c(lsOOdxG2PktPP-jb)Y`pHLED|OHC$wEqS*CPbu zs9oDqSOK0}D%WKW%uYc_+ z;s7CV@%@&y$93^kDu@>lbD)TcD|$NniyZdLQ`30KpDaT*Iw$-&C?&o%s?eiVrp97i zWS!3h)cLqhQfBUXy4m2v!WQOyZw+zv@_%1EhgdyRG-pEPEpfZ`xUfOvc30aOB{o&? z{cw<|5xL5=vj=}upTMR0kT4B#jHgTduU;rJ4_52}Asp;1x4Cn)&51)VuK_g|KxhTb z%4EUC2<_qT!8mnSP4eaEsT4IbvZOm?J0wQwy%*kt5ZAiZ57HK;u@s~_-|kIT4N|Mi zkIts=TG3X6diz5;v5>seib|a0n;CH>C5^9{_w=ahVDk;ND9vv&^^=+j3mrcv&Oe*D zB_vFlMJIPyt|Zff^5^&v!FsDBOIoicZF6;?CMZpyX@yac^Zp+ZH_I;5Hg=c@>G>C* z?;%sm`!{<*5YlxFFY~e$cbJ?DwWv0}EU4O}#5D9YJF9T~m;#HbT5@s6JwDz|G@BI3 zt{Z;%nO9n3c*`cunB()mhbIl6I;3q^;|u5(aQ-?lEaz~5_b#nTAIz&BFpnTv?xiRp zzKI2n8~CO=0NH!>>;&d93FU9j=uD?>L{gx2iXRI^q1x}ZXC*E~0)u2Qik|x76Rfj12E&U(koFOcG9|po|MunA_e-ym=T6EXwyuz0bDjhJQvz zA$vsZw0iI^_}hXL9ku_4_t(}BW6;@afX*iVT^Hd@V?YV95roDqVEmP(cGVCb<@vxw zg_%{;$;V}BCX6}H6SLQh_`MjjzY+au9>##T$DDNs1~Wqgt?GPzOPv!-yUY7tFLX=}x-}W)`{skLtEg=c$?K;9I3(vJO_5Zcwr>(kkCM9r;L1*H5SAeNS%~eb-o?;?sJS^^>7_ zeRgPkm@ui+VAU!H!2VbONCVhOJhPCsn+EQ41W%aI!z3B6!R2V znS7&T)Wa)2CJQ;K`YYKa>Z1xGPAZSrZxTJl*5$b(dNwdKA1O*x)`;dl)>i|fM073u z3A5R~SiXMfO!<}`6oXEVmhqWn0`dUmb7lO6X|g#q?B0ITQRBj`F!-AbmaT%N8^qE)Te& z4_+T+mx_p_(=#PJ&y`Lbg^8&@!!2N?-(ui+enXt$*zAjGc0D)2pl)JMiTQ^6(Zi16 zr>M=V#r4?WmXEfZ((NuS70S$Mm#0^{nQ6@g2oQ6nZ}lgX9>?9&G%6myf~5I(I5yGI z@S&{xR%&W*kxix4yHD@+pGiHb`+KY`$Bqc#DgbiM`K2t1KI9i4t{!b?9eVpz|6{cx z1vW&#kDxLIaTC&E+mCmwb`BM@lser(3hFRp|f=~J^J=3E!RCStON!yftm;dYgv$W?Hr{mw+y$f=SEZbE_vU2gCD?Qm3j*X~!P!CO7A; z4D*_7etk68%Egngo*C>317n#JI#`R4An~vmrh8?ZHJ-&iP(z*vvBVy{mLnXlg^Mar zggz2eQ*nyIYs5k~&I8CSZ=`U_aQf-;KRzQ-t!(FE-E^L}a$)Lbr{9^kJHaoz_$8H=h*>8*2X?e1RRO$n*Z0 zMf56qPZg6gJQK?F<5IT+DyP4(Xx*{~{FSQ4%Ul2E_oL!X<^C+k-fI9WWCO9cFH5tx z6e==3wc6A&>ADU!Ux*P$!9Lq+ z3#^B%po#i2VSe*n(d9ePS!WLad&~1$QZE}Dou+$lvxv|=RVL?udvOr$)4-;X~+b(BE$_@(UhiWE~CC!)FI|>s2i61=FI{q9d z-~D%C6dwdfo4I9tdA*?D`Ah{j{S3Ns>y_4hn~Fcd^e807yqVd*HtMXB`T2mTWp>KP zE870whZ+r@TK3&tYY4ny5$J<;XW>vK#d4R|e_bx}vsXpF5dI)0>SWIQ{D$a8c$7W{PJfP`?Sor)nzca|F1d@ z@LCzra2sQJ5EIJ$udd9ww`X-$eOeS;XZZn97Po8O)ne|KY5(EL;Rd+^-6Xl0k(SU1 zF|Lqe?t9e3$ z@7eP9)o##(%NY+nqbvFy!g|5xUWl*;2%5Eu_U@J1mQ(O)Qvkiun-;^1a23c%sTBGB zic5RhOwP!6h#9k$R54_B+il-yT`7pS;>XIRhg4~yW@mX3?(8pf5SsV2l-JkpimzU3 z{C3K$qu2b$n!WgHiyI^baK3q?f;BOt44qn=uf#0mBjQ{L3G~*guR-CMeDhDXS zV507Qfmz3t&p4IYf{T4<3EY~L-_i^R$YTle%yhZDtp7I?D_mw zlYtd&2v*|F4}@?0(gTo3PZDWSy-Q$yQN@sy4v=`%jp$pNNkY@FlqxA!z`M7v>ryoI zNpK^BY$2z)s7@hGXtD-o$Eeb=ne7TIe)z(&?{?!r6TOw}U4%wzLBM;L?gv%Qc zhfAty&J|nkD94~MOH~=fu}XMxSI87WFj%7nlQ8>+idi@JEv7FgDe_zjxvzG+_et9m)%$bKJ_mDGE$k}TpB4!w7ms)g#iF!%n%dGH58Y{$or3X< z6KxujlWndWhzy898a#9>a1DKY&N>>ZySgD~cnL`Ii{cKlp9JRVE;=VGwn=aS5lFR{ zAUY#-W52t8Wbf%Vo_U0(~2w>@#&Uf0;z}BoOH&WDQTX23`Yxx&=dneG^4mxfStVlv2krrX{!Ovdc>X)9018SH-hDG5so z8nWoXxGX@j8HK^NxY&9pdeC>AU(bm8R0+hAdiliGR4``~lt#Oy?k}H{YdM#_3bQ|d z)NtgcBj0e+XkD--wsRVq_0gsk z95<{OUZyftv5{s#&)N5+d%loSu}h)LBZkc(5!LC@1Dn^YuWL{TiY5JUb1)wPy{rF@ z4tIXr*MoGX0q6bY%QtL?<#lbjg>iRxM(71eOkUj3_6y!KH#|Awz%7_^4Q~(MHna6`(}G=} ze|zTz@UWiP=i1e7%-8+qVV6ei*9uJ-WGJmvoY0kgr~Fj(Bh8zcJlNrlY`NEgd13tG z%5TZH(JSsj70Z9|YX2|tYEL^c5>Y3@4IAy4(+poRe9EXl|BQj6#SpbpR!YYCyb@LE zdOfM6j?gE(G(X}6fpgNzv?2XX>ihujxZk(AkAogk^`sp5ULw*iJ*;sLr~2v^njD)n zsEYuLnB&}!$!)Qgd-ZKeiA{IbB^+wVMb~+*0hx^npYwX!^>k08u>FY@NxsC%H$LHq zNhOQ?dp~qsD~6Sl-K+e)CGtu8=sAk3_Z6So?Uyu&!NRVpt>bmE3vL4YOP%l)`E%r zrx?Vq2@@6JFyA8+m~OtE!qaKQ-!vL|wZi{BYRn6`KAvo)jLk|?>0Jpi+)_)G8IK86 zi4F0j&Jr=%iB}+BGZmX(!KbFi@`x`Gp0O#t9~3Whv|SUEMIW1UK6Wl(t}jmYfn?BtVU_FF6d znz)!zXH}YPA8Lu^)lGl*>UaJ3D3PrxB~lBJU<)yfM}NRT@j>|BKFFm4vM zx$*{mO~0}k5?mT%Z?W-S?h3#p-w>C^1EEw|{W_&M^Qn_D0JsG`}v;nq=sH`dY3;JL2l))x&f1uW#GhL(oEDyKfZB z$OM}78ZLdkov)nyPpwG^+|JNuvw0AGuN)LXOxH`D>>h*S{{3{Ao(zcZRc22ebpkb` z#=qc0PCalsc*zn_@?LvKGTKc=q(Q__-t~w9Jx1y|d%H^t7l6v+?kC9Mbjx<<^^#!a zx~ux^tfD9Eb}f;=a_@irsMZZgQZ#NO{61p_7UH!LVAie)RGmbhv7ZWyyyEhmRqa14 zB{p7v_?Ki*p8k{zzxyE#|IYdp{gMaygNP2#sib|%Z=xk#tHQ{0||jkVJ<_Z3y|6GrHtvL z!tEdL-<$jOvz}QOhpKUzg{Jmb%xiE}aF((K{^n4$-2bv%^P$xw?c=iqj&3;}qJ$9n zHTh)Ox;IAPiQ^hQ2g)U7h(5JdNVuYX{*t>*V!?<)1o)?x92UM;mH=Wwenptq1Y84h zFK4=dhJhi-r1<@Xp(U|xX}#5lJI6T1Wu4oG7YHC<3Mb`{zR9E zpZ76uxL%DL$zJ^Ck5>IGv=${h?2@9cCT^P$R`$ooFeGfG3e8p?TLFXuovTdDc9?4T zy+xT{*H&_}NIfUmB|IQz)BzSf#WMA zF=yCa{44C}SZm1*X@zN=@)6?|lR_9~r!9!4EvWIm5D5Ca{3uqKM+02++m4htFWh3Z zL4RQ9V4u$I!H^$(X&8NzKj&)a?hU)si_*e$gfdOoVtz+Ul!zDHX|`<-eW~cj{f%^c z%CXKgj2P#q$26!JLiW;)x4R@rPq}tY?i9`X+l?d0ugFlU^j6aJdZ1RElG^GxYp~>u ztnMiNrL<9NNBa*%ZDFQj&2uL2#HRLN&wmp=@ZyWNO>A*px5moHE4@Rh#^lR&u|cy` zqJd@GHnaL2;U;P1j`>bsn)J39-@VC9iTP}QN2*<__u$Hje7`*u+Pce@8Bq>omSbkV z@GU#(|AKUC&e%R_!KX~brn8E%h%DSeNWe`@{UI8 z&ymQxKX1R1@|9bdSvDr}!fsWuV#RPXfoZl9v4{ z`x23E`|Mu&2xQu^DRIBhI(I|o#lFFjJRrFv1lWJ03-AwCpOqDp*T*0ud8R$wT-^?2 z?LXglDtF9r%C>cGCK|-{=Sea8fzo8pBq8M02pnvySd-|CF;q1fbR_~Yb9+tg~;1b4}S0Z>F z#Rdc{TfWWfP=6imh+90i#;M_-T;a738o?XdUL8)+e$vwH^T#!ZiJE!!`|vVLL} zC4bCXJ5C$SgAt0a7u%Ob-lS&D@|PK*QI=Xd;eJU1V}GaG=osu!T12vI&B4#GVG$=` z3?`;(6`=V3wyc;Hgi(mp67j>4vcV@F&H4eigWq*b66Z!YkjdvV^g5I4SF8jw4j}(m{ED;ws9UBkB>JF@*ucL z+`R4V9lrv~VCD+kr(I~*y+3Y{o_y1(A_R|lTA7^N(X;)5@hsNu!51aPcp98Hs?%`c z&1CQ`REUHD)D2^0>NN9bl-`!r_$`UPvRduU2OKai{W;1i75p_u1+@z~R zryDZ!qlL@%)d-C0*PT`yb3R32I3_H%!?N(NMVP}9F68)zZD8CDd{>undN|}GZgzV3 zJp22L>UXA^|DF+T)TrjD{8Lnc&+goC-A$fe+hG&!SHI3;!MP$ee-8wkVVV1nt(L^O z1e}@VA6gR8rqmjcb5c)_tC_SF^s18WYUwE?N6P3Pl|OUa3!Sb|7n&Hf$|PT>5{MJYNdXqy5{iERgbX;&^c}?zSYWttu@4P@lPw!ta7Tpgfu0aMEX*) zN2Qu*Z7TnU`qA>x91e;6AGEz!SW{i}?u#Ib(xmqyy(7IBL7E6CNG}m-h7ck>bP)mR z0s;a8(xulBdJ9FQNedc!l}_lP#k0P>&;Nd(=Q;Z#$wh9Gtd%*(e8>C##sw^;^?u1Z z@eIWa4=eYoPEhlF@J^HVM17zVWCxkCb!pzyN&LplJS_kge!`|YaiqZ2j6_Uw#wbjv z=WF?x-U=tS37>g0_S7PT9w#}ALb7v2^(c~Ak$1h2P0MuTLaSG{Yd&EBqo`5brDImd z*&O`~j}TMVU1#Zb%!(CquP0_-CXD(vG(;*nrs?KzC`(WBZO%k<-G0jAx+gHju<8_>>GQ1Hb@9$RX)mKi4ka&0C3`Aakl873V~C(4V>?vRom= ziZxTLpvV%md8A#dn(O19Y+XlY|IF?Fr$>(@5{UiHQMoj(3*5MjRq07Irf0;*fp-}5 z!P!y_x)Kk)?c2?!PWXm@o;%qz3?vdsp`xhbdwOlemlmW{${W+SK@KfMTyY~gTJQ56 zBfSq~{bD+8LxDuU_={bPtu$xi@_9twp-2dq5&4^~6_V8l#TAWIq=-1NuJ^XB z@Aob|zBvD0R-1kc>Z0`UI7bgV+Z7n~wiySF z4Lt~IN1F{53$qHBfnEmhWF z2lHv^v+<%U)pEA*3qb@=vs0|7VE-|vc{~WG@vD7@|1UmNg$<7%Np)dxLZdG>J85UG z6?J}{chHUd2rGz+odlAW>xmk~cFUA0L)`;W8|DHqoZ9NWIOf!|BF6N1b=wfV(>v^nSF@1eQd#0?l#iOc;FVk&*#uLu( zzjpYsM7q#&dMy*0J7#SY`@Qf+jjdDI-)%SWEp{Wh@u*9>^&wdYD1+nAB;?{1$&tk9 zukyraWZo4gIKO4x)2tiYAgO|?%J0Ms={xoha@GXRUhri3sosCc#80gAty**jF99!E z9u8>1MV#1%81PvOx>Eo|o7yx%G)VTgo*0K)O$GSvkrebukC%p}yb9gsQ;l;$DbBT^ z!#y@Ez$S|w$k(r!19cy?bTemQmcP7hjZ>E})}D*Vx7+rz>clbBx+;G6`!9^_RTK_% z!7G70+Q)}jbRtE&(%r0=2|c_mN$)VEPZ>NoJ(2@nDu$vc?}8a-W*Swgf9+O_7hA`+ z#swb&lNsBJi1Gl9 zHC^Q-k;sSlmp&E!Ft*w)kYViP#aS)1galfC%9ZwCtlq(~r9- zvc;;nS{f2eGac_!>yVMSJpV|5$@e)2y_vrhZMIWOGn>(BY{ zm0V+w;eH~pVa1S>e+{ULEwTVXm_PfrK-<@ZNe3RpSeE$TW=I$0D&vB_-5mBKVkR%_ z4PN)TaZ4WyJkvM-RT|jRxsAb>&CgCYZ+hUw^xA?sJ|4I)WeT$>h>C-1vDUp}!>?&PYWyQ^@c>4JL4Gz#Nbj}EN-hVypf8h1 z|2w!xMUu@pSi2u(kgC>@CfwinVW4AIMEj+-6E%Y=XR@L8H12ClV(-oYF_;E^XY|NO z^4PQmsPe1r6Np#^IJHwNC-!A8s!UULm8;;w+FRD6i-Daxe;0npx{H@wfG_=3(_Oyr za8O(et`JY9zr^;(mx>jSt6wuM0$9N#*|upn?fNj^eMI~sq*)m7r*-; z55dV=QDYXek|O$)nQIc-cZaxLSACpwqc7(NB2N-&;3q{FB}dMM1VkCh>%RSDDBqdat1N(51cgvYGwhMC*y`yUW>>b{#X) z2NYYf%=0*|17k#Oj8azIC!-9m?=FJ`M@C$wzpsU{b{XHcnb~qbNV6C)JcpiVx-mQ6 zgL=*dO=vSfa_;i5zi&J5CtsbtQo9G9Nx=m^pE?b8U)T_ULQ9bEdlz2meYnI#g8Vk~Uav&&*^5H=PXi*J7x#U?KI!K% zdl6UtjFqYf=hv$$iI{1FRO-XzV!ex|%#G@Podm-3n!<V0bpm%eU)l}j z0vTHItxE`u)9x&H`T(%E&KPBEC;z8K!1Kka2fu+m;RyoQUrv4N3*9L4|30?Nc0X9-YpSediX6SkX^w%)KPp;;kfa=e*Js&yJPcT*j+DEn-~)*6y| z_w@X0am9jb;4sk(Kzq~ihify>wFtb?c!x@l$g%)Nt1 z@4$AChq61RWA-$26N0%F$xgX+=sIymR2eX1njf8c?km@}o13muF6yK;W5T~-R>Ar4155VXBFc^8?Dsgjdh0G} zlB{S=THE`aAha_&HQEb}vOgF6Tjn0xT=YUEy{~Yqel}*>iP*&+JC2sNmWgZe{4Jzh zO6Bx0Iv_|w`B>1|lC|vpD5(UQKXGDdRYHt4^d{7dDam8$=Fa~1#C9-^Vdlo@`hjS1 z@`Nm$-##jpF|PcRp#|_C6sN;6phA=zB4>I#*eBYwAfy+yn&p;S-bo!2&1PDhtkjY! z5YHHq%2&q43SlBG6i!uPtJ1oM41mpZ^8^;l04mIR8EjD2QS;wD=COF z=+s#2i5Aqu>8A;$Nl0{KR*7k)>;uRLh%%@1v-=z!APeL`*EXi2%I&n0)Br6imcbqv zcqRWg!OW=1(&j;5pi7Bsg3&FUvv#8kc0YN~HF@9`gfTjr=habJP^Wzts}f2b&mI?}-ukMpz7l z5-dVe$qgX*nj69BwD0*b`5OPd0X*&u;ww8MzfW)d@4(ZuLOSBp_{LHP50^j~-F$X0 zlooyb4Zg0;=;WmQ;6J%<#K_L+N*8YO`%|inzk$W`6X4Cj?2F#D=gyCZI*Te)~ zU4+dXQJr_9J_OnNttc(xbm;LG>+vQi#k*(E+?~AroxU;^fs6QLZVfULlW`IvlMDf;TD!u?xf|+$?4%77aBfFnGw`*Iv zA4ejye!0|0n+YpjkikKj6kdyN11%Dri z#D_9Aw}HQ3iA~(_S0!w@^%rkqpI=?ewxaA0?oaKR6+HEyqVQJzl6U;>@5zW`SO(~2 za}=hi)hKVGbPqk@8r{5gxdKNjEk*Og9dMQh&pczwoAz#{wCHE>PFHsy6`eQp&Q|p& zpZjcf4t93)1tI|Df&|=RkdO{uHlUt)R?}*Ir7!QjY0MIs%2P4^&4%Y)N)!Qmz;r6m zcbeF=0erbd%?tx3G^7IIv30HF{l0%kgpUrcey_?`=O7L+QUg|EO$)RGk&ftZhpCB? zJTvU0-nGd}<<4IuyU*Sa39*$u|JhxqU_0l6+6cI|8tb z9%WdYtmCxT%{QPrp}%Mwey_Qao!fTN6`G~?=x(LA)qhGWx#J8Vv>scGBF!qj2!B8~ zo@)%UKgM)X6OmD+*xg-9j8&sk_Fst)eB9iK{rdsd03{r~+-DNynJT=p*?J_DNH)J&cwR)9 zni2>QePcDx3SvA=kGnRK9*6&2?RmRUmG0nssTwPi3#-j^bV+h|aCudJuJIrQS`jS# zckDwaiH|rF9A$IJmusK53C<7Fm_85-(j%+BsrJ90L09pVqMn`6VUL~ioelyHw= znouwO(|-h_T7i8A5Z~mB67k8y)?Zij928*L{@DB4&lx( zS6@8;b1wqFRD{}+6h*;3pz-lcF+~cbbCUvV+^jFJ{p@xz=%}q!pIjCY24cc7tfVyq zu$Dgus1UlTJ!vQm1vnGl`&aDRgxfX$QnqRb&P4JZ;9w0Zig4v zp(H%_T@|ba3cl`O2))i4y6(sYRwx|};0c1KTHLi&!&Chu;NI>0qvn*jn`0=keqk|- z8i00wJ(t>R)%NGsu8`d8t9VeC`PD$pkn?4r*>JEAC@kxFQ#KaNPG86TW zz$H+Pcn9MfwIWKfv;0+Yy^zDD87V}q`}&CAyJ`4coz1&AQA`yZUzMY9&}Q&wL!sa4rT?u3Q5A0^y0%-x#O~JI2zspsgAS1Y@vJW8!lr* z#Qeqa{|MH~Kq;ypraG8#Y8LoWhX35Kky+gO4rhQHR`uuZ?4SIf*&k}ip04s|`kbRe z@4067XO%C&L0YZT-o3iJu#!mt+emj$pjOx1lbGidZJbLCRtW@ru*|5BK?;HQuyb}S zXk`zz51n;u4PUn(4bUiNJnLEFJ96NMrAAP+A%IdI!Ekx-0d%Iem3w*n^g&xQ^Ob>k z2j*ttS&7pa$9ili??}laeJ9Q2$s$k_jr+7#x)@gJP8VV;w4@fc?;M)xBnYNGv3Og-t?@d=t8~e`)b6s=XwY`x*npv0 zrKPhEI2xIDZU!?ghu+;(C7CqLU7n{g_$9)uDTtWZ<8J)eOhEtp9oeV5^1Fg=${gRe ztRnhO)1pf(7i|n@Ol)Q`+R1uSV(6qVWa&Z#BL3Vl7vjs5{lfnUD1k4M`(a66g=@g% zFr>PC(KVo#TC(ktwN?GBHL=e~|2^MP4X(cs7rN0PyPIz^Ky)RSw1XGtWfF-#(9Z3_ zLRz$|@1$KqY}H|DqImsz8@aTlJH~jECDvjRnHPpO)fdU30qvc4-LG2+V>Z^e0z+gw zSE@08|0p5>WgGY2K+(XYCzHMK5+e0SW+9ubcse6o;$z+azH@kptj&Qoa4B*x&G$Ue zbUX-`imht3AxnrW4Bw^@Uhd?8Pf(J<>ufz|P+a~ep)r!mX&Ci1{cNpC9cSY3R`S0O zL)6O%M(5UYPCLP{XiS?b^MtZg0WP#RL|`iDk@5@S-~F-9n@6;|G-DkRpZQ4q!#;)o zBM^yr0+kP5jCmA{uhyl zHNdj*Nv0z$?d**2cx)O_afZC(_baDOxuS;2j>XBR6MjvtI!||2hK?Pw2CroTFpK?b z4u^@(WpkVqo~k(r$la49MBIc)n58_$k3{WOnX~A{x=(0N53s%pFdb664fisfbeyb| zCKsDAO8#Y`QYibP(7;V@g)r=`1G{4`pTseeHS?&G{Mzo&3_%$#W1!6{ z_1KXrWbk)av{WZ%^^^R|duQLCe~&#+sc#Zlx^R%MJovcq@Q}R~d(ho75Lvy9onI&^ z1sm%k(RDUZy`sePXVh;JB)cB*ljWroDKP(3y(;M_QwyrZH5_bJYZ6N@mHC?g$I#+0 zfm~+C|Lr-r1H@D|Rcv{K7}6^<15oP9!$9P?=T3SMM=Qu}y0T|Pz#hrB>H z%)dTBVNB80#Z^Nr7Zv&bdoNwqV>DVndBTkqXFkJWy&VGBDulm+B9InrIW#?uODn%! zeEPd0fzQ%!_i;Png%%6<#<8R?dE$FDsy45~`$l`Beke@?EV|%z`lZiGWu4pHV+*8K z;M>V{YgPLMGB<^1jSNCCjFy3~!G#{M5$RkNeymFEr}F> z)uX?5b+s6*%5-J^;iUCT!_ZD;V_#C+hooZ3tm&jjyqfF5sj;^{{UdlZ>zOF>6=XC7 z!*QtglwP$1u{O(p1l<>YDg;2Yn+xZLgTsYU1?ph@ly~*+ch#TH{mNs)&hx)leWk1t zm#QiC&Y+hRUlyI~p^D^ak6fYYcjScEog$7x@59&SSv~CTRs_AkMO6fe$@wv0*wcMh zDDTWc&Lp=Q{ci0t(;<&(o12J-Dt`zK)emvs9qBhJ46;fwt;N9#S+XiscPtGYbSd9D z1X`PaUR0NJ6X)joi}RD%%Q;!6&othixb_bv?_46UGKYaspq=6Elh8;!HFmGgddrS} z+f?VnNKxW9xcs8Grv(WT$iAj5uPsYEEOS6nT*D1IDiMKJQ{?-ulg!vm4}=E8!XO_Q&05t!sKZbO0?7#3@z}d?kKdH=R4k@@ed;~e{VE@p|fT?d*mCv z@gja9`x=4#iw|@)Y4u$M0ZH1ljzC!6_H($}W5iSig2dZEQTR&03WMHO(nVWvIi$ri zl9i3qbi0#e8Hk?;|&)a`eyofATRmGEtMOo zJg#a?)*pH#4Lt3iQFihuxt2mJ>-iVjZOX}}F);8Ob;9l7KZWUTck_JIe?^5DTVSK4 z`>Sa5vCVSnMi#gvoD;cP*wg*QZ~A9VMQPiIYt}wZm>w;v&z8u8hsTJ>g=Jp9!Oe~v zHFAa#qKUDY%L{ybd!jk^0C37KUBO@d3Q{WE{G{P1p;Kbf=l&f8`|^@2&i!}BfNg;a zv1M#eiwOOM^+3UI9hk_AZXSKtFm~y|C)|uetqFG@rz9Yb0b5G7^0N;4L$P{DDO{D! z`i0ziDE5f!i<@>+Ar_{Pc(PI%Q-@4>2YV6eCWBG8sp zFI|6%TF;%g>1#$w&k|f8LeBDkQ_j-s`*m z-vtAxds6%Gm;MVTb+O+Bj%#S8AW^I}yaZ3}uuOg%moj`D+DMUccUCS8>6eWR@#y#Z zYEHCzz+!mL&Ng+>pmamAs?z{y>lo)E9&x@`Q9t4okZHOhSj_a)1}O zfEwNJc`WL18}q3qrUwXwU#WaP*74&R6hH9ts8iBd1;={$*d%ru3ZB^Irsev!GrVZe z9qF7g$}OMK7tYC*3%geET6uG=1IXIVL7J>~8m?nbOsy6_IKO?a!ZtZGjw+}k+{GyY zrj;OjmJ2h=%`M+Fj39w1uD9)NuF!Qs;%ARO|B(8XN-v$mdx*?Qb$}5{j>yRXS7zN4 z&A&33t80i2=SisL@jcXiO-;j1%#tFcLtb*NafpFrMpQ>}O)8tNuvr~#==sF5sY<*_ zLp!rPFNeq$(Lj&mE_||o2!#3ubtA+B=j}ox0i1JZLCC9<>5I^=Yt!}@2gW#}o?}Q7 z#260KO|giPUru}uVT|w5j$?YDhkR@LiiD|)lgh*bCx^OxJueE#oEXuWth0#s6Vf#P zl`Xb74%suF#*o9cjkblI6@~hxNZ&+l3$nXDg+>B!vQArD(VkChHeHq{|w?ZbkavR)BX z4m>;#Yg#P_d=#rAs`vvPc#w);g+aw1@EMfVWB^7zL~3KilDu97&(r9hc@-3wZ`?i= z*b2tnsEw5vXRdo9_3><>KhB;C_j@nW!xPTUY=!kf6aYNStfh^5$9T*5LK0=a)-4iG zILfXK{#qvZ#Z7a%G3XBlKzmyj<91$7^QLR!e@rQBvM0>ueV(%up?~*mobr(fp~A!F zAP)JO9~Zv+4#=ENQHG_3cEm2ZOt2E30jQGK0^8}9(4n;WhudcK$PaLc990BZVUEWriWD&nbV?-;jF&Sj#s5m1+hm=(j&xc!mj#JR-35L&8fj z(bdf0(5mP^LD@GlDvdE0f31M_F2{3h zta4)hX8n#G+m%yEl9O_Zg^eCSyQ{(nM1pVcy_5a&M=C>|tF;{{0JyN};XXUTnmQfL zZ4=U9-o)M)MQvv0=cJ6klb*O2HJOR1_r|_|c|8}GybN8 z)#9W@_%FwUHyw01qTuCdWsW>>S`OFbE?*N`v|%qT-ruotf~)<{;~$V(cX~a#k9-=P z1Gdi=soFg97C@T}!pk?Iy&A^`@6jux_bMuHHG!Gm@S3GLQ_?xUe4fL zd+lRC)=xX100cU_z?8TTi~=5}EV@G1l=v(%SZKx|V;OM;?bdk@W_M;#;9PU$)O8ft^3R{;E^dck0|qctBK@8@F=xa&q6TVV-?er=xRf zw^ACLTsd_(Te!hAJbR{HamWP~@Z=$H4%zeVB=xy5>g}M>A9=lx-Z7>bB0HP~*I5K- zK7l5Z_8vb20D0ugKWk88FW+lb&xh`u?(&x`!gfv$S|&}Z@?!+a1oC4D{^ubC0i8x| zJ)intOuR1{t}y~-Jpc2aTkiJkrfa-i%8hj}`HRAzkDr48%0!wRywM(>D{s4V(==c)->ZET)yEzJ)sWZtqk&9BvYj#Kr5hn3&zb3DGKQ< z&J7>0wu>sU+_ZAfEd_1Mwggu;=6$D?OMlx{DmvPS$#Dov$Fz~9gmslAE_G7sm29KM z^T6>Ag=ax)xQk{e61gLq=c~`ID(_dw3O^riu)?%7?%S{#@Qdr^@7MwGghOn#CA{}T)5ow%?XT3VJ;*=`pS&KL44MIX9UkniFT)r&@igNi zC+!?hu=`O}Iu%0&j|+RD;)Dg|PsYi=%fSX;vy^DsM*JV1*k?wqjP_&>#f`B>sK6g5 z?bHB}=x{9^^cp$2OPTJRwmc+E8oO!cl5$`D_%((I7<9l%#GlaV3S-5IKc3ikneYbk zqKXrvp>%Jke&6IPama3}GlE37^Dn+7Cl&gU6&d31Kn%@8U2b-Q_Aag0C=1&BV z0?yx5rG~zc3ATP#J3j6-B}O&rWy+LigP8Lqh(yDhs@ikk5WbH(dW@*mwavRPZ<@h%Pxas|52G{uvdf5!{`rjZ#S*i zj1gIYTR`nlr?(!g2#W|3E}GwA?oahwQBiS>zOVAGNy18d1u`2XB|xpmRli5k^zleb z#(DA>@R`QlwD&Q>#WgvYQ#n)!PLRU-Zj{l-S z3_Fc#R2^J)vo>%DY9_NJPTE3zuT3k!_sjaEz2q#W&BYC=u%cS_o3ABw)>=Ppb$K)@ zq$T^N!MB5RlCA=}aS!&^?uaTwohA3p-TT(=*1UT6O^-T#)DTVp!OZ#q*WoBAW~q-@ zoDaq803r2N035Pkxq{5<$z=Vd<#dz5Y7G8WS5*A?N}l*F*U#|!{WS{t(rSQA2zsu6 z(t=$`^3443X$W3#(Yvy~GVpoADa13&9IP-K7Wca232x1)>2R#?#@S$Om4kAdohi1b z&L`&&Z?eh|bnc#QF&V?b5rs#LGGSH7L%3A$+kF_js~VNhh?G^6O;)ssgI@Q0J3!%7 zdR-Rs@HwjJCsml@lu` zBJSz}=l@Xtn{+rfkVp--dNUoQ26HO4!iZo}*Yhn!GA4u06BfKYcy|dUgisHOxwD(^ z4y}^qH@vV81$<21M@OvLSt*N`01TsT#wXM;YiSI1l_e@R3L}EMTN{Wp*C2zr<_6wa zBAcV1zE(yK`vNVkU+54voOy4+X+m>3+(lnDLvfdV$Z??_}}F6Hh&mkjZXSxPI2uFj9an= z%o_>SzP|@5;L@RQ9^b}VR8R+(O)LPQ7yUD2vN8L;2P@MINm0;Fg^`9_XTTG#He=9( zX-I$B9$I-L^ZQgOF-n!T?UOQ|alANmk8;m;0(>ZOL8V9;YqP_@vDf6QM%1%H;10e++v`lj zR9cKde&2m5tzgOeStIy6*{Ru@xvIUNUF+{nE&Bye0aVi}4E1ZoDAPc+6#)6QonHqV zd4ULVU>Nal?Ad3rh`(nazglW_?pe$FUp4+6{`0?`0To#X;T)6*6;(|CF_6M(t!+%x zTWZYJMZ#B-HOLamOzsb>i|FtZ$#mti2WgSs9%QIaGGs}= z;W~1+t%M#ioSvxon+bMFRGrZK<@*?V33` z`*hF4*0)^MNFBQK#!d>*jz-pca$-uTr_rIYO2UqQUB`PyF(_wKBolX<{Cc$Ii}7%7 z0q*yOge05lT=g>5w{R}KnNW0YIowZgT12db!JHo1C}BW5NkEV^{y8$})-hEM@mp#j znyxH2UrA1+e!9r9m`#99Zc zyhbmg_Lj2^A=!%h3byM`Z|*Fu_&i@!+~bqQ+z!vauqhJO%=M{WYVH(PYb~oS)FLOMA*Ig~6EB#kR@2kj}H(I~r zOcO{}`tsi0{LSm;rk8hlpI(d_PQd3IASUOoCR_CQ(}IihYq7X3{4ubZ!J5mflYWKv zv}3EUdFpVnc&cm;JoUZCi%cYdJhtAOMN00?c_2K-Sagcyo&m8S6$aDxsgncJO*C`r zaRbskttCieM5%FaguCp0?}1ygp&y5dojql5BK@pYR<`Ucs!^47d{Wo4BBEl!ZG5g! z)zO14$@msyiqO*^ED;Z7_aWyYk~4_0`#T{In^oD`u)o?NEWs2|RlO4Jgo{^;%KgC~ zt}7NSBA!Y-x7bxGHcONa1Ofm0M{&*hMGK2FLzh!~BKQY58lzw0-bx@KSvdQo!zcN` zAWAPxw2DbrXhNF?@<6?tbCnR;0HWLqVV;~o=}x+xl+zN3B0k?E(|<>6|B^tSAef*U zumakzki+b-zO{jVdD(YhG`7}%z`o;8k+oTYfm2Ew;QK$DO78lQLLyY!M zSliJBH|~>wm*RTNv~nwv+TdN{dqLH>&ZExZlaD8ClC<&Mla*B5 zU+1|h?h_7sW!z;|}gJnnt&b8JgLYAZ~h6+-6{AM|@Z{r^I4 zqOYHv+_$;3T_9?S8}02}9aRco2d57L7u#Sg7ead!{J%rczDQ)@Z{&Y8RIeI*0)qE!gLkg0-=-G$iRb3~hI-ANF5lb z^b4bc3=YNZ@V~M98Ks)`<-j12k5x2Rnnv0UlYgmZdGtkM#)SKrZ9rNysbCU#3xO`k zrDNJ>j2!2T0iTp7GD1iZ{86aG$KbZF>p*ZsqbyNVm_2YJpvtAp_u}*>w9;)hXfPB& zHZjR{-uFgFp)R%4p+%c^R1^C%&!G%Plg1B4dp+;j3;pbNF#QC3#m)Oge7N9YD@(R2 z`Uqm_E}EBPZK=HD2bko^A}r)X^ zZ#30@^)$+kk)j|xb6u?C!R8QoWK!YQrE2)H{JMVZ2)Dt+1d$JqXS6-bc&gc>rFy;| zko?@OR}0{!*2M?c;^V-8sHlj(s;DwcuvH7HM4t|g41U|VC-Sq$YyBs+H*XyfRnN(efQ{^LIa=n+~2UEfe_5W%Az`Ka{{so;YDbNzY0 zgvM*D>7eZWjw_gb;2_8VxfQsx{s&K;h`0({~*Bx{+$xquE_g3CPa1=!dVdu@;XIa0mKHJzAkM{~u09!1Qd)(r3AsWydw zHiXjd;3=Y>O`PLUu7}`UdSUT%HiAf@v9=dSm7pYNle~xl53B!xP z6Z@D|@WnYCP#`E=BWM|TA5kKWnsB0T&+1&y83 zGmC3`avOjWVZC)!e?xHq?EgUYW?9MWPV{m-i}t%Y(t7&bl0L$VB`EbWE&2cQR`*3_ zgNtTwa(<#&+-pA01O|%BV-6t&($%p%h=!VuPWG18g zGZLtGW04q{gE3;!c9@7&J3-t(G)i9k<*`D#^r zD=o-R_RASW1ztIim!>#=2l(zSzCz5OB_j5Z%vF6QHctLCiCY~GC4Rh&NKGj4DyF1> z8v|g521L82S!a#^YgylVQusPN*&@@@@k!i)Btco3DlDz8gAF$}0QM<@hdvz_b(lB_ zt*4}Nm3#4IT&DNefS5ZE7!RDA{ z;<9fif5u; z!-dq8BR`7xR=!qN!`jshDsi;!8>#2OxfV7G%o5&n_BIFIzh($L<7j|uKF-~hleDw) zZ*e3)^Pfkx)vkx=INypTqgLnHKvZ1I6@vHN&@Hy9_16BycOvH>^ldb5`7Q;u&ZZ44 zD1V)a1{jc+$Q}byl$BY^66`K6v@f&waO<1_O`|f{{9f24S--qgtBvC5uFW1VlHm&F zVV_rY{qnGAO}5ABSAGJ@sACEduen?Q;Z0uKo4iLFPCqZkHKl?^yD2C~@1RSqm_b^X z!i)QM?IKS=GMPK)+q>1rA(;!8IVfO;ASR`C{|ew>^AFIwsDm*0*6t+eWn)Yn(9+m5^b@4>awR;#%e@od!{ zBjto?Uxz9?wJxi>&VX}NWXFSP=sxryNI2ildTtg4RyJq$7OO*14NE){j(nnAmP32e zC-njcS{ivh+7Dc^9!0vnqPQ^+FwCPE#p8RVebd1 zRGk&LgR_2Ot}_JQrwlBun=K&+`u7?%`d(~1?*l#T2!fy zYYSWZc7L6L%@n}5YvcFs8cPPykf{7b{{dBU1K2h<%{*+!?Tpu+g`&} zIlfo9VjY=yhTk04Co{*BGpD`_e=Uoyd9kWd!CryII4RU+@ZL~G%AD2KTP>c7I+3#B zpYLj^g_`&a1XQ#k{@yAwFjchl)eE1$EQ!kMt=E$rX^!)8`vQdSI}Hv+aNpcO$P$Rd zwSyf8b}8KQWzHU{N=vG6xDpyN29|&pCuDSrBnj6?I)-0usnioNK`_KNol%lTn>@1C(xe{>;!R$|XYcJ+3BLQk~v()J&LZGgW?Y$JE3Dn)ebcd#-_-yb!2>8yGA-(t zrYT*CBIPvJd8YnE(TrrT7^wA{&KLe{Lw*+HvR9Q1-fo&xy?MT)SpD0?Fg`D9XtFR{ ztkAm&CUwJE=$n9g73F2GYIDGZ&ZQGS@Ky>oHw)K1yfyg>?V~GW4V77ry`k!BFuJci z@fpmlNAUKq=be5z6Axbx$fdsNdGOi98TE7t;3mmk4Atoi4E37Z$Ne<-Fzyta zTV*xRbhT5(r55T`qr997RQghLvIA!56@z9-OL(duHB&NR=&FVxBthEawbb^eKW?>$ z>NEvba`pR**|#U_QeieQQmn?w-ww1y`d*$A)OM*DSwZd2w*Y+!qyi1r3U2#HuoT*L zY-NX`lQFuxskolqms12RF%d<*_aM>?W=TV=HF+XQbv2ydfbi8j1B+>Caw+TajR_ex zS)h&cG*gXFpXEEfE}L4*c#V(_(R+zLP=3))U?Maj@c-SARrrqe$CV`t-e8>e4-l5X zLFBonsyTS!W1h8e_m8bUgFH9~DuDiQt!Rth*R$aaeJ1;&n^jUW)kVwnmPO<% z-L**WcIdd#u$|WJU(!v>x+w+?7AYe_v4jzzM=5-F`;#t zUGdjC9U;u);+~|t@xw_q>P|JDKdXE02bNM8Z4zdx#wLe`^UH2#pynZOh5VU_iw~ZJXoda zZ2`vr8KCq(um1-yxVBZ#np3(b@8!AgqzDo}4t9W+0l1-s**-rP4;C$%woP`07m-Ys zMzzq#*L)_r~d!{&7zZS!D_#k{G}SuyU$wCqCWl&J9<74iv>pU9AfZt{9!w_ zhMZ929d&tmI!*io4ziFPyx<7`x%o)x06v^y(D%>$TU9$=1%=QyPyfno!BEh5*7b7~ zjAYx635i|*8_{50O=(>N_s%%kw40E<{mG20_0|x3c=KtQT<)FgTi=5d_w4Rq=f{3m zq9Xu z`!o4)0TIF1x59k0%W7e}ZF>A4q1P1jFdjjWK#>5`rKIf<*6qbVi@(M2p^u z9^I&;P2QD#_HV!E`+d*ZdtdLn&$;#=zdzRHaxt@>^{l7e_x&jnG6IXN@2X_jw1%tp zZeo2jhL7*joOe#B28i>&9l+1er~cM+@$I^Pu3g%>zV5e@#8%Xasog#}O; zQu%*W7>d+t`0U&Njctz=!h1=!*e}&Sk;+yD7>z)e7~2m@+-&T#Ky@RlXU4A@CVfL& zTgG(VFCN<0SnHox zHXC`G`?;b1uH9-)QPWkwEH2nz+rwtHFng011JN* zUaXzqh6lv+>Ldm%qP2w%2m90%;6KTTr?6oNasw<}IncNkc4!wp*^bf@9sX+je3#Rf zr{|Y4^8C@Y-VIhjH)rues#i^*mElej)Qc(Fu*Eu8{;qn=&AU8>`6P7Q!GwWT);S#L z*3z30tpED+kd|{2N#^f>o0?MY)0*MJIyX{sqv9KtkGp@ycqeY!v~2IZPW8NYU`peF0msaR7-Qz!Il9W6_UM_Xp$i=3!pAuwtkwOmu0A zz2-@YXvW8g21Npb$B%i`!^G5{z@V-YSRAV-g!OLM68rvmWa_=hCq#C=X5A@uJw6c8F?^03~eTG!^8s zD7UjU2ggxFFkaZ5>F^)3ZeyE=9McP~tBCHJk~n?3E$8HS(^Xq@d~vu-j<9Wk81m=M z$pf1cv$s2$XaVzkkQ>{zDw@yyOHY^CkMgS)fax)`C&Ji3cKesRn0M@1!pMy6kIqvy zwEu=47r)2ll>Ol#WWy$1Oi<(xRpegq67%a9Bh_3E?2)!vjesCUyfS9Bfq;;=mX0&} zU06s5%Z>es$opXe6o5Px249mv?~feC>Z`liZ<*BvHE*Bl98otY+&Glb^S#@@+})_) z;Rfer@Qa5j1-dPi(d&NKYv?w~5Q)K8Wc+xnj1y0`Z)0LlYZGp&10+9-w!<=EmU$k zZ141R{^vCtCN!U>Hhh7Y0Fb+kt%>Qil*PG+Z3bw3qfOnKCxFju%MTQ6F8f}){!?+1{-xHXIROOtdLFK5hS`%lp>7&^Ybe;#L<^n|{!|%!E%&9TTk! z1jd_`3$va|&r{EROv-v)_>+i19L+zPK~D_7oV;xyqoeD98*J3XqrkL}A#J1`oePpS z%R~n|bb!iu@*M(iqDqA)RABj$c-OD47n*|V6Fm2VJZ^tg6@I(CN6i6pyB9rN2?wUF zfp*f%#M3s2%u2oCj++@r$9whhSfLQx2OR!N{5NO}?<#svJX2t940b*>A(p1~V=goV zLd9B;er_#F-?f`go;OcO($Zho6Y786v?kshLy)jp4Afe51^kv z6g^V-T=KI)KlmCzZa@B^3Cej3fSy>>H^+taO>7d~c9O??tvQ-HvYi$8Z$wi*qT?dF zufa0*=Hl6ih#HL%%c*)*!!Sq4_JN+p^+qz5CuNb&nR3*{vq;KhY*&9pWm3tRzdBpjkiYw2%#%oQhuR=oSW-`qix&va? z*G9}#H8bb9Vxb4iE$5_jV>zSe4^u??Q+nqO)Ht&3_to3TxS!C2?QJ zFI&>mP+yrG&#-aY!#5$i6=54}zUI!wVNb=`ExgB9sq`T&Yc8j000cVU(^!Di$P=nm zx4-gCSB3?8D|P64az1(7SW$aF>|{`Vj4AcTeqV(B z;Nl#|^cY9v_3XKwa@%tZQppztc<^gvdJlf*9~F=0b!~}$deMFS>sB{C^^jI zvM|Ja;f}tno7`jL8*Vqk7IHG*1yN}}z4`B5|H5_WW=I`VUz%K|%YCSy8O9w-^yqfi z!;0PN>WHxRhQZT@R|H7vxAog+tFNLutL&?lcO!>I`Wm#QD=NqF?ms(y|3m zMW5+%Xn}7)cPJ2pFMi`S2eI0O5y=kGULI*&{LMBzRnu z#q>r*oNr>o&?>4(4UktH<&Vy$0TaVnW_Qh3i^@6kFmGk!Mz-`XwAP0k!}T%tsf0l3 z)Pw1+(ZKY#P$McD#>I#VC5_L%S-bq!QcVL+9*2sLl^p}6eG8Uj+z#jU#h;3^dwKk}peIiEy2 z5d^4``+;>DP{Uca>FjI+Y{4)pV9+kpoaV>nDKtwQ%@hI`2+dr~f+N zH#~+nmxdUPSZn)wSb1X_Bt$LpU`wOEB4CN0yyiI4P_p9FGkUWwW=|THEU?Mg4i0+$ z(z(BED1psk^W4CQAFu~TnH-H>C5G*5+{GStN(MsoIB;osb_|GcSXIGVH7enI9hm5s z>RI~xHu8?6@x%gX3vQFy2$@*QZ7N={OMC(L zw(o=y!PEz}sz*vPB8UVFZuFV0UuS*r;+~`UTBWdD*!;ucOR+^}L4$CgIj!G#ibk5H z3#yHcSM#Gf5ivB@w#1b6&vleo`5j5GbP*GSmubID4?jx!!Aj~O8yy^IW6v`lz#{kb zJ5NW#l17-cTke+bc%o%|SiOH_0z+JL5mT#mjCSlJR-Q7v_q&!dO1FZ_@)SJ5tyfUUkNf*w!Q19T$nCZLCFq35BXiC#D;3utbDU*cvhi#19h$T9 z*>51I8dU&rXB7E7WW&1c{A$}hT7M=~cEW+jOU`GMQKi~-SqLLh_v7z8?XGg+EW%@ezJ~kwGma+-$~D$Q&(0bz@llG4bqV1rR)RbUPjWimAg zw~Gn?F!yzgokXu>wv;E5P^y6hLF{<|)I|`t8f6o8){;@t8;5gAQsInAJr+7~KrnDu zx_YOnLTI{l^8k!i`cw9DLsO<$RauP1Rz``|+wRWziLC9`$iB^N^lKKebJ{=&spL)P zjNxL<^MC1{!54aD$=lcEM5l}ho-#cyL15Z`itZ#sa$9-qz{%P$edGq)`~!%09%UY;BSG@JD)k$$Dt zd0EVFyiopFjj>XgW#vfmi}>9LiZq*#w@D&aJH>pltWVY>Kkt1^<(^pF&kOT?vV=cU z;=l-s(n2+i+*OXXsf%C`16$o&4W?sJ^rUublMrXe@%W1(q#l0lc`X*itz)N7>g?iw zM-%KPkwX)IvQ__Qgs?81hKo#IN-YbJY?W^e)4S4)B6COHhp*p149(SxS0eiUO;NNA@6(jTQr;vePW2qoCeS~F zyVlVEsIVgEI{-%5+=1_xz)nW|$iSJ6u`jW8#dh@at?azqi>Urr#U&~oqm_qji!>*SbP{&G?@B0 zK^IL6-|D}kpF?J*RmFTpIRdRpsyKtz^b1XJmEOmgbdXVPh#5=9w=Sr_q*|A5tIlTU z8oakTt+>u~Q^s+UEq&U1yfbiFgWPjQdn|W^Z3HIFEV#G*TFEm;W^_fdWL32c0Je3? zTNCEUXK~!|k4LZKY^JQJ0EBz?S*d02iL?5Aa_PCvksVJvjupEM8LcWMvSDGa96s7u zAK@I$i`m!UeZ(+J*QzMpzZ%XIGvFx2a?{2C1~#d{)2EF=Jt(h*%A>L-2f^1iX=Kug z*A)Gn*L~T8*Z=I>jdFIPsYOfo1f?^R%d}%C24Vlhumq$Siv~3t@WC#(z?P>{e)knT zk4rnqXtySMY|V3R&tEJ*V<;ZlEPH7z@#13y%a8BwDUBA_uk{S7<}4yuJpj?Dh)D-n+TI{ za#dM7mehE5jfMqlH5gB(h*j8ytldT0(vB^+MXXi~g{UC!e#uYeyT!tEJkq zRR37AE0i|4rPGVPXW+35jv2eBKjw^fJkYi?8nzsa>v|M5QJM<-AisJ zlx+wBn>=V!{-ZT$*A;8fE!Mt1e`?HvCy5hgUkBE4)U! zc+IA65VV#Jk_O04$=DVP=Qx0e#Gj6NUMXYWj|wS_!y1ac@&DrSW$MlgW(fU^XNwYI7Y!i1Bmt1HkNvS4`U1o)(o zr=?MUd5_L$de*krFK^>KHEzj=SrS?#&OtG&^e7^B_0XBHPrhWi*74SskwynA<+FU> zCz#aFzwzv1U)K!n$_@#fSaviuJbw8kV$PjhH~U3sRXM;PX;-uo!ii5d&map zZ#?`DYfj;-rHoQ8wuP(1yC()lMv(KojV)Jj=mr4DleYFU&#+^)_|acdR5X~C?PCSj z)n|Y4Ii=mye)UOgB%Ss3=}X-S|E~PWL66L-trLcz{%Gy8`g&R(2E|QG3nlH1yLj#8 zH<%B@fDr@;OS37jeP%DUE|~zfCf4Wl&x*(-qr0~_M8_gZQR82I>hJ<@6o?Hr5 zW%EY&g}rvz7p0+J^>Aejkr;!A$qH3MZPJuS+(2`nr!eEz;cv<%6#@xgW-FP0h6;+l z_3VF>4Hy2evyfvjMENlhGh|OK@@Rk`p^{4?S zJU0Ad1mk;HWuvUa!5*f|TXI`wU-8z~YwWa&1&mAs6pAz*6}cJU#kXRUebBC@QYHBb z>=XgM7Z~6OO?7fi;E_=k$$}&nF{67&G}q(>LC&0-caN?v@T}5jpRc$wYeN z;PcGJQ`Hg3MzwocngRL;X`|hHJHfMw*G1*-0s8DWwcloOe~(C&fx;Je+ADs!bO;~z zax|@A=t|~Np>Ff49c(qAiXwsjctSRkHWEE%8R|9EL;}nYfh4|YudAFu9$}GMi|qsi zHdz)=tf6-~tY@E@It9MvPJ4f;R@8lRjvV;vq%TCW0>kwq;Dfzp8TnQRXBWq_i9UCCfZ|%w-Dt%DagW{AGw=E7y<9pKqqkK7I-JOX%Z&8Fmr)R_t2X5i9eHLo8eS zlg^wKKgmTMZHpLldm;=7guH!e21O!TO%~%SFAO~t48ZTjpWQ5U9W-pc^y8WOHu7=# z;j$kq=p12?Y9*Onkbi*goJ04WvfkPf!iKjo7#BIgnX^$f8%`@7_oH7uo+Vf+O1-sX zbSDYdgr37?)(M0Vffx6JpV7%p)d1YnmfMdX(XQBX6)esot$Iht_{cQ|Ko z)l_h1pqE@NQlX0@P(3Me81I~(-`rfgb)x3{eS}=2@4IM#(o?5*saTe{*@|F8mbhrI zbS0sLk6&iSZ0C^gmr{}p=#F)J)lua!PEeXDha4f59**RnG!iFxegrq|$?o*2lkA{= z-L%!S!RQ~zTH!ET3iB=BlhiWCYZk0VrZkK~PW4w{qR)ku@|G$N9}z;FuYMxZ7o@NJZAnt zd9}{A#45)2>#axiy3Q+)m`Ep?&J#CwOESu<6W5j$g6FAh*`o)jsYqfpOmDgvQ(;7v3KeZ@wRck(jcWm zs>;+D$V}wcpKqEp>>Ee;xfB~}SU1A}y1zhDztdWKMnEa)!A~jYTIn%Pto34na0>V( zOiWZVD?1_D>i~Bgt)so}u6SMGxuhR7KQpF4q!Jgu;N;vklo}J@b7TZZH1A&R4j^>* z@4PG3$nQtwarD){ckFQN+dJe{_~_YkrW*f--qCAI)4*5a2cKEhN64Vq6r2XfS=W?m zi@)d|!oRCuCf>sC0|qJZd+|{chGZ@X1)wt}0APAr@Ucxbe*H*z_(eN9C4NcU#W9T9 zLRa_ZEh5KvpeSOr59dKF!u&#{&kbp6ro?wM0%`(2VJr|$-vq}q)i)a;KnWlyN^ zhPrsc-vp4~CKC>4h>a1y8SJxMj#QOc89(R5W}`ubWtqtd4;tg^`Ch~QPd(01v+J&i zkb0Vse257I0y^o{%MO0D-jHZbd|&Hlf=dGjI5y@;nb-YD_1Qxs9jdGB`JM31QJOH~=3XDjZ#?(Z5Y7x>AasQ|#H@9xS$u^V zcR-*8xg8DE5AQJ#_8xq^Ge;n3*Jwg0%>lQBLGPr<)I%zT@5&=wn92$81dGG(xxM5% zyEfCMx^Wy~HTbOj!t!!n0sWOp>ZH#oj-S$ws7TfseGPFtvLT(^vKv`rFnI7{g^C>g?fxL02;yL8g0Or zs=K6pc>l&VcA~bv8&{3v{peuV852^@kfoZLY>v{&_=P_65ANGD4N}c}^aFldT44zi zD$b~kV#gyhe$N)p`R`Y9J$~KoBhs{4Hm4^ZHSYd8{i&(-hGc6E_BC3!qVPX?Y4)r~ zR;T3xeNq!$q*MU01yQ$aNtZuLR1BuI-}PML)udZFC?pdp%EiWzLi`*UZ8*JLlhP_w z-*X+ZADDl(mnx5_$UiF|@Nt2N#>#XQ3-;j0S15<|<9C2Mm3wr#Raaca*_~R1ud+{p z{WNys{FrmIO4zvHcBRU$_XxDQVy5pay^l+SW*N+E;0z_D4-6+uQ|=#F_+89!G~1s= zwOP0vA&FVZrfg2m-@B8avBDBTUn{m}auAKPu^)drik~34bBdv&{;VS_&FG}=>WFBF zTJa=r3+>z6t6#`EbG4i`z9zoTQctOS5LYu&fm+SWX!VuA3guwIN<%ZRtAe)-%Jt>^ znA=OQH^ld5+dmKHe#%QF)?}x$4{yCI4<$Q!&FenCV-wCiyU9TFrcTNUe#9QX zq{v0_BIxaO!P}?30OmJrs0k~-$fxwGzNv25cWQT6VXj+D$jhZ053f7vq?S>UDj+LW zLS%9XG^0H{2tP!x=Z_PTS|wAeEodV%S9Oi}m}wJ=B-Fr*)huL3OT#fLmwy?8ZRf~)bX%(tL zhP@d;#36BK1$lnP;o!Ne?KKA+1J?N*`qgrzQlw+kPC#(*fq1O~Q3VeHunrJVy@lpx zRyZ_*pteg$si&T6VhQ63V&(PkR^JCLDv`J($2xxb1~?yff`xNzP*(<*2|r;(uL2z? zRGPLMXD(;_k*Dk!!VuRzs*R;CZPbNMX%f@C@rgzXlO$6CVK5$!I?ZeUwCy}7zRuRk zY|UWHIkX!8Fq_5YZQ&hxOHYN1+6`?Hc<4C9ub$XQNNZd~qLj0|X4qa=pvq91_XPkC zzbm3}gJZ>wDgUCc(543yHZ3Lm(bK~aK_N0(@ke^L7iF;UxZUbv=P~NhDv#Wkhg|M) zB!*Nu3^AZN#CY1i+;zKGIbz3!D6!{i24ArE{6}And;Qqf9EZHQ`-zs< zTax-9_LAGnYs^kZ`Rj4x4NyR(NB9Jwfz?sxWR3Wp?)f3^rtG~v;(IRREfvoCM5IG| zlrZJqVQa|`aX8?8YN+E5Y|!YPj3WNj9}B)osf=IE^@&IxMNyh<4&Z;DbupwPu%J##G{Q*iga)0!&-33`7@PhF@C z|LBG#+X#T>%dGp#9-+4y>s@Q5sqoOk8B~-aMQ5WR{s{0u)@FZLr z|HI-*Jp0aoOi@{8T6MwY;GWQVDkIKM32I+6qM=4R+d${ue0#`#w|`XB$6Az4O<=9= zH=YvVeF?b9($=2#HjW+(*Qg&V;j3B;fU#VIT5ULSJtCL5wIDW7w@#Mo1t^vn4@0f5 zpg8!RRTP<`L5p8+4=#MyC^~Ry@PjRh(=bI)9IfH=u2k=T}Z87`^RuJI@?fuyS_#$}?$spECRqCgPG zi0cLGc1;+wbT`bHu^=-M=o#_5MIkM3Q~>{0KVbjg^FeR^##_UkXpA|Yte)7-*f*kk z{CX=Sx`3N(@Ew0()aZkBRJkYguJ>F_W5v=8uPP7NKT_r?)6Eqyrn>*=P&`rY7*;o1PCTVD zvty({#T^TIC}EbbGXF{=w|mV^Ah?-nENe__OZ||bz=?Tmh_btQxbu2e0SOT~mAQkY zZpvx!(GI9B<`?*t@VQ~lf`ump+^c|cAYONOT97zJNlXvpTpf} zE@t3ksL|C%vHi9-S;{8bME696rM&nATJYW39tIYoEY-eOEQ?Nw4oUl^t<$olEPxvT zFZhY_$n#uV209CPBc@%i^P{tu4q@WvufmgR#)eqINJ=uQECwePyDEt6x)dB(x=(5# zZrQqwu%nCdQNGxLPiHQbLbLr%=>cgBXK$W8T?;bPxM#nVmx28Oy7li3=}LHoCSiN2FsKhe7x8 zXuO!>&EFEJNMC!s#lV+}wmdPIoK{8^hnYubxw=W{g0<+C+4Ap=ZE~~ErmPk;-e+)H z4X8Mf*h<5*0Ym(%W2cqNX3pL*@O(A@6e96SIIJaEVl|Mm_Q2WB?C0F$U#H&YU2Kp! zwe{}1ilG&B)I>u&+<;F|=VNl+IjV4p(|wj$j?9^Ex7%@+lwG{_IV1gyJ3OC1_cV#K zlV@MQ-LE&&$eCvgb&kgf%8N9*H@~vyb-HIt;ncl43lKue*K_POl|FeT&jG>*4~9o) z+RroFsx`H@XhV956h$codPe9CouYq4gN4x~ZJBchNsrir2e?*A9gJps*&~ZBqo+dM z&ouaA4_TmZ!u(CmK|ik^!W`}P?D~D0EaaMFzYB8j=#v=K&=P-pQ%A?N&t2&&^Mkph zSFe&dJDNqb_H$-YnJqrFfnxU_Wf{K)hEgd!uF>JydQBNr)cSwk94w+p zAA=k2ssy-HC8LIfwW8`{j0FCKtQ(^od!iRJ`!F1QSJnk{8Zc0fVbdSpZRGR7FkDFs z4Nn;Q9t^LE?JLx;Ez7C?7wc|9!?J zmlFe53VOC)W&Q_?4^19$O>-U!_DN5PUR3Boy8QSyXP%>CIzRO|=Ho|x(94Y9)B)Aq zNavl;&C9Lw05qf$3PX;Rd%Uk#FV#2Jlvk7u@1~c> zgA4@txpp&xMcr#ut`lCWmC)IGJI3I{xXmp|OzeqF%vZA7)jc}Nz3h5A@Pj$fl}rmMMaXwi{fgDo=SPe&xaVu3T|V@_=Go z33~mERmSL221C8j#V61{K2MPV0uk2^3BcYAzd`xQZ3ju$aWIxLyxJ>Ew|viiT?}@! zo@RfbpwJV@mw0@8eyZJ6^RBAN24w9hExKSm!_MCGpgSAX)Y$6=TkL!~$uq^3^F7(i zZi5bR^O2tw|~~ih!6;Y3ty@KG@cQHqGBH4BSa-Yee%4e zC*f)Q&(>V~Vqm{SG~U+GOxGa2vawd09!k753x z6m*Cy!xoF0Fu--OB!cQ-t1^<0kB8c{~q zCx3eH+h6zDhl5)5RNF*j>-?Dd7+t!IIF$ZA*yhjGIO0#QQdBf&C#hS+F`mI&(QX+@ zY3)U2^}H4wdsW*X4(;moUKqFs`Cx5^&ZwZsg1dcbkWjvI`e!VRMj`!BH;z{*}% zUAJXGrPFgroM{w?mOB)e3r)Qb#{LbcPWvbMaL|0) zs&QV~5mF+pT1QF>_XwA^zg%$9-6L0xQ}d^toC9#yPyZnt`Ct8$d;VX`3xzsOVpl$h zhARcmvOo0$t7{5Wul`*49;};ye5mVhJnjx;QPlBWL_H$z%~(5dTq?xN4CDH5e-(Md z&rg2id7Ot8=pHQ`@8I^1sZzh$4k=K7`3K&eViu7fdo^-dL{n2DH>&b46$>yq5m#pZ zUk-(TKP3Kl`Tc+Yuo{UG4avm@c1@Eu7vxQE>Tczlbe9{oR-~KpeIdDVT_`}&uissy zf8jS?&mZs6ZOVMauPyG}YrpY`Mp{{qxPPT#`2jzs&@3Ev-g~)UIzw{%Mq~gD-QYAq zQ*XN8Man(^D6`m82Hjx)=|i+str3xWcc>Jf77Tf-QQ6_aH!CT!T@%0GEyf;e$o`NE zY{UEVW5ZL9vPZU82xE<1dSFNT_itoGrIn3gkFM`weEWUVnU3WdVQt>)vPk&f+M{&I zqj3xIqbL*cvz`_AuwIqx1|Y>4WV=XqPVK63Nh=TNB@X@lUL`SMcx%7$79pPUxF93S z-*`8HF2D#QTC4U$u88V6al}Blu>{1JZ>0|x_W(|tF_y3mOv}PBv|gL^vL;5wvMe-Z zvOT+;!&yaoWgJ*&{?dr3;IspEU!LE1rb!xCcjIV~7`ZlY*3k4H0s=W|s=A?M3D(k| zo)6bd#@mjOI98@oSXlBZ<1vM)PV+CWf&SjuzrO(xYda|o%=tn!4AisBYwpF*8KPe6 zqjy45!5B>+(nr50a{&ZMg`#MhMhUOX`AsL$V)M$criuMkQmf5iQ=)e^W|U?3Rw(G{ zNL+%%!Me4_P2uQ$r1bsYc+X1!u0_Bv1U6CbZ+#<@;)jWCO>~GbD^m0DcAaUtPy1>E z?3_~;QPb_9`oh1ryn=CXs;cNl1TtjPgr-q03me8vvn%7wQ&(bM8ELk-^9;$Nf9uxG z?zgSa2Im*v4Jfx1*3@kB#q}=yhxb-pUs?}_!T9+}J1#d!mnXR)8)7a!PJ-5+sE7xA zjzz(<7($)tDK7%oTl=Me!y-#^`wZMV?O8oM_5x0h@4_dzmV4;6KW z3fY20;fp9xUI^5Qv68#SDN^-ur%TsxAr{;*trRJ2IaVb#Ix4)LXhX9kVp@z*9a1KE z+I{DvptyK9JGl+n*72kN=tg7VrA#)W#@vem*HUGgfs!K9)bPc$4NF_Fh3Juhy}s?t_lzW}oskMHP0u+rmjIM%yAq6+(!= zy{*5GWLs3)-ODFt@N_k&;%Brcr*T(bDG3f8-UnS5?25Q>VfSLkYY5&3tLZ=;8bj4& zH2VR#=wGJ7|Jqws)2k89b+%bOvU7^N^U!>=$u3_fVJMqJCjrUOzPkFZP+<5day08d zo{YJi?WK2mmiDlU@h7hf_iRGW*%z#Bb)-Ar8`>Xy%nyY?l(J@aGi+uPFaH#n=ES@#>Hg+&+{ADLp9t0qPi{#e)g*G}ewYi{L5 zr}T*)CYvs9__*Ck0K_@|gYJh)X<++*?kL-pvXq#jMoeRNeTsVZcaZb9X6$3-c|R0L z+c^@q_hmUB9+GT(Ds`S~MDjUU4`&0Bh+;xdD)AQmcFBV`8Nt7-UqnCC#lKs750fZ1 z$r9NY`0qbv(vnFi3+sL)(mHoDAy(eQl{(>jWuncZu4CAt3WMOcpvWHwaazw>el7`N z%@2=>3n(~?puM~5;{eNkHNc`V=XT~Xj;N+Sc<;5Qxweo7cE_O}%e ztD8#x8!rP4Fuqz`!Ky$C!a8%ZPtlR&A-pt z|7Bs%&%TgR^*2C&4o;NRz(WUHJ6LcI(Z&lBr+=kL zc;hXPe;D`78Z6YN7|8xAxBlzd{|?)w4!Ei-V%~61zwRffmZUI?|zw~6>u+|Qc5}C+%wK)Ui zIw8h6ivrXndExA%_PfWR2*;NR@Z5f@LE%q~z;3%dw`yfW=Y`jcD^oe7AsC2S+5xxe zrm~I0_!{L)ZMN&eG%sYB~2m3Mp&Xc&HffDbN69Xf#p@ zIGs)$V_7JdK)pAy=69kqdzLi>FO8MUqKM`Y?ZaM1edR_)Kop)G^Id)CWL8vH;g#|c zrI|~K=b%y;t`h`^yQ$NrHOQ~{m6-0oWBS4>>{Q$q_=!`?DcT50ZHyj|$DtQ@t8q;_ zfW1-I@PfePrASn(JLKkg9&IE+BoaB(!xHOJFl)lmj>`XW7t>(KuE9kA^Fz2iI~UFR7AgIVKgBCoZyMyZ96qPss`yN#r&f=j-zeqNQ)p zGj+F|{uBOrO_=&F|06(x-#CT%W1R=C3bj0X=(#*D5`tCBH<_CCs}|G9kG&xf&9*Td zd`KXxky7(>Ip(HoO^xyWDCP0jkWtqiEfpG#3jURqb{We%q88jJVurEYbRVi!3h*6N(r?7g0~5rY^&M z(A*CSKX@2b70#Ox<*h-^AA|`Mo4^m@>f_C+DxA)^L4o5d*=A&sP}|PYR&Q@@BfV%s zF>&{$nn%%K0blX{3}13Zzhu49TU!5z%I<7uZ&!ARazgkPqsWXdrS|Qo4SvbqN2j&> zQ=vv+6zL6U*T&b*47XPRRJhg4*$e_*X>!>9JvbI|O~2q)jcq_omY zT7mwndGAyOjC_mi!*Rf$Elagw^v!71`0#soZ~tgpH(0(`chPAHTb-;8hrtR(i9DXO zP-@--)a4JDRs8^vweLX4JjZ;jp1*02IG? z_0pW0+HwV5`g*NN>>Fx&lrI-lu-VlrOE&};o{@^%?_Z4=HEdfcP2gW|cGJ7IaQA`e z579bAe8>mhOP?bBdF-c6$Y&Z!D2pVXAY=qX^-hadH?qzv1PBMjHK?@${-l`@AF{rJ+XsA2tIqFf2g%T?WL;Y?p z8X6t+!UW|bDq4fs0wF7`rTIGx@bU{kS*_)rp(lVPwUVnB@3a; zk`F@*qXL_WsuSC^X!o~tUu%%gvh8qXUP?(92HM>Bw_;n}RHB|;n4Cp-MBK%|R-wvA z2ES5&-aik`Wy~Lus5$QYyw-tgMk04bkN`S*0^D? z*!~DkWiSY_O=?^zR&62Tuq92l`$U=UXXM;e!uKx2B`ehlfm zJV`$NkN!zX=tk-VXZUZtUt&O7CJ~MUWo@Sl{KiY4|C3&@MW6B4GjOe$x-9(V+g<%) zJAUIGF#?$;H8G%N6Y>g7eRq8R_Q|LUPc$yjn-g~%z(}vu|FX&Y`feRCfkygj&0pUi zLX8W10>F5Ca~0RGMq|D?-+1|-ax#CTKcYsTXaKN+AMigBitxf^f*Kb38;^af6@5Yk zkdlUYjF@Tv>smDUw`Upp+s%zgsazgQ?EUpwWP6qXz7Q#pd3y*%%`saUnUPk6GJpG| z(%(AYRamp{+j{d~KlCh>*ozujy5XD9t9#`Zru>7SkSe_w-L_x>7Gp!HZu z)^RB#*1(1E-O`28+(4xd)URku(ziYsxkNlOR&8KV6m=ip zrF%2IgE;UWw{zH?r74yLL&9(zBPmp+a(^ww))uz7mGW}aJG;_Q*=lfFp*P#MDwtBj z&AvVee2?eGyO@JHfQt1lH@U`d4=Xp`iH~5Emgh)WOP?o-oB<8*AWPl!`Q40STS&@p zD~H{`eaI1UoByLZ^Yu!mcjnKqt8yQj*#Ms(tcg~FB5i`C*SPNRslCfn3$V4h9p8I{ zB?}T1$;{Vh&kkXuNs9#kgT40*i)zc(Mp0Bm1SEqbl^_|FBpF1qfS}}1N`|69a;6Xk zBnJfq1eBa}P9<4Da*|l&oC*XAD9XF&KD$p-yT85r_SwBpfA{)>r+ms%n>w!9`!Ov)C93E~z|R&%K(oD)oovDfCnTSYA*63kgRx%D?}3+!{E!$C(nzCXzz_@`Cm+bu=$M*Q7~)#z zx>)_PoH-6xO;*y|se~xeZC55^JE(CiJw5|)hYYI*)_IXiwfxn}DfSu7hWEePan`M7_s2Pe*I6#9aQ}fk90(Jz(~s-a!b_4MM;Q zQJlViUL2|706*LV5Ql9k;4sz-;25tD0LL*&-v;m}1>h*t>OeMES^Jn@eIJH#C6F)` z`nakSI0w4}E$_*%0Q^SkEi{iT>UOma>Szs$ya})n=J*CxWm)t9Bw$8#0J<~+fYS~5 z2SAm%6g0`C0NT?LhPnoaBH~tAQr>X^+<@)G71-`t9-v+9cMMbj0nlUIO~BIG|3)rA_G;0!rU_y~OW=Tx@nWeM zJ)_S=^XWhPJq4i{HvdPx#j=3+0e05rKy2x3p8%9+JKt{5S(A%n^a#L67ksb;oB_^S zoF1b~MpUJL+U@U0@=v?{9B=;@&C_2mgZ9wBcTZWlddc?KgDB7J}mvgEF<7 z)lDiZBAK|uKNg4cY;?Ikf|l6$eV@GjFzDenAly_doZV!`mw?Vnx9F1+@lh0fW=KV( zjds>(B1))QQ`njsD1+^Q(cTAPfRvIyiln|6nJ~Sf(56vWiZJzeG)skkk(s4cpa|`x z>iN)6L_aC+PD_|(riC)!*2tQjWB^LDG4^kj;p?<-t=D&YUI?gy6UDZY*f)IF=Ja7N||k`^X=WGdSDB zW|DA`11cl6?AdFYZeAsh1WB$&*~$k@jKT7}cFjhk)>(q8lpz6H=ZVkCNlwI(0Uj~4twp!pW%Lam>YidGH; zY};(@L+ka7{h*((XPk9dirV~ZRa20=I`soL`>ns{*|%F1SZ}5V?tE?|j3&O{%vI7B zQOhpkV!=2+Z)gL)`mG<$gp|@NtF0QSRZq4g-&f148yv0$*)4c^ucXTZyEyFo;`>!q#s~v0m4NudcGWu(iB#;!doi#Z@1telg zwtVgV=;0D@Om(upXxVaQ^y8A|EUXv0Rzx?XMYp~50ms6F6JhYlGdn-Z*78UuD_hak z)`+geIkgHOVnZxvRxWjut?$vJ8@_M9Ui?7TLSZSe2Jrmc%EmLf1AAr<0$ppdO!6EDkdENwNNsUS52B^nj`omjBiH+1b6MExFAEZcmiR>+D zVr^e7&Nx2vn6Dv0RSyF#t5#H`g5mockUgypF_ zx;&<^&2|wfJR5@Zu)dGC26}Zh+HE+D{4Lbk!=%FfMzXrtQ$-pdm#2?fZkh#IU!HPa zFk4TD0p4Dxy|sGUB#aI=?Eev&GJEjK<3{zoTUY>Z>L4$ezrJqZBI?#Ai;oX(zz3ol zyK^;IF$S(=8HAw@)M1yB$fR<#6=xR8!6lh(_SBLKEKKoV@k_8TkbJm$eVQ3*G^@?0 z0>}hU=&mHv3^}a5q4&yQnwy$vKmV|#mizokg13Q3R;+I16MJh~jri$U$IDh_qDC9! zbT<@9%$V|%@(q+SxH~$N7~ju^&y-Ys!XHR_cRj$~PJnhJBOkUc2C}_d!E3VwMa7^A z_cDQMObyd;5_28?9Pq3@>y4pVZHQ4c`r4+P;gfS;xN2yw;Wo(9H(E}HHUGfEu}q|{ zMc^j|ISALC??TliXy7YQl)bD6MJ?c$seG*^K}ii)CgGz55T;2f(maYOD`Jdg+aG&5 z3OG%`Ej|vM#a6YfQTGD^qgL|(`FH1s(QuCaxw>B3o#6|hak0Pi??QM>B;Jf|D=A$doP|{NN zI+^cK3yb#TCNm@8sJ6e{Rn|6U9DRRCcXOu?>#|X0CH9nSJtNXxW?&;@1SR#+e9QKB z4Bd%_IA^=_(<@sgwh(`Bv7JJy@whoYZa*~Zpx8}qmvwwbOQ(H}Lg;f9SB`S&h7XU{ zxFe~I)!)0?yBbe-_>#(LkwY(85BI1lmJM)mafygJr^qs#Z+SG(dGo@%FTws{PC`-3 zFW3d!Tf5k|kjx`f-w)#$AUC6*5&<|0p(#H6<(w+K)V zD%QB)L(+CS$bAbJER>j)Zy^-C-8L=%rX(i+<~ zMm-}ekX`Uul1D~+=;h(vuTO(6L6Uhsur_dyx#Y|Qca}WaULP>9EV7KS%mXTV8t%BW z`$^u|Y2AOPi)F%<&a!>|K3a|RTcW7-N^hET)h~d96#z21lqu>oZg)m zB@&3Js-htPchukT5JVg_;~Oa_POp@go0mUvB}X&V2eMPmR_-#Nr~LS^j)3@1o>=c| zmS$21QZ1rfc(?CAwCO320F=zEeZA2&D8xxKV>Kl>#SMVObzH>h2 zX%e(42`2pjfHf5&QS?8uA&<)J!&ul03!|VaR1o#r%%c6@a2Wn za!H!cJ!Nt;#$t2JNGawCf-nR8h}6fwRIK@(F+=?Sc~@i1>E})j@*D zUxIM|Iwv|F282~YfLPbJ+m8YGWLUlb6zI5x4+ek^3Sxbkpmb0re~jI@n8*0tPMHq5 zrF7eY-Y4$oM*H+&s2e&qs1pEq5IY4P2BD1?Pl1Uk0GN2SwuKgb@>Q5tn(P#?IQzXU z#&z}=Lz4qf0gLkhV6k-ySnL6S1zigI8m9o-YY&E^2SE|5fQ;4U}KMtx^pX-CJ@`cy6F{Z}gjVo`H<_`*+(p zEI`S6EGOW(n0H>p`_F#MLDk>wDcL((t1S7Tvj!K(?2q>xj-;9ZTyfUk^q3v;m0T#0 zJ?2;T4*O}hGvoB9-F}X@Gpo^m@;p6@Sg?s>%;jvAGXc1F12xzH;?DLOAc|o9PdFQx zY>c(^d^0s*zY6*U{l@;6?aD#%d5W7wXzr3HE?TC6tB?lxxFQAd(=>>wp;T^MKM$qZXauu=<`gm% zJSqMZAye@22bQsC42H2cb}xGuvSuVv35*Z{=fB|_V~eelxx|6;Ajr$gt)A4L~wfqEk6SAddPq%U$RE!hHUE!eG9mb z`zhjeA`QQn>VU_6pCOQ*OpyDRdMgNHrDvb-%kZo>o82?=r4`siECtcE)QGn&bj(7j zK%)DGBQ-dyG}fx%VoQ1oXQUqJa;nesi@8K?EFm!t(rL!G#h!oZhK1JO0;9=*RCW-n@*kXJe`m|wtktF+8lv0Y@7h)7oLs|)tplaUVeePn{;Y}f@$@o@v5u% zf6dl{m#9k9#ju39fx48lXg*PG`S`VG^a2G%2MVC_tf9URmcmq=e_%0xJGvBz5Pw4_ zGF<9u-#9GBiZG4euI@i-Q;pkSZQaDneAUAF@ikM|LUnQxalO<-$*Z4D%8Pg7l3E}p z4&RuDJsg28+^>W@0)HwhH9?57=M5J%RBK5lQfYw!R5Jc9O5`g^OqkVo7>e$sj(=h# zYGn!SBo>xj?|^U)ECXG$1YJW3hzD+7-`6KtmE-liG^bpxB&acUPi>J0w<^%oaGIQ( zntfX}FmubnJ;YgmTQng*Bzp{8Pg~tjtJzX$`J(PvLG|<9@itRP5{~&~B>}QPRvw?{h9j(2ijG}k1r=N)uRB3!P&rlhvu(CN+|6cqc! zt*p`{$fmt8y%*bBdg737Sdu8<#CE6U<=x9&mMa|C{1ecAPr9kB4UVVW-wumz;YgBZiv zeU@{z*vVGUv3qmxB_Vke6Jw9|r%W0&gS(GwM$GHWbFF~tJ#r$-LyAFF~mR+A|6OL?Y)#0gyXIrX2H6-GML4O)>L8?fe!l<(XM zY@eELC6~6R3FmMpjcgXA%R}I`(%s%h$Fr|?r6a{3#;663potZ!x60}ga$H~c+*7hD z`Yf*%PQI)9Xw;hGwtT+ENCJ$S2-m(Xz5_^f>3N)74?!%ovgZ*ti&2zrFNNJ2nhO=C zG7+fu^#KaDH}Q2hF%n4|Z@hSr8$U+zlH`i(VbQot%B)hzQV4G+tH=uvvQNbVqnjP$ zQYSesG2BNbc%8n>{_oE$~9TkX>wI+KVEN|m5Nv7|ymLA_w zNNG2g1%u{IH)C&0H;DFV1Qjb|FL0_1{KI4Ge_HIECkxsx-3wbMJI$ySTFD7Ph{V0~ z674030fU`wPh!2OxHfez;4O~M`)N(Q{a_oqlqhKT%}iI?9uCN{pPb`WLD6&pQ}dl? z!6_f|0>Fo~2d3&R4ZU15so(pNYRBhg^L+OWFW~I*kr|*{zKVq%5{H!`VQBBT+h_t) zfHbKfs6~rU)`M|-)qNNRz>g$3~HhlwT^&)I;wyau71P*D38uajCa=zgEvPRFC| znrO;y$(MJ1geq`?!M}SSa;L)0f9i2SiNoLNxqq@#NcY10H)aWmq@kHEVH#Ea$%)kO zwhwjHi;0`nQ|vmiKFmsM-!Wl$L1PrS22MN%1px$GT!3J^XoG&3g3;qa!dgNTf9^>5 zr;J757r0c9F^DkUBant3ek^YG_<^R)0 zdUiJ9F8$=}D*vSZ?{QCcY3+anCQ?dLGWp6vG%L^0DQ$Gvq z8yRNcyz;@(nMcXac4;*BH1=E^i5@AZcrroHNpPSjbt_Sp(%J>B{vn$sOJH9O3V2NI z?~=!Zp>co{1N-_NC`S{9;~|Z>*yFRep)lTZy|uD@4Dz8E2p-;Ir;b-_zswQQ%=wX< zMCP-f`8S8LjW3{2YZkImqp>my3d;abAQC{F|03b`t7x-BR2K>(d(pS>FU+^!s&@JB z{=c*M0efmbW+EZ2#L6lC;g6<3*iJEz@WKg^$C8ype0ci&lck-=Vcn`|Mh=sbo05i? zUf{MBWj}MQ;73g9c3$|x==YRm+3jA0k2u?ODg7&_YT;XxE^iG+IP-E-2fiOe6wIkO zZaQ9W`U~eMt99l@+x%n3Hyhhwr$uhS&+oKqJiSRAEJ zzg>(1R4b%3PW>E8C^EZ(y?h*9!Q9Rmvp29Kq`(gND84a(63F#Z6%=LD53CjdLC50; zVAJBafczFFB5P{&K+o8!tUO>c7(+<<~DIkg95X|5tGN9PKZujbO{avDIy{ zFwt?x0nM`~Z>GY&-ahp`ym>%qI=)?sR|CPDd(Alfb)}DQCrJe~DrLnV*GXfA3LhoM1Shc??w?r~XK% z&MN9X0Av*WwZ8zYo8iATaUpuYh^yt_Ap5!s+EI1jKE7xP=s9#(TLQ}0hb+|;Cq89> z;Dg!2^6R`F(qPU5|2<)I3XcJu&g)zfouoIeCfOV4e?&11mf@SE4m)xxH_4J;*Hc^G z@7MK=+m~Yyex0{a`b`rrJn~i{<;{2Do_>KX=HvPhBnZ{IS8HJ`Z-ANyAN_WKCFuM8HR!=& z8-Nbwq$P(w#o+@G_~|f#qcdJ-i-v_TEE)7CRd@a9Vh+2*kTSwdwxAg7J%^ zLS#|5bYe~jgy1KKMF47LxniCYb*>AeAt@M5Z~)52d+);hrzi%wM6hSFp0v2N6pO`L zbzW7~eiuynZi70n{qsuu?ZLRy9FDUOR6I*ftya*Gum_!erBiCf*^Bf!Ne>^>j9|1? ze1>=swrmSfGPb(Heqb>GC3PJFKN5DH`L>9JAIl}{9-lbDel><*2;Uhc>J&2b~77;qm>uZ&soFMYkdOh2!> zdm&P~M^BjGbssHF{F+VU53HpV2OC{idoNZ-w1&v86tZeonA#okq(xJRHa&nTI&(lY z;lsj4YLRD{AhQOXdc*0O@6}kmMLAbqAS*z)xq9fx9L?3cuKBcd*edG!Y$J<8iwKX9 zT#>A+1F?jm)!lF!@d<;BQP>Q1zerTjF;{1Y>b-2w1pb$-%#SaL2S@52k1p{^JpdZ5 zf;XOeUBJ)5^VS8&D5Ijnz>Avt<60LVpQDE3l<)8HeMn&i4S89>kkANm(@95EE{uN7 zea-_HV2iL$b04460s;fC^A|rB0p*m|A?xdTv!x{!A%=ca7jS9JQ?6vEcw=E<2|eBG z6SPs|#R6&<;cNXlTxCxGA7&I@hS1^lLj zQ@?4A9xb2m6W9|Q+9nRioRmYs*j=@jR zr#=uM%gPD(70Rc6#U9{SFpfw98Yvw10P{0?74-c!7WA?-mpOfr78dyPRW5(^=o6>x$WbY>%K5=4?bd-Ct6hx z2RNfl19k62o+A!va{PQ>)D`RKC2;4n54FHJ`J}}9hC(s#Pk;6r@JB%7gj^6Hn*N^I z1m9}`fklkh@B5V5AXY+nq@8{S9mWH2G<4;&vxX(v!!6#J zsHjOXorJ~$wKccd#%gmPnlHo*{SctYl2aYSIKn?@8yHE zkgm)bGj$}2{#r>YF^c6b#79H?omF{^6~s4tzH}H*3GGxK z8zKU%s;p~29K9VbQ1Svr!ve0a?Eb)diKO$DCVd)x%J@C~!-V|u?J+qq4*zS;(l5@M z2F~vcz*J|ZKPJ$OArmyBq~{z^Dk{)SC)NwuQxY3dtI)rPmJZw`i^9gW`uvQN=mRm& zrbV6i8cQzW@5&j6s^#1CY5huj8B?vE*Uq==h#mX4)v*DA5t#I|-&1Sv>!1)={wG={ z_+TD-7WvJ``4>tD{LzhCJRy7edj$mm2^Dy9;je6nX_*DQ`0pAxzoYvNsCRe;eg=Y? zzg>U<&|~?J?Z=-c`=xBgKRxt+n(U{^0MTZQS}dn)*;#cumR~IlXCe0w>hD8=JkOl} zxpi#@-H@O z1nibeE57MVAh=BMF<+9Z%hDy8ic5qqN1B*7vM#kF(>vPmu{YKxxXlm=o&AQQNSRu7 zn{2NBnv-ggok(94qv9@n*B(!qlFGzx!5PQ1<9x;y*j+XOJMaJkwi?rcmgFR^NSd($ z>SB)EOCtKt%2lSNp*yV4@r7$s2B(8On{f9B=mdKI;_4B%>IFO2E+75?7zyIa*1zN z8($f*Z{b|>9TNz>WMWI6ZlHFV=Cw*JtXl9s*<(#xl^oD}?f|YOT@yrnW6an}zuM*z z6?&ZcLxrY}(mc7EUP>wCioX0cU$|SbuO`!*&+YkRwZyGQOHa2$VbgNFobJcg2L^!u z3FUul53zt;jSKG2>#d2ri+52*Q1D<1zHgWFMa%KmMv{_df~BTmQg9EAaaRiBJiDQHcZ~#D7AJxapbGQ%#=VQM%pZ_ZY3~TB$xsEigfk-R7Yk47iA$08a>AIBt`plY+Al4Un zc;UEhFD`jrw840l{zXZn^yI3f-&6%&*}YLTpsLq{Ap?9?sM*2(=Z}7x;O8i4|7n6h z+60)#yY&f8iAU3$?cgVe`q$p#3YS?puPx&{?)ofEBL;uZCH` zVkErDt+Ys3mQCkT$MTD(uNkkoU*CpdAscs_gsuve`y0(BfFD(s4M0qSS|~L8VjZai z`fv5tZCjkb_~PqhSJ{Q}=*eKCE%~+qL>-LXt@LTB{1KY`2bS;=bI+&c0-m?C{%>*@ z-E&}9MrA*a>Puy;3PgY}E-L!7+Bh%=ngU zXV%mgQS`3f0vGU)W>DAnEcotB=zgH*d0~o`K2gU!s6LLa_B;{(eqCu9RW@l{76$+ep>Kv%l|a&oudg(qV!s>Ozpuoh3f-17rvwQ$q^w za|wFb|3nthgvr%W#Mh9Y>go33dJr#%YTjkkE4gz+a1O7F5x%#AHlEa3%J0)kBtnoT zvh^De;>VU$fMaLNCys-AQ-gy9B)yNF&-HY4*mqx=yb1U&5;T|`sx?fVVgpsgm7T?< z+43^8j0u;lT4{X04@VqAR&oCOR%)ehx4;op$1G~3*1Lynsa(nz`Kljw=w&a}sT$m! z2E7^ENErLJTK&ATZ;$ZWnhqpChbz@!zLTtFJ~L6dsho)PYT%UV^kYH}F3Ji8WSOI< zg;}a(hE&Svgo`UTr?sP!slDfmE_0Jx;~tFqhfo$*k?B=0Q`IO=9*+pS^#Y{85s!fi z^ldjhq~IWNK-wiS9wDU>)+D5q5x|SfnVLv@-Ca9xFN3H1?PLQs@A{iGTB^P{J_~XQ zg_s*y&IXsZ8IPyx+Y`_&Xcp{z4rD z0-hvLzr`1|v#BvQEufv@W4apY7hXh&r8kb^B)ZG>H@Ca;{W*sdm@}?MSAVLZCYx2^ zZ158;CgfSfwhO+>W4zG|9uGt6^y#?noP;kIu)cB~h4rY`*gTpG9@L&jH(Y(;eSw#z`T}p8Bnh0p%jLC-@CW>MG-g2OcZQcGYqO-6Z5Je8VP#ezL*N zUeQIjpjX~)-wGw$I|kvv74yuCkUH!ef_t?5JDutRJdC!bRx2-Zh+WmJ!f9ms3kU?Z z)0SejYnFrDgy|-wU4WXPVnUWepx0I&k{K>uJ&%K)I3+zQJ~o+%(R8|rjhDnc+%fZ( zDaMCCGg5RjcpSSFM#q&`pyY(V(dCztxsqfUwh{S&b6A&~mpJ=H(=g9Yq@A1Ehq}Z( zN5#c`bj{Xt3#7mf5M2b>t_^DTps|n$XTk=3620q?wl_EY8aq{v!Ac?{n$;<69B=w$ zuNEI#wsEpto%ds>4(4&IXaZ49BG;POvq0t*I{0H>x7)$?_{|bgA|g<8KPsxr3>TA? z?e4ZJ=L^+?>@JQbYVaB2(AtJ3CId^UqkvNpNT&-TwB=`PK4~ZOG?*x2-SRb> zYJkfjp7Wj}WSC#YhLOlMn4g!UfT-KfshD+sH`M+qrsgk(3Uen!a}QEK6UBulbum0{ z-Y8HsvfW=w6wWeKJbqmo=hFB(PEkEviZQ6@&Ze(_^lSPE+mLCv&zM*c$H-V(6>QMB z7FJ1Ax6wRo&UHJsg0rL|GLmwEr8|>y)3(x2aOHO%FQof%Q?1X71Zgi>0v0ykW3@u9 zx%N*TYt_~SlD}+fTHq)y3{dwze9RX9@tVZ>Ob-dm-L5e(^xKw5fB1Azl#*lbTFGR}=d+1`Vf(`p@7#}=TxNq{tk8V2LT?61E zoYCIqwY(*V!ucdk8^;t%-i@An>h0R^5yNvhWtHTf05^|+^%?$|lCs->hTHE`b?JLu zxRCZ(UP4)Fb>2jDVQZ1AL|To4q2@P*!xP zM5Swy?lZ@G#oFrvLH9RiULEw~2VLmvx;9fa&Zt@;>NGu1jAsf|e)IIBq)-fWEU&E| z{OIQj>J;D!c%3_X`zE^Y4x6MZ%y;_v?>v}x{)537S~!q9M*76Urc*_#+k<2~ta*yI zu68K5J7Ol`sdj#n3GHxNrb`^7|5t+J#F>qGyq)A!xd-V~RZ|jcsYoCf2bVz`gsf1F z-UXFu2H4c{IYW~l_K{yDN)Frz+QEUF(s^sNVb~W_XIptog&Rn$a^=?n%Ey6{SuJ3= z9-OIb8@ak#kGLKccSrAl^yJO17H{qv2M(p)Y2KwpD zNs5EsM9bQdJ!`J~m0iVK>teaaDUoE4hzp>IOLwv_Rs2pfWO58ECfZ;~hUtw5GwBeq z&CxN740fYz{jqdYHdBcrg=~h12<_R{Hmed=L-`S)9>UBdA0&EQWv8WNyq#ieURZ~+ z_I(&<_cyeG+n%6E|L=;ti)0U1*fiPHe5`=?AmCf8CKU~!OF-ZckF4K-TGhhFl)-1m zWxJ5&EN}3>A7_@8#uu``^|-|48urlNRgeZT^oE{y%N=e=cwE|6|*n z&24!K#V98*nDqDHFx%W8lj+h0qz<&p^!~tFCpne)U|V7Tm9Qj`#Hp^Yqqyua9y7q1 zx4C!m!84!DnU4YRLJKmQ%!A8tsne_%(-HBKC+Y}s|L;oJazbUTks}&Ms2I8@l8lHh zjzp7Og`!v1&9oD*-d2$2N25VO#k2`ku)KmpX17VQo`PnTEAl4kQ``aHok{^5daiXE z)NE99I4nNNzb@Xr4CC@LQymO^?eTaUES;wyqWkH6sSIwm`2M^5g@!E>A2v_=CUWn5 znZyk2t9jlRSzu=VD ziXewmF~8b});$}6o5NRbDAm|*eOTK5WVv4Z1M8wQ5-;sUoR+9W+I|B;(io6uV1Yji zp>+f^P*xWTAY8YpsK`YTn-ev0a)ZWp`Vy;b5cf7Zn(e%_uHmwR6*tkmoYW^>PQG}Bg&+oFW0jL>5Y^@fI5nwibAKJR);=b6Z#tbIhX(oJ73ve z_gy>O2ou}}s?DBJp=aZ?Z*|rY4@QY6;}g4D?P(h@WS1gxpsvG$5o-7TN!&t;pZOz$|`i74&HhG?k#C{*>c%0s+Bh( zWqmFJtvdBZIdBWQo4p&~IhCnh3Z94dqo!mzYkdcaTUk23nUKRYJy_s{!ZjSozoDI=4Oom#+Kfz)*x zw^JMR*xb73^AY<^+Jybk@q9!R(s>#bHiZYoC&x}+!~^b10B%X$b_ zs`;~QP7;R&h*slL%T?%1G_S^UrW1Y^p{>iQPJaDP2b^(ehkjW1ME?gCP)s0phK~Lu zX)|w+Q*A)ATsJ{X)eGYI2K6MfozZk=@})k%G(X}FF-^7LVfYoU#*lMLNnM zYu+_+0*gL4bAqP{N2Gq&QVWObVG-|hqn$`o90Ifvi};O>5&h{9yym8lqKfXZwXLMwjp_a9sOs8C^|T?YON#UK_kN2y;n})(X+2a(S=lUWWuzR7p86 zhs@&r`>O3N6tuy=79<9U-e;wb%ivmtVe;rf@S4eh$S3jf>n7I@jg7@nbJl|0wwf$M zxV-y&i`pnx53fHJor=FWVPkKdae;~f#}2#FPGVKm!b5QO1h19+fMi){ zI3cgWhP5J2iGNerH&EgnOABt()lfo_-izFSm~Cj5Fto2R?Ws>odhVYw^3NOn{y_X` zqn|eVEq(g`OXix|S#hkqBTUssP1<%dU{}=e`4i+LdSTZfd%^|hkfF5Ks@I4uMsQ7y zp5-l3eq-);qy5&fVc-TQ6}d^+RKonSl*Aw(Hb9jt+-Aj+{fg)p}7>0{9r!C zS1{Oz;BtXsa$z|dx()3?1=UZ1@?c-Ksp)CJI%SP329(Ix9x5q4Sz6<=vqOFz3$GL^ zF3pbWT<*VQto6we@;d9C4T0E`3;iyBYt1@jT|GgLtTwy?BYCeoA*L`ZEroYH+!5X_ zPC2gb=f=Y+nCpF$lWpzPzunn?Ca##=NvOJd>LSbc&k7XDPO0ch~mr! zzc5wVWfebbK6770MWEnSk~UMT=9>4HO{T03?ghhde8Kx}LYAlEwLbuDL&0WpmH67h zYZWsv_=(;jdaE^&b2~reYFtuKYIWGteh!;WNBPoYhcFqbwZ+7dX}K$`A9Y>qXRUp?Lij$!XrMVp%4(=t_yn7~L(WBUF!?-AVqv}J_XtWP z$gpC`TAnlo@6_dvL5W8OT4>k9)8IX5%FxkNuuJf`$gDRkT3-L#(uMslU>Ln04s63v zYA&pWq*x$OGTQ{%<@}x5@|m4h2gzh4yoyFnom3vyY`BbEwvkHKC_vUA(s2fKd{GBT zwv5UT4XvP;35(gY_%u>WVKI|;E_$mq?x_%bzb+)AW#W3PFTNa?bxHdM>xYL>aIx;*TpHfixS59dSiqfUZ_IS=zW)}e<%;rG}FS<+}Z z7tl&zxTmn_1B0E4y=rKBLFO;y{{M~7KP{o45>C>dB|A5Xwc=D>;Y>doGZVSF@KK^3 zk|<{q(k|FWx#>EW*ii+92M$@r=udnc0l5(qC2#m|3YW5{14kX&ZZizkObngWmCTf= zi+}QudW4Xkj^IvEBx=l`hTECfvf%I zRH*9X|Je2W2P9=o5b{a0rrI|o^hwprauxjCVwrC^SFeS?@N9AQ3dsZ4V-M7F=dDfM ztw%72}Z{@v>c*V5!Mt(1(jFfO%8}bQpIc*WhlJ5yiD@HtCq0zk^_KaC#c8sq zHc1^j-S_Py5?&)!gk7xXWNHur5YzTOJIu^ zped9%y+QQ2B3ze;UKiPruQO^+;RGVwLy)IsOPey(fXO1|==g1KagVirowjABeCG3U zHoN6m&E-0XeAVr8jahVywX@R2meNIe&IX=`oGG#S>V9olwQRXh7L2L{9HeIScFZ5I zREY5+$kwAPZ1umbQqUWMSoW+S%&2&4{yM@+r2(Xld4f+ zBuC^!+eU=CV`uXSlx{a4h+9=x`!H@dj*r*X?k7K`c=F|usco@<=~VHpOGK;}%IQC1 z&@#0T-~`tBB1X2ec-&OrYRRgd3rC*08iW^uuFc>nTJHD?TKR@Qt0D4{Ppt^rrI)cw zq()E#IZHZyo%i}2m^vl^jDEN28gQ_I`o0O zD>k9=Ou1}v_Ez$rHq&o%kjprqGa+JRy}A(fkn-DOQ$&feg}zm#Dl2o8*>| z*|_y&-&AI^_{;|Pn2RD;9C3MXA*jh~)UT98EF8vrs|#O9G?=L|-Lw#%;$Mz|Z^B0` z+{)`D*H1ue2bLr49${ig``HcWS@r6Z8W6(Fx1elNkk3=Nvt;1n$Co*)!WiyY%NcO?qju4HsePTuPL z%zz_E_iBdTcUX*Q(09zzEjpcZBd$%k0_GAY%0CpV{n6jpvPC6^a+1}#*;2r%S(0ivtp31wi*xWG` z9g%D##E}^vRsl4e!g}9}&c}Uit*!62?t5!4Q$mjJTQ0loWQWC!hPI)$4;_MSs-X+e z5#`}k`mV(!cpgj%Diu}K4=6|?4Deh~_IayukI4Jspp}vG{qq-hDbs2d`oNudWL+ce%a=W?0w3p`=G+!k(hC#8yVq0j!H#ffu< z5;~h=Twm`8u{kkDD3B{!Jt!h%@6tO|++Fb&%#+%OBB7bcFoh9#W1J9JgW?C) z7&BT_XhOx2zfFHYeqqzT3iWlKb~z-GwN2*jC=~QkM@N4Q8Us+Zba}k15hFph?BLm= zJUB8)WjIbS-zsGY;?T~!%ppD7#xz+~e(3?{OtgSWrAN4Z>2A<S{QfP~#7v8bGnywdVwX)0>QuYeZT)HcnZf8NhrwM0S#%0MV$hmT&i8GP zyY0f8z6EX0M2=fnWNN(XH?G~|(H@^vZ1;jLz!Kxy9#*fMSfHUxDMI4@)uwf+NSQ`L z63YRw&gc`SuIBbDQ5=ewe_+|um^YlmtGu;2UW0v~mev&MEMMKnTe-o_m$P+EIW3@m zQ0+qOj@`Ly($}9kP)cqkmZj;`>9^|ws_kljudMoq@^F8p!2T=Y_>@dqreAd7bqAm$ z700kab%nnr!lmwGD+jXV{w-D*`ZpcgGFx=A%7MyGu1=-5ChaW5UI_>Yg_Q#3a~=a( z2IG%lAtp7kh7VeG?~#(R0kR;=iK`p5qlL=+laGR<=D1Qv%(l4=9v*n#lj#`ssN`EQ@$FgiY`_2IR%t zgnoIOB8n*uwgj;dng~TGarK=5Ni{sNl1A0E>*>M&`b zgeo?MxH^WSeZ_Lhdk#P+;;ghfre!ovNbN5M6JoyOubKc)28yx%$M)n;ll`Tz!2g@U z|I=hYO@>)`;U6!tXX`^?Bz>^9O#TJkC<1muiHraG9(0zieb2nQbvP9whpwtbW5L>YrsJRyEUjIdbuae z_B6_C)CwJ`Zw9Dro=09%sUq7gkKayRKDzDy35N8{b?Iz!THHdjdK#P8LxOiiOqj_L zwNAR{Q(rpqf8W);;#@vhf)oX+oi=t4?}a>QYvx(Kr|7j`T?gA2`qpW~VRxA`^{pj5 zN;=|6r(vIeh!*Xq7YnJ@HR4S``N{lD+Y&fz@5JK3(vt|xGojPO5iSpAe3RR&@U+%A zILa_JUslRTmWD)aB-9*sb+1NLp-E+jcw91$T3-iIku{pxU|sm8korDHxKibLfd`|< z6Ne+Oy>QlalmoI)YMQ2Qzy=pXNBMFTs~pU&P!d@}yvK}XM4iI-H5=+$7a}6Q?9vRC zR!!KPKtaAqx>V8?q#Ff$CvKC%^a?9pH!6n8lnfh5qfGl3<(SQ|*m;^GeJVvl@`dKY zy~;8Sz}uk4Vx$S`$t|QN`r70@G@5mtH;Mn!PKvIU5rZ)oqGdM)^`_Z*6WpI|;F|%+ zJxbsFfRWmlH!J>zea6$ezkf?|DE?8LIcJhyz%%~vE?%GeDJJ&<0=N+Q^8xQDsGj?c zn_);@*`Zk~M{MeE=;}@)rSykTf@U1VW1Sf)8F@KM;jOOC6|6k2vec?is4f<6lo)}C zVbC=+&U**b#2AEO+tU%c76(rqYI(8Va-q}+*?mvx=`YduAAB*M;I9`*#<|>r$IVm@ zBIUAyIP%h6L6GV!ghlpztkF8jmP_LxRu9*E&yU_zzW%tWQ=FT5JAQyjYDpxp(letJC^5HQzS5jjtwRBl5ZnGDSev z34BUo-JA0s;~JwITc7>zSDy1|zHcZWF(zXH!k^j)jU1x&r3$)$T#VtRbeAX1<$(Gt zr=za9S-E@#`}ib__Ol4e)QHLpAswq7PLcO&iSH=W`+2cyyQJvri*d3)DfU@pH5({n zubd?x3$`uJ4Z+o>YQ@xj1BakDIV8w?yGcI$K+)6R*R7 z#agfN(D4CT9EDzyQC&9;f?u2v1Z79#>kQ3j1lV%*pCU7co-e=$va;4(*EQF==JlWdAKWVskN=shNY||w#kw^?kqIt)&GcDy zzzXLUO_BY*PzxgL8#MsmNT2PDMD$CanvHp?S!M8K7%YGHQ_!gVEK7h zSF>=%rFxlPyYJMx;@C{L?W9Vy0WMKl`0h8}CWWu^x_i>qugvC_T=%-DQ$I?OqkEOU zv_W*PStF!A87fi~S|W>MZkJg_jj#mo)Bvk=uVvp1Rt&Qn!XYXz%Q+7*jk-tGW;Og4M;`BoUh{PhPZ58N#HPbv>J zg4(NJBppKc?Y}QCRIY|4sa*JgFXP~4N`^<*u%gC8vkv$}u1gZ9w0aT*fl+e`c|b-^ zugNL}lU?vfrdkChTMKGtA3mLW&~oddb1=gDmiCxayD{&ndKu{&)!k;SZWed-S6CK- zL5z=Cm$S_$j*|KT?I~0QwknaP%nh+7EXGG)3#eH%giRoNsYCo$9*Al}N;hBah9T1t ze%NiG;3?SNowKMvr2=P)Gdl|L;%R-jLT56S#k+$(KF~c)77G&m983EL}*hpwnS<^PKaJy$lRQ@-sz&z)?m!-YgdF!#dO`v`Y^{w7j)^3(f?(a zS%92>*o<1o5zE|5oUi^c15n^dF|ejjc-hJEhE#s~6;c7~87;8jlC>ckAv=EQLj`D1 zIn*m3FS<0f_(JJi54<_2pKE#ewX0OV&P+X&`7GXR+*Jp;SLO;{Qs#S&G%Cw9nBpvG zb`pqxH&XbbD~w(hf8h0A+Fk7f>Q9=Pk>6{dPv^oLVP7tVdP_857|}IwBfL`vU1U*= z{%UQ%DN2AtT256*s#b=*#N9FN!sqXbJWU}` zGTwF(?1}>=#oS%7P~}mtgg3c2M8)Z}N5K2_)=P%Upfa#E*o8|q9#&^fDqb+j9AhiB ztHw#6NHtuAc^VX5Jlbt!RuD|{&FNj@^clHkx8~XbWdjUnzRPcgn#>B{bwHtn1Fw{66dj_5p_L^ zX=SFPpyW~#r8dc2VfB$RAnB3X3q9ZA_cQGCJ)KOKlT!n|Q5&TEuY>quWY&#%Nv|PD z-@tbx$KG!e3N_x8#%WfTKKK#&GzIXrynZ0Gu6~ooESl*QEA0pxx9ocW-`5^lhOeLd zrohJ=jGKITRB6%rgN7lm8%N&O&YAkX;YpylMMO<*9*HL?#LiBn`RO@*EnW|@BSRuD zLt3E2-+if*LORD-piY4@53?*)^WpzjfaeIN;&=bgff zmLCW8{}UjKv1I;*!10%C_g7qn-a*;i21~K;Z`h3A$Q`+>CXPSSYcNape@Ow!i18oz z6#SQa>aVm5O#R|Fd_=f5nFt>HU$)G@p3d)#4`E#c%U{K@8`~ey-b>yumYXCfW5jd{ z0Sue5eWmRr3G&TBD#NvN-|v5q@>ck(y723%I+WH7sTp8e3x0)&{0`<&>uFh+mi@~> z`wxMWW5-XvP4bt4_Aelm-}xidgNDHdzWwFm^g!1(?P8+z3cVDMCi%RXo44WKVtYyXqQX z`zMZl9ekp&ES-VL1>Wk{U{=vaWB$gApIC7SQJXl=zkGT47OYCBzaVhJa$pt6#abj{ zyQt7`(_t%0PX)45HdEB2Km$$Dg;2A~2q7zM>0HuB8kybd+GF?cBzrCu(Vr?-B(A@y z8RN`Op&BI_Z?EIOTagw(4@$V~uyzT0V^S8SkXvjC`H97D^b^Z2uEEpEggs@$6s}-FjoG^@h1YOse=(st`4Au~Z$`&GFk&XmFZ3>YEBfM0=X(C|@>T}0?#ig4(s*R-bc=lr{yBxL zY%)%<66O2Fivgj7vi*2fq`WEx=$uTx#>H#`Az;+7ZAn~q4IkBSyn&vIBPIt zql5*Wh8%2O5JKsE0SOS|Tj>Wty?Lsu$7~BtJgX`oGrN#iFQ&MLUP&?FvlF?kvm@4` z!3e@Ty~SJlasgFI4b<~pGxLRu^Bc%czWCLOg`BI$?r(VxO>ZoVC8ybtrTT9E#4O~iX`&p7T!DQ4`1!U}p+4|)J5 z_NU*BUBSw!D?hQ6TN^N{kMp6EbM|#ZGKEykQsGgh9=KloestlSjegcZ38JR>aYtVE znPXRG>DT_%Hs!=rVKuWSTDaJj!_NJrJ(8gd#1jmB3eJue-Va=BqvT_5w#mg&m`1LD zYR8)QpHI#pf^%rrebL5z&&ZX4IB76ykPv-KYFxnEQFqvjJxdo2d{Y|Rqig%%ZAe>m zeQ=BChy2;)E^|Gmd;9B(FTSyj96}^0kUeN2ogwZ^{G}^Z4alT&ane#k(UZE-_qN%e zSn*~_)dIEjvcG-~gH0s+eK3N|0*p~rFsf@89P`VPb4)f$JK`i6@DfMT#vn&q1Zio9 zixTG+|+}XXJZ`W0#C!mPdc3h5vN<{O|t#Cv=d= z$G=cg|6zo$)gW}`>05Utt6AUyK0o=1<$4~h`j&qqJ-F}Y|4qicyC*rOaJ_l06#~$q z+hY8Q<@6Jat-T=dw&U;4zRO<9xr5nm7gDkC*R|sYn{itvl~yrLhwlfL*J|(Chu?Rn zcFu0vdFs#g#4SrUidnrdoVSn=`@x(RA^O!(1Z(#l33KetZx0Ps=i zK3Tk0KXX695u7J2m~72K8S67o)s$shK^}VcBO;Y0KUL62>(-CLcWA(3XX6MM&?55C zX!Aj)h;#F(39sI(&)?($wq{z4U&*j6gI)jdg~NSN+9JJZYfO=m^T#%s2P9#sh(TrC zc7@NtSYKE6(V@Jn#r(JoA5DL^@L5C=coNeb@vr$t{Em+gMfBMdF$=<9IYqz2NQA%Q z|7sDPG2TdmW^bcB2iE3%=BH5tghfWH*Nr}oT~#zQA?A&}ZTD=D98r2r=a%sXirJ7( zSH%O8u_RiQ7Y-}EBbK69tG2Di!6|u6_lEs%a3c1iTV16XYNUVT1UJqX{z&)2_LVJH zI+KvT#?Y{=r=Xfh`wl7wk}xn*a;d*K*)^wmkr2Pt#HDMJv}|Ld_fb18i{T5C;JxRA zufIDN(fw}G&CJU_lr4p&4QKkcva5yq`0Qvt(Ln>R9QHQ z3pkl%a;4hv$9&moX?xKq6-baS$xY?599G@IPWOikvRaeQYn%}5cc+<#2F`a16pDXkE> zQXgkyR`mZGiAAO_(PU-dCMQ#eB7p`n4?CSzZR>^-*+l7gOsc(d{H7;Am+vZswY(-# z_0mfS8NBU6*@c7z3wTRBAxKHPN+q1(%)t5(*$s7InVY+b)8}ms`xSy^^|!dn4%zCK zVFoXMU6?7Nw>42YtD^#gJh>ezKRG?0D(2spFbDUPbUU9Yu%3tzsP6~jE87-+?J}cE z*T&+}2)}`4Nn^*3|A!b_8|pU~ui|rmlDuCDhv2JXp^e6jUQC=ysD!;w@p>(7?#0}f znafDadt2EZ>D%NH5M+{J=*HX%6%qFn)!RI@7TgEFH(2en|2E?v#JG4bvEq-j-tbOc zq7MzSBVzH2OPo)7V)R#tjV$seX`!i|w(gULT;$`6}X#lSyA-fB(CsZ!^kB*}l6BmY@2 z?#BjWfReugi0O>P zp7GuImVWvlT&wv1X;s69Rlfe}QKD@~uF*@9EGRTe>pm~87Ng~C@FCbAMplHGY=krL zZCYVuapS4K7F{c(|DK?OI{{y-Xi~x$kCv&>ql+9r-Fe_DxC29q&=^^8y_8%U)K0Gk zl!Pr1R#XSzR^eyH%Ku32Jh7O*;McJ1iCPRSvkmh*>@9nBU%t73*X#9gWr05wHg-Mg z=$xx+VSPJ1$?kyfm6Y2Fi^D2ktliB;(k484K^NbNJfDK|Qdr60Wq3#MVFZbn(@?$W z(oZa6c&BBd!Tg5Z*@$j`hB2VN)m>_M-;Y+j!)_Y9qsr$P06g_}Aqag;A-IQx%_Q=Aew8HJz(93PG3*NOd& zIhEu!db|ob5AUt&k7vPE>qV2tNmgqKBkEOiZ4#ANTQ)h<+=7(~FwGRtnUq2-!x-IC ztV8|H^@zzBIjr847aQNs=SC}wsbm$K8jB8wIb|-zwUoeT)o9&9y0QCpZd5$k>KPDpgIt94;X4iMmb9 z7A1fGjtZ~W-YB9oIAeGbg$<$f$;;aIke$d&--M7JGR=XgO?6FTPGR58L!%U5`ICe2 z&hC6~n7D+Mw9(fT+2)iF8{o9iQQ6S)k2+J>9*a}837#CX0k(bU{1N4~w;$E!SC(H6 zL$m@N_&R%JSkfGq_aDe1aK?zN&05}Ut8J+3$1@5I?Ddk(U@yFtRpawNs4rK{1D!pQ zKKUjBJ5)Nf_PVf9zFGipmu#e73U7|-#B9Qd#1xhzNZl$FkVi8rab{-LmiE~;Iw!pI zAz_CG?V^=He!UkH=ojSX1ZNf&BuP2w3k0_B&1F>O?oxxso0?G#tp{>Idkd1xr-VGk zqZ}PB1Rqb+$r)G7ZfDNGa+b?7LX?Z)tB%vTB_imMJU6&Pj%7tqF!Wp1#g1HR%%DnoefBouP#LADN+^>%W1Z;izoJbhX*I%C+~0Tb zGK$SRUr3jeaQ}g(Qcb3*l-fb;%($3mu5uolYgslzwFcQy<3R5@ouX#foR%ny`#=j% z(j~|9nfR*#*Bds`hBCl2_T*KPbr+8>;h^iMdYeM}gI|tmC>B#rwx|qAfu135($hB+ z^ij?4Ox+JY(6dTxHsy(Fp(yuXqobE339KPV1Ax&2KV?;0T7@m;2*OI8mq)CFhuAT> zAT%Ob8P{mRcXC4%yozat^0-a1gsC1<)Jp?Fh#>Agj)!VhUpvjx=g}TNu~gh*_HWng z5Zd$m+nT)T8W`%pnv<~T8mL8gw)a~jfUK9wOCV7VWZTwEK;{fn+sVjmJwERPta|OB z4#Ztvg|Cl7ZJUy&4Me7nYuUe}J?#-ngLkJ4+)DMbp**}wBrz3$OdAE3!Z40%yE<2_ z9U=3ZQrJh%%6d}@@HgqftoQ!U+%2_K$2@;R(tM}bG3%A#2`43!41jjo_1H+sd+3?5 zmH!evbayV(lIDCeVeXP{vR-X*7L4as*Oq9MllJ0?25nq=uLZ{^rmG3Vy{u+EQeoa7 zmhVQJ=^KoKJ7&*jk+X;Fp2j)buobs{cntaRp6J?^lB|2VAy#(-gKPjC>Ua z{WZAnn1pPf;|_St4hHC7#+4N5qZ4~3+d2^Vsg;6JgYWb}^+6;*`1VLYb%jAUeyr@m zg8t(VY-t?!p*6zHImmE7%m!zPKR<|U@IvRr`MY3>Pk)MK>_=BncZdCV^NFfQ`xZTa zmCb)*CEbVqRf!(>or!3=WrT|oOC^d3EEJe0;Pk3qRPt7mNnBf7puJbt$~)hYxAq{) zt6TxM&QA6g@Hds2laq6`Q`wpzX2Ic{q-|x2daX8Pz3p<24a`OWaC7t?iIuD&?1^H= zA947yo`ujQ<{=n0)csrUa7J!_dviQ` zehqs<>uiSf8Px|Vu6GVuN$}M*x{i^}KOX2G#KyhSMl)|1`Y2v0-`R!3)ZIIw+IPCdX!q^6`U=jHF=C#ruoszHd zL{2iAdod+)k(A1Slo9S!iPGf&JqVM3;)6#bT{UlJx1TjH)%Cxa)NUBn?`!CbbGcRv zi(2oyVfJ+4W{=rBQNaDW>iKG9*jff~$#<6ku~a*pq{s$|q)- zEjp#8U64MFii<&$G5adE3#hP87(a!q^s|Al!6@3g>mF z!F2r$?bWMg0Ef0H$E$Wz3TN6e+BBcHwclD9Es3r&dP6wrqpR$+Uc1e->Ex=t@G9Q6 zYmD8z_V6`~5UWMImH_oJj`zUCfuOwkWQq0Hqd%@&Bi|zeT*9)*c&d7-LeJDfaYEk; z(Fsvs`rZ`aWN3wmxcC*gxhhzU>8LkU(NckTruBKm;t^HhYm!g-?ULX;aPb%XZQHGnJYhsBC)~znM5MV>k{+qiovXZ z5#Imj>c77`^#G1P{#v=K3}30pOb=$4{$E@RV7hDwl~FjDCL3=J)vB?g$=9$*(>i|( zsTKea`5kOa?9hwE9pK-#BVYdk2MXQiN-wKQTyvSmW*L#6V#d3p&~!r5<0gj~45$Zr z)1)NZd*7Zby~@7pY{<5+;u#;niwud+IMlQ?_%=u8uuc`AOjS-$#q~Qj^LOOkqymN* z>x(QBdxGJ=7YF^s`n2JT#(>@R-DIx)4Ig5X^3YE#lt2yBrJ8Z`yWVH9=I$i1I95&S zKLWlIXd`WI5>=sb_Xg)QuNxZ3g6^-X@><@lOZb%Ay{G#D$3g1HJ-R=VROc!i z!;gze1rlBp#~TlPT)zDQhfSAYyX!2DA$LH!00U#gWSL6jmn*zl=4*V+_ALTaruvoY z`PY@WueZX#G?F%8idDrJBwog#y&Oamp3<~ z?1Zy^kimWn7XNQC2c|)*gSYOk1-wk8cqF1gbw^vB_bx*&eX2^+KZyK@mZ#FjzW$P# z-nV8}|H}r$*u2{ZO_&Wj~pv`s%|!ItNih(}6?vhS8-Y@A>%9LD~tbTc0$dcpPqQ zN|9sKN`D$YBUcT>Tb-CbO<`z-~84>7M1GjDYHqh+1NMx^nS zL2S4bM4}`dKY0Bm-Dq;Y;yw<>#=MCAI&%INu;QpR;I>nJcz-cHpoYO(eXjbD;!*B9 z{IL&u(&A7;eXQnxaEM^6HO!99uk+|{LnAZSvJp~M4fzBNOix@5mZlCT$$Fa=_{Il? zhr3+*^aGFYACHi)&sAZGAmDQ$fTg-H7~CNDY}DHT{D# zHG=Dx*N*QyRcFt8TT*MNl1@;ODqq~U_eAjQG^BavU)C*vPnk+w&F@^zZ88TRa6p<hyikzr&2~4rusR_{ z)(?t5@|Fcg)L!2Q|2A@dqk+~cW(d}pfs6I64pgCPbp~Y7q0$MGe;nK%v+erM>p|T7EVS;f{7xM4lu2tne z_$N6`bJsaUv|sU5H2`$#V#+7xsr&vuu8Mqf7fu$I*&lP@#A?{3{$~dT;=bUhdPdb- zEv^hCj5t^^UC&Kg?-9vA9;38vFe|h!hwJrBk`8zCzwUmx2Y*=Uz+zzjwX5~x!1DoF zN=~`r4xK-6mBBNHOsj=L4}wUABh9rE1;d&c7#w)+<%|*C-H=t1Eo6sl{)4o_9VTX< zs)^$x_X$#Zo?i$=+yY{d4c7g%$dcg*f* zZB<8p78RKJtypS#C0Hi<ia^Mk}3tlkpe?Ecp z{>j*zSaC&l=PJJ=HQ|4jS=fIou*j+OqC1QqRMKG;!A|>PZqNK0K*W^ zQddNGE-*TnpI8j5pr@m4#>jx}hYRR}_ULHw%t=aJP#8OFbc5==#0ajow_zQ|TWFoGuz1{thF?LA#zmxCa$CS^F|-L91? zPuWMi8O9@{Ih)f~%CM5dE6-H^IX!eq3#J3#sds%$OdWcFeyCnQw#UuQMJw-2$ky3A z81K@~hA=GfUy*lb>W(u;UZ9g&8=nG5Q1g>t=%bbEVw_o><-xRjqD7NWr^$<&jhTV( z1Kk0i+?A>YCHyBUJtc`Y$r6py2xmCJ^j6Fvj$B730Tk+Y7f%H2?07`9x(`KX&+B|0 zV2gE>Jq8okwK+erZVflCf3{I}gA9e4T|We)WoFfDa4r~ap8muF#}H1to=I+g;y#|9 zzVviO)#gRuqbu4HWrxQE=t!sKfIsGyvzdxk+bahj*L*6lm(efY5pBUa@~y`0L6){*rtlkGGpI14 zXjm4=>@xkpAdlg1LPM7v#L^-x*yw4LH(?v)_r!ptoTA`O4}tzZ9byIpKZ>0Nhrb{j*98{B9=1uaO>n%&*vCH5-K+qT6*-@< zC+rGIpI97>_P?NEIONsLVC`xWmp;*FWy)xT!q!qZ!Dyk{SO_E*Q#bQ%K0X8Vsd>rL zH3Q_KHW9@ykj-mC2`3mA4z0P)ePT0;cYC5*iEj(` zsG;vWjFvJ?=Rzq{LT9FrZnN3(q$tIbe0I%i!B8ilwZk4=-g9A8ISDIW8FH#V4ha)5 zH&jUG;?`%H2ls;D6v=Nz54Jy+mP*PEYtcC~%`6npUzBb#!I9(QqVK&*TpGD11tO^9 zi^N_+L}Eh(vW5P%{@qpq8sQd!q z>1}(#`RS?BL)(vyeIq`*<_vBj?hp1mRP|45+0@IG%Ap9%U6S%Sx!OnTp4FtGm`>ZS z7-zSynTGkvGfP3FqG31&b$m1LBl?x{WLsLI_<|zCb~x$p+^5=$*_B{+^Vq&7bqOi9 z9tJ97z~v@ef-b~*{Vo&M?(vBaL|!c@=C!5rH!+YHL}@+Su6#2Q((@B57z#h%eycLL z0wWylLSd95yX@#9DtXKwofp)b#m>Iy*SC>iC^)3&Kz5SObyxIy@FKM)VyW1hTYyFe zL7EOB^Wnl+3PFR0Ilm^en9F` z9Z3ks+gs?^gX@WN!~ph%ShIOWpdW~V<61flbmN_rjCpMS3|Fu-!yN}lp18C448W${Lwc~iwyy|-;)E|0iI`(l)qRQ-;@ zcnfHWrJTtrqp5|?ycxJEAK-;dh7>l=sU2@v4_k{cP@q>vsupH$aWrywZQ0h}%5bG)q%kE3?j(hIt}qiZ_0&eel+FUl}Q za%8^`Cwvk};_M0IZas&l15%Wb?>fl6^boxbBJj4nbY;-nSVwd+H}(OE5bay-`m3`W zN!R)gLiPubij_2n#WcP63iR}Jjct7)O1JBWdRHjIA?9HTQu}oMkpq2^?cRj4tQfmE zl(G+$FL*VAJNYLTRVp94*~?JEFQb`hKdAD@sg5x+a)5u=_>H|UgyAj(fV=cfpM-dq zr!3GbUG@Qa#r__0TBT+)g~nGI<+`O z`Xx)FCgc{!K@GC{Td#3DP!U7t8sqH3$ICDjLPczll~BVEvlCn+9T zsyy1tEc>ifBN*ivTZJrcUPZ?&^-h_f3XAT4^d&8FM#PugW?}%;%K2gD z{6eqj^i`x#Ri(}9hle0-!A1E8dOB26#AsvL3Flo)Ip~FI2GY;- z;(T}v*_0`D0ASpt`Ca?<$8x@95zpkQKA67r`uY>ARTqW~L_@3uI6XCz4E)-)6MZ6B zLSCoH7p>RJ{=|~+k@c^}jw%dmz`96N=ss25@#HHc(CPk(rAoRsrd$IXkG-cu(fQ`S zePWFkoeQ2g*tfk3E!phy)aWP)Q!To|eCDeo;W3ekx?Pz_(vCo9Xw*a)j>mEmPuW1W z?Wt@)EApoDZUk*w*8(Q z_c%KkUYP4D_KWZx2RmVu0xE2|4HfBw;zn|rH(+(rN}V<{zIjb+%c{yA!{1UUDm3t z3%>ai%dPcZd8OS7F|1DOOhK)=UAunIkOtn5@vLr5$g=UOJG$h=q>izoWd%zVbBm#i z5)i*@4}7FB!%mS#zpA%r%3x0My&JX)zpS5IbXdulaFp*FGq zbBEH4z;}TKc|8@k?+Jl~@A0ya=Vmdv%#2=Bl#FH0r>Cl-=~ldYbGRdp!8C5RAXlS_ zN?~k$1ISS8(ysa%#n;vcH3}=xWDxzkZw3tB`NUo1yk7-(k4l1hecScYv&&OhF~in) z=YRx^kB{g$^#DD*`f}PV2%b%yr*8a-6)$I$CTn=C+7E-B!-^ryS@lsDu#(#K0a}is zOJkhR77Y;^D5kPTlwcZZ&XW+0#wfTdAPH7}CO8q@Dw6h;Fy$tBn&E6ZIR!0Wbcf5i zr2p>G_C7J(M#MHHE;cb!U!pp72E1N#Ay&%SQpibd|AW(eo&S?+ZKunAUT$Wk>!IqN zOlm{l1ssLZh<`lOMS_@HC$DKxsX-aT2o$61q!D|-o=$b*H9(ltXz)qo%2VRTcZA;1j#o5W_gf&qyvm&!tpyxA4|o{r0^`rmEyQKATBLL&8eo zWXlKjpLfaSgTi=1>M-7UMsjYol|GC^$G1nkz(wd1)$#qkV^O8ls^afbWiVah`FYuL zcG92+i|gygeCq;74Ua^jzU;onE1Je^(BrCzXv}8u{cXy@&&OR=)?OyL8-lgrVR^G> zF6URtGp4KlBd@r)80)^Jvq2tx{8}6t&`R5jaj9fYS~iJOo2)8eVW>|49i0wUS#xr6 zh(UM)YA>YAUp1@iE$KnCM-+s?zUhf0I@b`TqwV3Uu@KMtl5_awehxr?Ld+MD=}|vv z#H!|9tZQvLsb~dwT{XshsB2(Aksh&Q-1uUPK_`k!lZ1o9N2B(d3x@1$5$D#VB+VhX zkOq@Y8Hvv8dz!9ro!v~UiGM5_zDg{}Gm9(geLq-xxOo5ky4Gn+NAo9E$@bwz1pbHs zP!ew|R^o}DB1)pl#NFB(B({r5z>4)n3T=A|p?X@}wqn5S?aQ#o{T_HyI>BVcvHzIQElw(NVN@Y9RGM@eB7G9$5*pj8 zDE~Uh3>%lG$Z*@}9*U$f3qb{lc&O@`(VKIX(dxmm#$AaUlKGD4kpIbe(;>}eeVY>R zs;tL2$@d?bQQq9>?9@g0pl4h^?6^YpP%hC*f?~``bkP6Al}Ici%j!_yu%9wETo{{( z3*U)?ZEDa!<5COZOX5Z*qdm4~I>A*^;uQ$yr^APTYh9Y z*jf!XLIN5fukM&R$7!vN>B!27b_UvmoUy~e+^M9^3^@e!9vRdz;_cSM%AU2HutoT> zFS`rX#9+xKHca*qW|tn!@*f6%|9=_pQ6b!pS;ahm5O8fx3@l&pURKP{@^9$$S9IZ( zKf!svE*?RRn%4Q%8p&bGEoS@^OS%EG2ZufCdtm6quWit0 zDgMX*QtNA4Z|p|=#5yOyYydq?!st&nE|^0wTnM3b-^E1mwNi0Fuy8!}>2JrUGe`Me z-8oXde5i~8N;(e>%kkYx`SpVtJ1N{hv3@KBVYUgaVP{;mlq_p+FVWj@bb65yPiC&c>{E`1oIOJMHdx-v(brV-ngC)vzQ|8Bzm(dH?#=lQOc@efK?oyOfA>H`ukG2lF*h_RHP{zfFs!0_GCKEq@;y1@639pfqgglSN(hLp|WrB(pC8Dzl+Q5ij2Em0YG_PRhCow%jZb?CY` zUToRw@uiC|!`D$CNn@EMPr8S0Us_V9^=UIQ8jH*)bbexiYQS7fG3ilHh;MUb1(R6L zk*z%_!+*0$N9!e%FJp~a-`}N1+ML!VZcYr(D|lMiToe^E6T3rQ-pIQoIZ$&bR~ahC zNiu;hh0r8vXr<4({Z+yti$fwVBDTaQDKLDC&hZ#EPX3R_&pCm(v|m0u`(3z?@6EgX`LG?K)`c zYR>YNcxXbs_f-+n*8oLulEhSbVrMMlZepD)LJ~W_608-xN@74T44J-J@Ye5xTP{~4 zn+>G#X>Fx3LEFsj@G@|Q!4^2r6wK?k_^jUU?!YRcNP(^MV+WxF9E_3oU869}kCTkF ztB7kR55Ku?NAMbKpAsP#Wmf01RFmo0Og>0Xo)y=eDAuwep0ecZeLqWR-*~M$r1t<` zLVjSjXy^PbWnJl=1 z1=C8D;szf-M|pl5JvDpoQcl&((KTWs z{Sy*rA(qv2<7aJCc#W%_KWUo!ueV6vgB$4?D1*FY^Iv_Mb_P^Il1zFM7KsDb-yi5}IoR>4+a-+p!Iubc#fdb^m+VxRal^@?0@uthI`=;*^u3$aB zT5KNdUDIjM;$(hRF|?Gz&f*onRvo(~U6aHszdB#TT=4Aq24A~jb|ZObIWCY@sm?d) z8g~E7Z?vr%Z(xT9Ea1`tA#7H9Jv_X#R2H?G-SEsiMTi&2%4}v9PWMcslnAF!m1N8d z)5Gy!kXr@N1(K0t?p^N6nX}XxwM-r3diymtORGgxSZB7#q&97qh=b3Bkm}{=UM=-; znsC<6eBw_m<}LT{*UwRiZOTF-J!{@(!l32RABO^@GAl`L@ZRTD&vEQP(;WEaM{iV> zfG7s_D71p)mu0_~BHw4^>jArmmE8;-#ZL}Us}(E;arekmzva%kI1_&Hpv{p;;~$!5 zj60OI7X@sQ5&4|(-0VtXqy;QVal~_AVMppMP@pZ%vKHoS$O;(G{fy`5+aV_|AH}B4 z&Fyhb$iFe{a*^4s+-dh9F7iv3{M64hd}6$?mjd%^h{MYW{yd-KG`j_e8Qe0=qwQp;_*(bw=|rdAPjfD|CS5Q* zo>4-C?2Fu@UR8#q{Gb_*5tbUJzij<_dMhP>wyA_TerGpQ-n65@XW(NzwlJBb^sL2r&#wSy1Osbt1yo(-@W(g zo!#n2$_YX|vM4HX(}TN1aSN~Iqdt-X7|%=`qrZOwGG5Y+Je{Oj4b~bV zQw1fW`yd=X9x8wkhMOL_14TW~@>BhsJ5&(?VhGS#?GG z*Y_7-d1*y%Ei-dgP-L?}pN^m_*-)e%vUvRS^Lu^)U6O70N4wUl_es5^P+VC{p1oE_ z^88741)l6l4z;ZXN$zV8YAYjKEIn+n1 zC+|5;@1^h%<79X#i0J~L0tFG(#RJ3^v6z5%*BbIX)ecGJ`Ho)+WU?m-bAkyWFQ(tpWJ@WD<9 zgm&%Z1ui@tJL1a;@$6@ooWU97C?1rtzm;0q~c_WZF1qfh+D3nFgthe-e`_b!(RDh=lS~{brFzpwI4;#`WAGx+WM~>7xkgi+92&KX z@2s>w+*y$7U0t~mvtXC=m#pebMP5X?>WR1f^XiHV47u8ZY1UIj8rB=u>oq$pW6QYC zn3$x9_D#3ifAm$_UZBmDe%BVvZCM-N#bDLUtGLs5Q}jb-3{}uAvEf}FYe|Rw>}$Zq z0(8_Umad{*2nFzgb61>iPR6$&VQsxvw&%^@BYCGfs;b&h1I)I&K$NHDG;hqon7g~q z%tiT&(De0N0jSOhfn5frQdsHO9w=wr2&4vr%QV1@EAr_o((Abj$e)-ld`TXO6*Cvg zpTCqGwyhjCeH?XHy5?~^yDgoS!)R!f&)K_k%hgWunVONEeM&xiYwWdWRrewbKolAu zBb$2i&U23n0+Y;_KtPy`O%tg%Ua3 zS8?n&g|@)&H+*whqgq7uP2zh9D5bgA=e|(xiW_*GtJUmfqG^VuMu}EXJYJkRID=Nj z?n8QiWXU`v&mB(G7btFsTG-Dzo!@rI4qDz-ZHqdCh+utcSzsCXF_YXoYcSh`ENoP7 zT@^&+ZzlJBhk8+FxTD;6oy2Lc__eFOH`=*ch!bP#?jVW+Opzqw)RUDv`ARsI z#I3ij)}j9@DMzolFuNdYW?qh~fPMB`qAZn$6E>I3ZPN!T4SVi$wWi#$aU>k(q_l z+pZo>B2B+`GwX$i6P#59zPjNcQPqi(%UsUhOlWEQJ%c-T`cEzGd*6nd+yT5(*yR~# zo$ly&p3D#4n~$!WHLsh>QGI|{-=m|<1QHPzJW<@`hhA~Iwxw{@4Le_nzOEWIt0yBJ zHBuFWzIuZFOia4#26=_45e~)Un^MBm+DWKh^>O~$x~_T}uSj<_Rcnr+h4u$wD_T!o zJ*9~9s~uO}dq1qZklF87dfz-848Jh0E*m@6jRLq8bATAD!c4xVnLn!>S&0o(**U?w zF<>=)$um@WfxA;grCnL^jV+M#xNd5ML?cG`MW0vs}Y0=1(hCE&k61};yctTQM5PO`%nF=4x3(ko*){m^3oCkS0 z`%X$je7Gj}s{)U@oY+ZfJ~E`LSqli^f**w=o>36d2`Wcc@FwTu-f|xR;x|c%jir^3 zEKPDu5Qrcawsfl$O6t4gF)|#X#3Z|X%~l<{9iROnb*uLx4dsP$RjJ@UNkgf5nEI>da*w;d2=`RqR&j5B z{`gRrZOTYR4&QiEnRel%7DMpZI~LIrlM~{L+1)IL&yVhVk3)n(q8*7T5$+i>u0YD- z2Ig7D+6nGVXgJ}sanq_V4@CG|#9_4@Nr8-(TrVk&JG!g%z$?l(fgl0S%*4?*^-5hP zk>5V#u~!whFR1peinX0!e`T+k5M#&z&iH4|BkN*zgUeq)M>}oX0e0MY)!{Gh;;d^7 zd1xD7vcc|ixDInRAOJ?Thnx>JY5`81kH1#F2@-rc+p##DUn=}KG;u_rlvk$!r+*c4 z-B1aj=!xa!y_%ckoLntYDKTnnxbOKA-H?a=L?zGZ#s5$zNi9w_YGDfjv`S~iO6_|J zaEh~jbu0ekoCnESo|y8ovg;e<{6LObRwkt)e5TVnsl*;whk ztq*Is>jMrW3s?&nEZq6-D&%UYtlalOMlDCQP4u)8R@h?ITDvp*{E86fStHYC8MfF} z(H%T%G*xS8Ojyi%V*6qI;QAFu&%@CzqJ{Q&(b6np+SupvNsCga9*GWAgPKtUt0DJ` zidOYpLph^e*O~24pznXcabiH{y}ZDo9w}dtX7Q8yB>P)(ZpJ*>vPI}yZs|^(PK_u^ zdF|2>MTUfU61tJ>?2(%jx`M3!ybr%X{1^s7MwN_9`dYcTun8Jhp;x-=ydGU2G3n*0 zJM2+bs7(^LWYlWIMq9N|DNkxp7Y>YS)0_xUXvEpPkdQ#Xh0Io2HwAsy;I0s<)T&b{ zukKA53_J+UCY^Th#+)HYro<#=Go?X-u4EwvXhJmEo=FY)NnjCmVK5Lw$RIt5b6CPy2HBXWnPJbnKpU;TX}kae40>ct-Qs5+@>ieAsh2 zc~iTNsIIbFw0BovOSvlcL5Gsm-k@IkroCL-_^gduNL>Si@(fGACyn=nJulfc-R)J9 zT;c8Cd_t_lmWVOUJJ4OwWadc6wAM4*(I0g1j2&clrT@s6x#W*v$JS>4cMb1GtgSwu zE-c{>9mT)PvYSn?Vtz`%J+FbZ#s&$X2Bn8GOS;*@3%wY0%D zxs)Qg$qNzENi*-=BKL*VEgl|oqla0cZ=4K-oCA9=KkoIH>-|8sxA$O^!_)Ov*m0qa z&emwT&$z5nPArRv*4U-qtvyhMXkIx%RW@htU~J+ly<=}09pFH+N7?&GF^f zjjs$EYzylz&g2K3bFHCY`X~#e=As7Sd)ojJBqlHUTDlg*d3Eg-ChTayd^$M{HA52i z9i50v%xecdu9>=e8w5v=-?TtpvOZ_r+k&ASYUne)!uG}r(Uq$fdcLEmD*acpwU!j4`{KyOaYLzCt=)Mm^q%3)kpl)aW*+iT@GZLH8< zw_fojOPuqOl;57-C4#0_$ha|e?pk&`Te(_M$JQ&yf`ZK;#uwaTm@X2TGI3&^h`uC~ z6_7(6Yuk6=ds$bn-s+j70PH(6ra@q${>>|Cs2I558Tt+eWd=2r-|rC~FDb=JW=K!xZzj|jmSEprgJfJdKTkNx0(eJ7U2^Kanr^G_4*otQ2O|WRB`tV35<7)m>_Pgm0HK1RS8~PtIacu>7&H- zkOvniI+wwn?%t!#AUyt)%No1(3;B?%8L3XD3@06lCahIYQiLRa(BV3Kds{fP4E|ge zk;_0_wLo`_Lc+fvL{!SyPvy#zdNvDc!p_^|yvhH{_r((|*cb@swfAbH-XfyFn#;(7Xa9z)F+yKMNnQ`Tf(f>d zm&)+c%H4{M;n@vY-BDkmUxkl!S2Ia`T1Q_J(hMAwO<_7cYq4Ip)oC(s{o%k^gSQ89 zc?oHA7ZP?kLM5hOJ~PB|#4%D^sUjYkqo6b!;_FPG>~!3XR?syaSe+knB8UXsI5v4O zY?xGH&R1>7EHi0V_|*$BKERF`{Qx%i}NuLe9CLTWCG8~G^y8FAW!X1e#dCyu6r_`1&4rCHRt3x4TBoG`e&Y`#52 zU;(qaZ3H-I`1c9+OVgxuuU!E@;o}psp?$5-DFEu1mxg?#k6_;xpYeBNE;M0C2$$A< zq{Gs{WVBmD1{c6d3ZjH|tziR-(59af{Bin^^pkz8mVaRT!^8{O-#ABf;|q*)y^B2b((h;1U(-9Q94=F$!#bpuSpe3#l%K9J=Uw2X&-z=h z+-oKl?rpyBss~6GpY3Kbj9t8N0C~D!0}Z^m?yk0=pGu|B9gz#h@2lpY<42yT<$gwjK;`;a22aKAxU4t*bjwI0UIo^u+w23-CaHbHr}y528v! zn(V=C-@7zFmRrn9A4bk+8D#3p@3nV_vuFOi zAG-f^@DDS0=iVtg8G5HY|2_#mcoXewYKpSlrCEG^Eo7%Sokgc!(vhs&4PG`Qmixp`9b$|4@%nq@Bnbx7@IRvZwq|mF=>n!)~ z>!w?>-tCo+K$rTgOWk4GB<7P2{dc zC~0pC*m6C8>86pa6B#I5)gD1EjyVE{ENnYK!Sz9Wy~&cKcx5 zH@kVYc0P!luN^w%eQ5{&vJyBov9wJ!6WtbG@rR*oV)ZXw68m0W`QJ0$e+hJ1GV6<$ zpP>T^4S$9fY``7-xZmYx{Ndqa~GfNpm1n$>1Lyt^YQX)=?C_`creANLaquir^L)K^h z>4IU;NT9@9fe9Not-7m!WWBr3!y_{ec>7!+oJ42o3@9DakO%Xhe-r-yh6hiD-pad+ zIgV&K+VnoqYN7T0prbsy#xZ1t$aUFU_(8WrC|unHf{Vrvx@I#vBLm~@2;?FV4oGK{ ztAWU)MLOP7{q^Wyfc#n^e~Zb$pukShnFQ!2-n9Iu1(szY@EyIY>WOzw8n4nX%NA7s Rt;*&9OQik}T~GcP{|AW)TOj}d literal 0 HcmV?d00001 diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/images/infoblox.png b/Solutions/Infoblox Cloud Data Connector/Playbooks/images/infoblox.png new file mode 100644 index 0000000000000000000000000000000000000000..de860ad91de294cef5c7c5bc0d452c0986209e3a GIT binary patch literal 15597 zcmVPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!~g&e!~vBn4jTXfJc3C?K~#8N?VSgF zQ&k(rpL8W@+BE5I*~`TSWeF+@%5tC}e2Sugh-^euK#(b*$P@=4qNq$4G6h9M6p*FJ zrj*^?q)nT&O~?1XC%4Rwd(#99@X!&;7QfT?7PMz8~crX?|IxQ8h`4m#J2(w7% zW?JyS?oZ+CrAwty4>uE~*7>v>?#IrwBP6~NQV7EdheTMdM_jHIt#=N^rlg&YT^_Ds z?gt;EXOHg4^9zKLEVe*>kgP30Z-9n2UvGa_9qDQ}7y0y$(HTP#7-T3i9Q5xg&}~92w~{?Lb4hMylVRG5LsHVY6ESZE3>z|3wE6n@ z${X$A!GnielZyhp!*mG0CH@BJD$-xhh;Jbz!kRFg%{Ymb30tMGTZ3;`uSLH;FG8a? zdfI$Fc<@jv7X`SPu{P>Q+y`WwA>nYg*Odi_E@_KLrNA2K8U3&$_!i)Ywd>KX%hON? zg+rs$dBoR)2M?ukQGoS6I_z&TAGL!U0$I*_de41xfpEZf4GzhyHzgLmLzUjlcE^;Vg;5@xVMKS>^3r^yWpI$_w@!8|-$w zINpN?4>u3j2(a4A7n|>yj@z^qNrY1=gbyi6R0_p64&mN@__6t?sOit0csDpHB3N;TNZY4@mR^&gn4?ZLo$WAH7x>J!rn^2pqtf+FK>AJQ1mIX zd;x2Q1r6#q!1U?wN+BLRc(_$5Re+f_jo-n&h6WBxm`~w0->hVWc=_S`d)`OAThJe{ zmx{+GC?B1Wn`6hlty;nuq?bZGc<^wmB1?cHH6d8tcrtDar~zc27o#1FDsOCR{xNRT zRg#YKAd3PO!aW^o9z1v;WC<`6>}SBy`<9@l;da#124m-a%g|6?OWNx}Hf%I2Y_{;= z!NbjoYymFhNXswq*8|_9mM&Tf`ETJhw$7Y8j}tMmI2n5y=CpKaPx+-h$#06ujB^*_ z5EFX}r%sk?Gj!L6B+7LVRKpVkteG zq;wG%p8!inhP2m%D^a{Ea(Q6=Pn+@mx8K5+nNFf{mP9ub**UrJR(T;fI1mvLA<$}c zxU*gZjC}o7(O&CnP8>gpd)u@_24!C1Zc--ZR1?OH9f`L`zafQOUzRLeiEUf9Alqg^ zT6#JX5>sKbWg|P=4lgei0t2)NGUyQ&Y(Rd23Qb$JM)#*XBO=rZ?|3peOND3UDm9@q zguvHNhVvpyt|}iNn9j#w-iM!{|0{i^9mTVK$1bc`u?ptoI8nf)B%6_G%|>o+F0@)T z0s{RJ6%i^H%dAxG4zUDKy*jm}vt37($~BObnFY0i^kT83p-aa$ShjqH6ykbz?b(a( zSFgkQ*yFJ0<~Rh`Vxx4CgM$2gM;rxc5FQ>%ziSZ^Q3>rHX^ThNw3e>m!C4dw@Ldg? zA}=c)pDq3zEt)owLa*iB_vc{d^r`UmVeykEfGH^{NJvgW08eTtg6}Aiyx5}~to8!% z#4wewkC@Ql#WTj}EeeEvQy^9y&Zo=;66MffHEyq6AIp|5L&XZNYkQ3$i@U{xEWjCx z1$aCO@Yw4p!0R?_#@la?!CA^+iK$kKA#c!!fj0@R7tgq(ijdw*`dL6}f>Q>^5#=qaB2i(LkB}fTa_+tlOBQ~B3Q@|(skdy|5+`Gh!^cON z*Fdp)inkWOZ2k$gYSoZJ%f_gYZ(_lM1)_ja3Twc7@4b)SeR@kF@{!#H!Bb(IH*1B% z`*-2kk)t@Uzxd^c*qU1V!z#q5Wy54w!<6G&>Xw%42Wy@hkrl5UQL%2rPY5!G;K|23 zB3~CynKc}SurRXJj8rlQ!k+|NtMiAyPDfh+^!gwefx_{%j=HmD8BqD?l}ImBK`sq7^tT>)WZ-;@f;q8Tt6c+p~key z)bhWba?(~_MGIbhkUiu>MSJGy- z`@xi{!mDqNquOMmbVd2dvVc>_YU|yr7k>C*HG(VFK|eER8p^y*c#;%DdB(Wzqx zY~8t!5__Pmgv$xtVzHoRt?D?kZeg(tmBer?d{$F4`$7H55DZLq0q59U6UDQ1a50iDoQ5`}68tr4 z$HI(`j($^ZJ zNnEwaFk-<0%3GGy6y(}WXwaxBUh2~e&-M5p6?TE*nBr*H z>2YjayB5aiDh|t9CgMryzUH`CyfNx+OeMp>S-20N`MvieF3CiNj_%@n$$_JcYfcub zxzC+F0|N)VEbWm`sREo!mT%{$x?s(Z8=#Mf5)p2WqfGwk0=!s^0O!y-EWp2#<;emp z7Z%`JB*2GBfOAPO-gsjqX1qTgT0R5ef%IakBya&twdB?H;%X=qQ+w`B1GgoGBK znVx;NC%*pr3&4k}B^1$Dpz=Y0(MZ)NjGZh|ws5OQUAAyHjw~`LJ7H*G^s!$m! zZ#4pff<%1Ff{){Gl9dI2GAUNC{T}x=cg`Aq`IP~f|M4OOMMOB2R?JB$c<6!V`01w& z^hnCjFSQAxapSv5eAhuwRabX(W?fBTBup4LfyDQH1cp_Hn#K2O0aOTIm#rbTiUPyK zv3~6u+})&ww6|z1=^22p9>J7o4G~vubPZ?3mkHqN{ngjIY%|ivO$AJHiaf7$ua6#w z_MJN8cWQ~Q(E7*P?s|2~XP?K@%Nr=N>`<(VD3_MpWB z4`bn?CGgc~McN|iC0jziwJ8gVCvG<5^k$^ArwuS*{ZGH5&BGnAVcmM^pljip#8j$5 z*{!K$v?*A6pT7&;Ppi=&HQj=DCcYyKMWr10_Xvsae5x%Om8TU-V+AU2c;#F1$%6S# zi7!*409UJ875^MK0Aq!!!t!-DTmpuLhGN;$m6$kbA_-+B(P<*A&oX8vrZAGd>0OM` z6>%yy22s()H{uI{Ev%-A1a{?C7K*yw#f?8M{bacLqa;iw6WTu93Gcl#9zOnoFd7X~ zRPp&`kFz4-8?eaH#_jKh$cotZ`%b9UYV6wkw{(yjkqo6~E$+elGiT%7sgs}!4X0;O zR)v%cryKqr{M!29P-GPNP&NAn3>-Q_I->mX@y8#ddDAAaWLja2iiR&Q;V;EaSqrA3 zD7+@eKj#}`SQs<`fug24{IwBOI2SFD!-oyVlTUR+W@?fYA`|{5bg!V$5Ug9j8dImw zk#@*~t>?b|2her6!&M`N%11@{GA%9!%T|7i8r7;up~@*zRjrwsXwm#$oH`wk;OOco z$h|(kXt^yl-D1V4@spql47=2}>V^cv87ersGUDUT;GuRMVb3kuD&Pcm^;Q;&x?bU? zgbp1$V)Lf8R70r>HCd&X1jzMqb_G{FXFd$k6`)cZ@X&*8@!j`pq;NMt_Z5Ycw-$@P zT8`IV9SVI!W%&AVT5-Mj7IN{sQ2gq+(>J&R=FOgt+4DYjgqI`c%$bXULx#go9|l8^ zUes8wH+)YPHeE;ss>#m5fPq6rdwNlfA3p|_t5ia!6XUT}WQDRX?s4PC;lhPDDYSGx z`+Ny@{Jx!PHQ|@#8F{deZd2TO)N9lNU7vbP3U!Wa1lU56@KD=_@#l^`2#Sn$R96&= zg0rwSb@=cRTu4Z~F3b9GwTaure%Z7MtG-#~2)u#l+O-RI{P`CQQPsFf?7xNL(hzKf zH76H+`}P+jSKLPd4B?TOJNFaHKvm#H8RB}v8CIhv%gGRhH-^8C?^myt_WbvJx@Zwz zd;N9zX!T+QgAkYNlz*>4+_ON8t=5HvW8s32@XCN8j(t~Ar*>_;(5n~hq&-T-knh31 zxbq5B=+vo`6jn0FPn^Vz8MEN63vj|rQNfy#hRDbee6#!uDa?7UNx4m$Hl<9xONcMG z7hO--%Ft-kqHX7T!JP-1zz{t1TwkQ$0JG={88&1vR(-dY#J95B3o5yA=FtZkkZel9 z;DLig53}2#d$HgvtueR?F1)o`4f3ce`u6CNNF<}-zvlFrGw9R1H+*%D2@_ORkoNqC z(05`H=H|pt=YNRh%U4P}u4MdMZ=zMJdytlttoWPqw+If8z`lKZG4GRwQfTpfzUVWY zIDQ;~0rCe36vCs4vMm<8*!v~atXcLk$QK2e&G$x)?#7Wr2N6=SDv9rZ^YQ+R3?-Hl zvS*=Jzd=$+`DWy(w=j#UnL%NZq=Blcq^nZtgO&Aw85eHX4%)scg6MG$j@80 zV(OIlC;?R{(-*oJpT*#Gyiy|NJ_BQPbsYG6FGi1@Ano|?DDquOd4D-@#^(;&fUsz6 z+PDrstod)6BC>L_(Ytpa%FQ~cNqimeBMtCD0<=p zC%((KvU2tHF5j-;s&CP=&j5N@4J82iV@a=p?jhn+blOqE%FY%(EiyB$RK?1t=%szq z=!}(b@M?98Q8+fevshE?P zGG&?+awS6t4@CQpkHV4|@6^2lf&#I9`=6MiFc>Xz=>l=V4wn%<4Fk|J6WbA zywbN9T0cy3ObKg^r;z7%@>;9--w^vb5V)09RWX(m1K3^J0>(mS8Nn0DBEo``b^XT+FC zWds^RMCZ(c#a~IG*9V(56QkZ53!gwEy@zw(is3lOu-Y7XjK6)-S@`<;h>mfaDHZ1U zSP_q=q~t5CQ)l8!7ZQPab3ekFQ)i@*E1B}nJBWx3MwX58pF+4WPv*)Ey z;9PtnCQlv*U07u@GLCV`)^*1rgj$Kf)wZ?7*=YF&hb#AK)b8-R+24^NpgwA9l7K|W0cI^2F z2mU=I!m8YU2dPyCCBAsdya^XKOJbsE3u6BmN)sTLyjeCYT_fp=YhJk}l3+LzPlI}O z#m|$mv6wJzCVX@uR|tk|=p24tb4n7ttf}bI?Mdw1wMVpD+HEOFCs9hLOvl!6JSEn- zAI(SgC_QDyGeV@4z9%PIK1Xj1!HShDG5^zREfROYPido!Yf6ZRI>(H@1BYSnzJ0J{ zSYV~v9$Rynv_FH=(CRfCQ2)-`k!4Pz^phgu!kO{z{H|Pc)P+^U>qB0VLaz^f`VXOR znu-813(>iBZ#J2cks6OMV-S|F`VOg-ws}&GHTk?KpmTFGgf+Z-@84+kKnvt&q`*vR zl&xfrFQsY2&yT9_zFIVE{fHEDCH3po!MKT&U^7$RcjEf&v*O&zBN#N`QlHK%FTI5H zEFM?yxSkU0nupKX(-U#x#4#zvb*MrrR4-7J@aVzaH5K_HbdPMxEH+a-`t|FFNmPw3 zZ94AvYu01J*s<8R?;jYVDpJZ)-Z{ndy0a)_ezW3BJld(f2>WXJD&9fWb;-J*w7|_3 zNn{C(nK+e7#!S)6E0^?)4D{&M1y4TyC~R59l<;(q3@TtAeDFS0ui_ZwJ!kGb3>i8C zh6wI>Q<~9KNJ~qFD#wmjhrNPv<0nDqFK?vDmrGY*#*FFMw|hVITuV|aQ1mU+Qj_se z>-+KJ539(^zOwC1@l@oJ5NY!qs@15DJ}>pcs5f4hc9aZvqP;);J$$ib8T|YM;Lkn` z6vna0)D$;qWH5X%cMkgZ>m%*CgsZ0_vjF;%kg0=0q17mFlgy)6v?QFvz4y1on=R;*FLvsB8H z0B2L_%k%E%&7Fzq8Zk`%h>JL~z@O~W4ZHRqguWC9Cq-e7zkr5~ z8ernY@#xs0ofImcOsampGH@uCe6|2Vk=01fm1Q>Ju!O4r2M!)WoxARoLLInDfVuOO zt@z%QCda-#4wWlYA*_&Xziq{R4|OCV^@SlcSTrpt#Z1=Yqir9;>L0(6LN4KI0iG~v z3f>+wh768MqR^HL3mH4ivZkEFN~)c7dh9VO7?t-a{JeP++O+KeFSS4P!6AwYEq(@` z%<$q1&tnm#tD-QQ%?OLA3@<+obb$e~MV^miJx)J6@#b4^BP~9b z^18Bk6;_9r4pXMhkV0HbF4a(k`1T!ug`X~TN_?4C_uY@ZyZ?Yz?L+A&#gTp#hzi3_ zqxK&@hQALSltSDC8#%vj{arYU;{JcR0?hAZqx8q(yKem^bm`K?De+|!igppp?nB4CJq9@$Ns4?u@N;lepH8pG>2v20>y-G? zdr-Q~&q&7WZ@%dk@ny=L0CT58X1;WI~ zs>y=+`U}@Pu;GlBk(z`-!(PL}Pd<=Bou^^_df2yjCqfK5WLhku?Ocfn`;wTQjX8mX z2mX~p+`})wY{B*&e<9FlbbJe$2{Manmsz$9to~sw+P7;Xg*s28M)j%Yuo)4dVZt%F z<3UP~FMj3#s?Eh7I*i}9UF!J0nz5rspnLZou%wy_eJ{zPP=t9xipB}cSEcfS`FsqX z>(viE{#SBsxGa<#0WQqY_N**)ezX&Usq}Lec1_o+`8{N5DjU#Uh~jomH^ObfF-MM4 zY3wBum0Y+P2iZ1!{^`dE2+&EPW#^+gGx5;F9mzsWmTPngL_0Yp>K!|GOChd-*K=#p zycs6FJz5GWJGa%Wj(H!tP96m42oD5AsD8BggBPrB9lq(B3pFW%+zz;oNctHwr4jwH1a677Q=jNh-KY{`a zro6!mNA5Xz6n+}{zA?Bkv!z?`#M52Tuu&r^)OCy*^#+WFK-hES7jO>Ga(1j=U%Y!l zW$>736@2rvF>3UiVhXe?>Du*4bm`U|X>n)7P`p9|p)@%2dQoAsb^8vtEo8~p{bSc& zsJP>epG&6Du(O+L)vBWZ0A)>ka_IHKb7=eE17Z{p8!&R?%iGrnf9?7U$tfvP$h9C!S0UZ--iF=f(NDa5rjzPllsHE#i{O@0%P!y56%xidwN{Zx*M?r%k8R5Uua zlh=E%l=r6bWPw~^)hV&2Sb$C*KPm*n9hgmNIQ-86x{ovoNe=Y09u|Q#vikYT?i6CH*^EaXc?8|4 z5Oz1^Mu7Q)Wm6T#%h!ovYek?941|x`-?1c(g3MFiNHaSu18)U`?5!3Ho_@9mYE^g5 zf`wNTpbNmD0WZNj%O<~u!N;hzIC|>r6_ZPxfioXhz3u4<*u2SA7WK7Mtx^eX+CKqv z+yzNcmxt=@}veIs!|Ug5#aGN?)@Gb8x;`igPWJkzQy@cq(LQc?ZRhEj<8h^$Zv-nvlaC>T*A z3W&UXoWF2sDy%DsPfQS^CD#wK5X1a@+*z-_6yiQQKkD#+$IXdy;6j8Q=OiV_TM^@p z*M_0fiHzyaB zBEnI{&6WkF95#Gh5!TyyLMDSQG|-2f_7F` z&T)>w5@4UOxn#Lbf{K=#=}@C@UTT zF6Zd=fmB6PkZ~w?^5lf{boVc>WES@z>zoBjhS(I473QP%gIeR<)K>xDMpB;h=jAWL z=qwqT8OY4Ckw)-)N`a*y^qS&B>C|z#_-nQBVy|9O(?V%D3Idhza_4U15)-K~dvm(eN$j{ui*LXE+qiY6EC z=sFXZfY{Tgr4aYPlL1ciDzrZGhw5<0jK59;ot9lEmIW3b4gT1*%kifhiBCvGa;ll) zRsNV;&d}UEU@*F;I_s~~NnX8_3GknL_BaCE$iM#_5@j;`A(4Y*QFAsDCTqisNT+XRm_YV4>-BxmfEMDh}9(Lxm?5oAlhC~Sw zlM8oFvhyKld^gL1J$z{mMlt1AE^00)v&~q!qUdGeUBQy2%aIr#Cz?p)6v_;*9T=k5 zqM8f=?$)h4DV7#$U-`Z{l)~-n=9C0{^kLC!L%JG|0GD%k=#W05DzdEd*T>?{A8v0Q zF>;I);#&6o^Dlnewp|E;TpSrD4`ESd9}30RG+$325`wK;{}7(R+`&8VI@YrD*QgZ> za8%{W@G0vGAH@)42*MqA)|M~8;@R2%Za6;sayep8opOY`5N;0n>dR&Har_jmI*~)~ zpfQFxM7sp$FZ=>)e%y>8szGtuE^EhIaqv}j^gK(KF2yJF7dZmmh)00SIrZw+LF;A> zkYi1kZ)p<#lu5r?{uO@t?RP1}HSpSCue~-LX=!F?H1aK3UX7SDXRn?;q>!@1gZQ)Z z3h?s4VU#IdYY}bVxeJpg@M;s)h2wp>8J>kYKi7^n58e-hK1d36Eo@mo()vDbROc}O z6jI8&^RrX@1Ox^MU&Z4mPDQTF_G7tBpEZwaU29;BjF4AYNyp^p*wOZ()~FB_F8(fx zeS7y};-pDbfCMPX0#4)S<4gAnLBE%KBhyVD?F#V-a5=}v#~ZcoxQi03w<3`dL!kT& z=+k!~jvhNMg_fN+-x!5me{Lu1GhC5X$j@epn*&{FMcK2k z3bB*r{8;DC(qFEF3n*`2HCc6&@#U9aN}*-rxgI_7&)@%2RbTlqGPah3Lc^No=hIA{n0LMu5|w@_gHiX-zfF?z&s@wcndl4X>g z?~Ui4>xspS%eL&%-Hq?T>eU;d506xw;Td-O*s^h5v}(~@3ULqI{BjQoF!Hh$)kGK} zlvHpHA2t}TzWJ6Es+_;}|4lWTyKpS_92HhZMFu~|t=*D}`gLmK_S)MjrhR%o9%-Qt49Aq zAXTe#a?s$Orj9^2^Uman^uG!=s-`Q2d;9eiUo)poM$MXcV)x#CvI}TVKhN~+izW>l zz|Rmt>5IfyVOiyHC#u5RB`hWNbob}!o3%*SrY>X55e*k-{L5*pLUfuGhWqt=kC4uXx==uy#GOT z>)I7sBZ*05nCP%lim>R&+6vOarR&p`#w&vdB0G(p_A69Cg1;w!*OTWj;GV{f(D|vZ zSiXE2e*67ToIQJ93^(L-k&u{#eSaUo@|E9W=&)B|435OoFBZW-Rdltlk5u?5fbN@N zHlaDy66#T!E{atvS7OyS%f$E0&9#g8RYF>P99lo}C~DWPjeD9lL$_{SktsFTD0yB! z)({?z_3PGP=IpXB`g%30(26w*a&qiqwu~(31)xtP{si;@&px zL?ZQ5Fz4T#YQng&Bk}g=H>42x%$@fU1`q5HLu6GcL?M*!czrXgH3L~@_P^?fYE>&E zJi-8-zfKJANlZ#b%$WpaXHcg0(THI`UUZ^ULw`7}Bqid3mQC@?mY<81h_mO;qjHs+ z&>2F6!}hYnz5%?2wUd#OAguM8wQ8YSl_&%R1PaTD-Pj~2r{Le?XJAS=123%sfn0@F zDkKt|NqGih>iHN9AMqxpzdJ?Rb0t+O*FaJxrAGzn#bQZAmyT_)Z21Z)5Qbo55WFe9@Cqj96H*a(?i@!R{EcBy z^Uyr52{{4lgEb`{f9%|W=1uOFLN5_>@+4ZdYK>%zjr2qQ6y-vAacp z3(kbZWK^tB5q?2oWC$o&%1I)dG}4xO0q4)3qZ+B}yvlhj;2VfR171N$SQJ$OP0GcP zp;Oo+mPVt6F{%mz!@?17O2fWGC$Vk!0c_v56-)xT2*rMt5#S;`0(^t<^X5%J7WeErx8P%;jtZ-d zL`tpI!k;WBo!A1Q@%O*zc!m=*1Gr|#ejNDy z^!gyNda^!H4}Y?T{nR{;nMA=!ORf-(OKZwme7@u>DdhSxY}gPy+4)JNlQqoF;Q4u+ zK@_y~lc$$!sYc{T69K}qR%cI_{rpb8XCY}xiD=#WVRY~2zG=~=@$UQYqe_KPSkg?QnaLRumJ?rm zj5FfP;+>tFi(IP}?@pbDu#juleoVJm@O;l+@YP3%nwL_93+!wwrcRy!|6(QyeYW6Z z1V>bYB|S~~cc=I82{d5gqR;Tx?vg#reZFKVp6c?Hs0F^%r#Je({IVz{d6Z7)uHBK4 zkRXop2=EQa;6a1Y5;Elg?x|caml@A-qBbEMD}96ms)ov)K@+55!wzM_<>a zY_6t8wW>lGax+b0+B%D{TT5pJuwZk)rZwp-X3U<6Hfx zh;X@pGMY8h0xwG33qP5M2KDMnJKO^|!zi`JTuFh-2ia)}cxU1`JovzUQs{q2n+IEC z^w4%RF3=P3|tCnK_-fOL3E|3?@pO1lq2B2ljmUy_+lQ%)g&&IdE$hdh{4 zO+pB-H=GW+6Us(~^3c~_$MkoLc5=@CfalKr0BLC^#Z#FX_KBRCl7Okx-c{r@|MuH! zVcdj?$TG!=z7!>}h3>}_lDz%Vy7iUKDeP~#`t5fhpm4Pg66>wow&T#@Bbf8yeB9U4 zF+;M$BM;#$S;ig#zQNH4=&)+#SCr|7BAYB8lgUH^CEp#O^RN*5Aj_HsOX4{+ZPF0y z*8PA7@4r{t??xm+S-0*dto?okp6L7((i6{KbkFFXHt_;@`S_Ahq)`<=4HL$V#jIJg zqO25hN^zt!Eo7~F1x=oT>kt_fy#^S za}rr;$rw2JRczY07WcPmA?;O8;nlB>vuieSkT?{%QYXstrC;Nj9zDq_JqsIIr(8uW zgwJt?tIsQdH&V}^fVaw&>R4lg#pc@8|QI#=yV-#AnAT%zLP+8}S@nsToz zj`gCF#rXtrIUGsi-3qUL_5F(298+!OO;zN%>0}cren-Y#?X^9+bwxtLX^eQ|Eof9( zFefJ<%Vrh#r*w7)0OOal-dakms$5y`{Ao4pW(C5zk-+DhSd0Y@tpiE`FN(Zcji5pA0y7=_sz+H z*~IUA7SBHW9OBO$!Jz&xi({0+*H)C*MB3u#zpNltNX?qnv18k2Y}l|74eHm0nF?pN z;_dbvy6m;_BfWmHTpdUJjO+o9XR(?toIylL2tNP(3!FN-AGK>2JJ9I*aPLGT5v17+z(wH}(QU`?> z*y#i>Z+X)r#Wc^1M11t|N9gx*(bIJ~GTXFy2*3RNJA7nLMdlA_&qzh}yBZ+oVA)r1 z-Lvm+G{5g5*t4_Xqt_#3DZ%r9n#~ z7Jsn>J)gVMU+ckxhw$F?8CbjFCnQrL;j1%H^)`?`Ex!-FZ!v`*r$7Gwyya09(wdPb zhI9oQqwwH;O~v@sCp$Zz(V5`TaG26EL}ycR@qRguJYm9Pk9NQht5-{*&cki8OP8<0 z;>Dj~@85@zWii1=s~6ROFK*N1XDTU86vh#y2|mV}o{k)fBbBcf4eQ>4&QEp0OTAx2 zgbZu+uRZ(FC_@jX!P1#7Pq|dekV?u2UD4D_)wq92XZ)HPtV$>E|u@@rUoA znmzZ!g7Fh4K^JHw3$V0A;mC~95n*Jye~h|yiyvmRY}qml8!<*qYn9WnX(!7!pQ;mI zeYM0TLwd5PDmrHDcriOk>(3dm^aO9qwxix%)iG!04BUBV$)z_lX3SU;xkbWnZ0Xlm ziB7UQw^hZA88c9ytdZ+M%*j~%v}vpO#Sx?tM@A3PeJMquHzc6;G}o;i)H|l)}pn zkB<2Hmu)z5a6jgM_7zSZ`&ZgScn6RuYlZ(5jvr1Jxl}#RvhySgilf{#=|CVfvMTyK z-wpK|-Ho;+JiOwyT+HS)3>Y{F>o;wKUe8mGOV6K-s9Dpo_cW}7!9#}NzE-a3bJ(~4 zAAI=19Q?3ht5~95j$Ra!O}bJ0w(3-{eTs^bALwnrZb8?c{m`b>J$Rx^cT}tpi9i4N z6Khs~hd{jn6G?OH*13zPz!wyxn#_)MoMa?^?rm0+#iy0Auwq(TI=u*8RK|5V^K*}; z!Qk3uTuk(#y+w6F3Mc`7H(q8(NoGr>(vvf@9Jt4qotUry{1>F8nuIsCJ^S}z`}SQp zc;pCK^5-ayOrpTzC<+Y?MHE>u>=dbSgZgCUJ}i2d4Mw9&M5s78LprLKQa}mtcj7n{ z3r&^+fBy_iIu0H>j9<2F!;Zi9;sRO592e}Vjjt0%?_8-;B`SRHz+)XB7S4OLT7MD- zC!1ADfbZ+e=|yIq;QZsR#XT9GeU?dreE!@y{I>m1Y^Q?j%$c*o!FoF7Uw(!Fs%D3U zhM-bZ6q+?_g8N%GL(Ll1q4C$j=!DbyLWIL4O9s5z`j!jnA}Iv|0|FfB#lC?E&~q^mSVs(=V82mzwfi2;!oY7_(nDbf)Hq}LGX9i%tu zB@jvoNEZk_KnOSg@4GX1UjKLIojc!J->g~pJ>*$gE1dJ3z4zJe+57jL^U3ph0K-E~ z9Zdik85!UO=?`!|4R`<`zi{EN59y#FeJ)|W?*ArWM*MyWu>8KzskmPm5GIw<*!M|$Vt~wT%@{qk&1!nhvI`^{FHv5mxVD^-?{rhT|-k#Tj$}Er_YQ{o|~FkS=-p!**iG8y19FJ!o0i#KLiDbd<+eX ziH(a-NKE>YoSBuKlbe@cP*_%8QCU@8Q(M>C*51+C)!oxOGCDRsfts8`V;2^GEiJFC zuC4Fv?(H8O9^sEq{^E-aK>qJ+{a4QZ;ER#O*98g+atg}7_#(UDNgCvg6c?{aU1GX# zNcqx*`MUJ`%PeZq8Ko^$0y0K8)>m(budoTqVug18V(s5J`=4Vh;D3p;|H|0^!xtJr zLrz9|c;t)#RlwPk%rFr^W>~<<39WSJ!tVOBfQdQz1XFXYAq&$_zjqWPPQAaWR*|Br zmBMWRmvaD>0#VxnzEfy`cQgp*+n0g=3PPO&I7{d^x!DQCC?ZAk&nO4Fl_EpSC+7fK z9b6kR*qQLT?i{fAYy>Z`a1QvOB4BB52J9 zO6!bA#UMXsgM*8=8<`b3MKbGkuZU#6``CZCHXlyLW}c&72u?YOe#4Az3z4 zKCz#!@oJM6ll)8y40m#McBu8McG^|0*6aK(+1l*r2>Q96Id=}=koa69ED=ai(9+UP zalx^DI8-P(?~TRKD%86q%`cNSMoKiIG0(r2{y_WPmBo$ZrkdCxXNONPy6&J| zg25m{N!@l_$UP6^*9a`~yXy*$_l|g*&IbP#kMAS?sBS*Fwoz2_WMPmH)64;%WIH+s zs4K&gqUHyOiCS(|cFQ^LXuj52Pm58+_Gi;6ki{)s<1tBrY6Tiy0Hf)9{`ePkw;ra! z#^u zYaE{gECz2#)h>8oxfgP<_{01c+-2I;+7!8{Y#C5hd0jwF$IO^ zfJrv+8Q(>(qYgXy?|6t#oqMeDXt9}M#!}%`a=mSC8uoYH#Z)}i^ShUk_s_!MzX~0j z4=*O31GHK!gDv!pey-j31SiZDSv_qDx|^GRe42ca4>4#yODK)$cb;su~(rU z1!?d2t#o~wHF%ti(o4Aql?D}Mep=R!5(hflHW^tbS~0X}9H+)9ndNO#7wRk+1Ro~z zy+1&xb+so}Cz!?b9NylNoqC}|@wvvQf@={rS!y6<%Ggl$tHcq5>OBXHPXFxh5%N5P zIByheR+z;2k3tso#juvm3(hq7X;WMTF(l7?PSD$?^24yj-IAwz5{TT}T=1nY1`V!h zx8znnHqb9hUV^=av#t9J1)my>my{soe0+q`>^_2$-k&NrXkYM(iYSyxPw`~^x?IpQ zp!sPoCSc~EPHgEMK)HcoXi&r{v|!kriGu5CH+55G48{%`Da}URmMZ1lPAzr zR?+0;H;$sUjf%6syN?d}x)(t(6{_K~y4zg%N1*9Hurd5kwLO+q(w7?0(b##^Cr;y0@d(s@DJQ(h|dUQ^&*eL`px(YU#P${*-Q z%=n*?150~e!mh!k#gf`z$JB*H zD`1WF8VA_SD095QIaJWhhp@KG3{UZG5vA!ltZRvWy#~J zlB+%_KlOxdH8bqNl_eGNb3l*SPU6{nXZZdDl!=t3*ntI#&FSt)Ebhu^G*g zlSM11H5_$f=-j6VSv3}r7h#cuZM@fgY`!-U$3`M^Z2Vq_Z!`5U=~KL4^b!g)vY7XtmVCp$WZk-ZlJ-R5o9FdB81Z0+%#4T{3;wOg{C+8ufx zHilP$A-fG2G4J@<^0!-^-qwDOK==>%bec4d*m$@taC&3laP&9v(YC_og=_U5*lOqa zQA)*ntF*GPP>n}QWs^BueP5hlcJGM*e332=9<0Q*Fvz`z#soGf(|&#Ia3b;Ur7y+8;IcpRHYVCR)2*IBL+H)RW6eXN$_0Rkg!rlXUhW7@8NDpui z3nqhQJs3UkBiCviuRK$2_h`G1>;69S+X<@D-Tlcrk)lHH@O_e3Vb@RRue^@*-2Od@ za0VrhCV}zFL7F*pS}px?fu=fK9$F40Tj>xg#MP$xiJ9slk^fZ3@V`Ix`lqR%7-bhab>P!Hm~ma+$V(w18QR}24W%s| zxnXmgKQMrj;#C9Xd`L%MKj>+Bq7FXMa|fvt+xFJctli`DS|XE!Nzbn ~6H2&1L5 z^qXr*GJJx!tglSxN*l#}Yw9)FCPk@V;CY3uYz&CVb`FqP>lNz;9e(~^I(z_$uxgnT z89IO}Jo!GdH01QEBJE)AU>KP5z}Zz?pGzh>T}EuF>0XCD47un=q%I#tR)Rz3#6$FA zM1;nWs8i*P;SXgL9i0-pr!uwuHA$j-$%u1+Wa~Kq_3BRI#)*GOo}s1Uf&to74OdlL zWIBt7bTF;eX(HJ|@*y5oQhg2=XNG@Ftg`5?JQRd{%(^6!4&h6G(Z)5=T)~z$$2%b@ zNswGn766UPiMV;-I>wAg9GPc-MmI3Fzf9A_i7wgLQ9x_n-Rlc;1 zxx>)8CiYESVY7{F)ZEvrw0cKotq&W;pq~xGwB>;DF}F9H%YQptPqI<|T(G;A6UwQb z86#xZ;!>s`DVCx!hY5gtHdJnntbh0wTfPbJK%P~eb>$6P-k03GnbVcKksJnl(jMc0 zwk<@{m}rPE>OU}I$Gif8;L=Mvwuuf*x3$0j;2^*BY@cM%CMws4Hj&%1`VZQwrMLEE z`yaPD@n8GccGWsY=BqV}$5nx3@y-6xlQZ!%PCr9~+1S8Y|73qp%Yu^d@yxKB07DJ0 zs4gS}gvc}G<|SLy_(Xfec8tPoqB6swC?C95)$}yTCiqg=W7k_jJmJzGv^+!sbMHoK z*TziZCJ7I#aPR=a?W((-h@F(j6X9hJ3Y-RqE_GuWls-Dk*Q&~?IKOl4T~!s~N)7%k zat^TXH+YUuoL6Soz-gBHWNw^z)KXhAMo{0gS7h+kq0oJAPXs&fIFP+DLVyInC0(DzB+$ zY%^3G51B>j#Vf2=;P=n6WgC4gMmE`7(}c@M_8UV-oas#RogsVT1o7H&dm;F;Oh5?r<@! z-WN(+k|_|MX~op>W;ah1mVA3a(VF1~P}h0AN3{pppg%QzLadnC%Fhh5x*}5C%nA#j zr@~vApd{kcruEB{cb^$F7|TlBJ8B(!^zf_sQkkgKTSuwcipNNYUwdW~-LAs{wPELYt9(eTbI#lzinLxFsM^L8 z&6>Io%*0yV&jIKQN5&HkJaq5B!2-JOk2h#sN@owvtE%#$eaNk|EdJu*UT1d3v|y<^ zqT;nxt*5&s4}LQbAKN~W?5o0!LR9FhE&Bi!I@qN^CF%L*>f8-3@1<(M2T!10*VN(S zakex;3-st4C?9_+QohtTfW49V`xLwb*|*CzwDeqvy6Tw5itm~~Q(0J|4_4BFxW9-l z6OnQ>luT#i;%NVj=;r@w%kqQb>z*Y&KEt(WJ=qpfu#S$qtM!qf1&4e?w?JQ4Ef36% z+~c*g-czcjEk<4Loo@EIs(M31uCRVoleprHR|!n4$NP(&ST+lw?UB6YXF2=zsS+E{ z5?fV7D~3}Z)=apiszD&Hl4pxW1Z}G{QnR(B%Idn_e6GKF8yp|70pY8l46g8lwAYyi z8r9Ve?TZ|&+yWsJJ(*V+e*FBQ)OKY0;GN1ayQ%`+z~RO@fSzcuWi<`QbLBKmS01G$ zYRJn=YZe=3iIa&=b|2o(Gh#5*U;!9fa_ks9*m;LX%%AFuEi{KUsOI1!x0Y{KoN@tq zwGqZ#3UOXQ-z^KzW`@|+HZ z4tMSwJ(ox8mY2ud^&WqI@^)EAK^P)N_?*~)HrrQz6^1k5@*h#*A5~##S)^shCVq_H zl2aC)Lt_jR^_(lrW@kG1(t;Jwnx&gMXt03|HbXa-dFU#4+8*KD53A)1>=sPzg7%;D zY3PC+k|#jNG*W{8x@;a8V!6cntt(72#tRc0h$e4%@^N5{p;1%h$^NJb@*uaKw^GAP zAGt}LCm&Qiv(C%5b0Y%jkoj3N%c6I`Zi*MkvLGavNbHl&R8fysHNNSBr<6k#Zn64bU z8&lkS)lP1D_%W9KXEMGxz4wqXxn1aobWTMc3#_D*6MI}>YM3XCV3_kmzX!&{2c|$J zVXXUzIAgJd(rkf~@aJX2O5O5O3g+(C5W?%TcpH4rLeZw?_A}h#lzH2gA81riXHJ2G zGoKH2ZjDB@rj7B7>*9|V8<^@<0y8V>>-Z5i%qkT z1sJ@_0}h218SKb!m#y@iicP6T9}%ILSDi$uWxvttukcX5a{u(5>!^+bKli+urqaUa z>xbXh(dwRuZ}g#8)R}y|xS;J$jDZqXukWCHTg-ictkMq+!!3s^n{(06UHf)!;0(;prblR@BQ0L}k6tAT{jvS{+26BD&1$P}jrENR3ro_(4ET z=M4AZS*%+(QOsarY1E&0-OzGfr^uqJe*QU9?)jF=6X7XjN2}~ZQ-!=Q+{NMj!D5vr ztD>T@6}1WH033!8b{c;C#F$8`4yK$=Eyeh9kG&>UQvzF0oJzCxZN?UY^bI8@dPG%)kh!#zLt) zccF{3Ww)!V+Mii;ag=n1NsOc5LnB76PDZm;M5j&SOAQtyL9yhWfiDaF4?9srMtTMZ z?~4Rir}%@2YX>4Xq8zwAVuw$!mlphSbY`fE(Mj&%QgvXIZpxTuz7G+*3+P_cZ+GOI?FQpxRDnnO53V_-b%7 zCJBiicZGxd(^A}>-35&v0XJh-RB2Omw;%K9R72ZTN@Ku1% z0oe~FN?5KJcC#sGEOEV=mn<57#^(w>s6WtAZIRgiDZE{^w1k&OEzGrOuskMv41V5H z_Qw zBe@{6fYg`Y3{Pt;51iEX*q1CYHgtw>9_?D+QQ^f?Bi6(+Vcy#vhlv=veXhyvihd3^ zu;`iZ7o|S?8x4ECN>cK(8T=95Vf+J=aG9yq!g}W~+h@|RYt4aKYomo{26Q8EI}D>k zGcI&>b1}se2M&_cuA~*y`=q|R&3U^$Ea6B&#Y=}#J?ROz6ys9v=FC&7mrms8(HADG+7_$tp6dqK+V-WxGjne~a9&>n5_Pw@ z8#gdW0^gn;)lNA!XRsqGq`HnS71@u~x9bnvc!Yv(PI!q+2)yaL-r0U>UOHaT#v;T! zU~hizi%@mj2DOgys1`1Gb)j^(nhGl~J@xU(iR(?-)&QNyVv|;ep+-fVw=P^6cuam& zj4{B&H;B|qMbBVl*iXy0-MHj1Z;J<8Fh^dBDy#Wbzj~s~jQqp*zWp$Sb*p9Ky zi{~iJ#{wj>Xx^Ge4YL?kRUcoOsN32;;-$*<|5<%FM@y>fNi=7yourk*Z35f~Q0S2bs0uMm5dZg7+D zOWq^f7lk&j*o?FRF^@gH55h#pk}KIF_v5LsH-5#_-w7M_)_4Q?jrB zwVg0XT|#<(s)63P?6K@1z4-<`M7iv$T4PStn$z`YYxg(ruM{zHxYQ^dx|Z+o7A+X? z!ur~o<_40-667b!EmvLb1D;ifj?am4OqK9|a{EAbN8)G6;xB8YOJ@0pr_8!V&4c=W zZl_@}%P!7&Bn2YH?tGFLd`$Kq7?g?lQS3RO9pT(wo!G>ON1g*NPee-$3h0trJ#W$5 zJ*^_nbM=>?KRIgG>UoNoiL54_swWcZ$M#d_fSqTXZYFs&ofX%=Wl>A)uT>w_%$_tF zNO-w(#<;#s#W=<@oyHY6vW0}fTMO}B=Kzh-a{!P_l_(m8e+IsK4p^;&FJ;-C13FA9 zhfU7%z{fAo0RaW)fL)4nfXxum;T$lJPA7a>NXHd6Nu2|RNe;D7bMPDxmi0F}4FB89 z$<7iV9Os<_0v+MIcK6h)39UagipAM=O zMs#IAdCABcTJ*5#f~Fr$_n=v%3t#Xhy&$);+*$b~QQQELDm}fCYK!(wxJf$|d8`+F zX*XFu;zIeQ7t=Y4I@6=kMkAY$W|G>{xaRqIkxGVtHB`Q8?MPZW% zQ+HI3|T&e^7BQK&-*WfJMUw$CUOzT)(J_OM3}W6dPEK!LZAa>W`!|UHo{~W z8H%;S2)CD>so^v*SxAc^y%VGnSJZI;0lu1sGRrb#j{nr%gy0;+M~?Lsn8}=S?E& zirQ{mY+ty>9W>*BZqkS{^+HwiB7Inz6fQS)hY!1zTHsJV12V;1F6zdtn1qWPmYM%# zH&ol%@{ND~M1UN2ItB!b&h?*7oCDkh(cX7(!a3xA}nq{@(uJ@ySFp&d2W@ z(3Sr;o@%z=oty)re4pj6qZ7m3)9D=9aO)-~7L83I88gqND-pjZI<>r8ps~3%X+0cW)r@mrqhhtBOvV^S(q?g$OI}6XP45bE=zy z!4VC@4%sjT%chFPiOjmn?=@*0s#V({Nb&35H#RLT+{g9#J zsAizH-m~yyd6$*3>Y>6p{JR1nJqwjRy`4Y}V~G*axO#<35GQ)T^31u21pWD|)=esw z{reyr0KslgbgN%IDY1>Z_umf0HNJ?nd# z*Zn^n7N}xH#z@(i!9?@+0SRp(I7CV9igRtBD4$v5RQOaeZ9p~$uF7!92CtTxW7J0s zR{D7wC+jrS9jK*4uf^pa0^-p{l~^!2tiF|adjiScjs|vpa93P&zcdmVB#r43=q!5g zc{nJZZ%s*5-U|#rDhVVqMHmo2oI!}^08{v`J|8a55xy_H0X{nEBRyVwGZm+*>OO;A zHOJGV=0WhDl|LU|fyiLNwr6l^H{CQ`xPCYN%aWIm|G1ajz)$NHyVUACD^71@-jAT} zkk%TSq%=#-pA;_P#m&bzqVNypR8N=>kf&!hq@+%E8af+)V@X)J9(s0?%EL;Eu7;#! zZzvrB$81Ovb+Z1T?HbQNKL_CEX7bN(Og21hzCsY6 z>ZJiG%Y>Prt0yc|LX0r#) zohIg~Jpq*4VDz$5NO!W1;Xi#y=>8pf>z>9?E6Svx%D6H9l>e(vI-q-pJE?-Cw`X_j*r%03%4o zA>iP5n#lF`p31le#tr(f&I!5@|MwoW9c zo@V^P=Jq$SgAB02_7jb4NgJi=&*q;RA1yg$f7bgrygd8)2Lm_5 zoTs8XAJsNdWY*G`!|zGwiN;yZa)^(6zQ$RE8}B9ydS0gTlw5?qy%-T*I<@!0kApqf z4W`n+v?ecgmb?YR%TM#~mXLb&Q;AUtT6;M&i?PcpIy0`(^sVU^LBRaLmJ=F2>oGp# zs@?r=_U z)zOD1D5~Tv&^l|4J&LuD>4iCqEm6EPwmylSuBxTooFVoUDAjnaCF%WJ9AjLKUx zBlXTx1@uM-pg`Ga^~x}^74aoQt1A~O@*{gyj76!*&2$q}r=f5Q_f7x8ZGD7oo|CgD z%11K;4p_7RP<|u*Ru7G-0Fe0EQ&SNblYbR(MGC*M zKw22I`hYncP`sSus#QU$o5h@(LCQPBzpbAL4y;QKSKiPNsR`_{3bu|^GZxrPsFO=g z%k#_Epqri^<{XrI)e%p2IZHT*!|MI}1go(a*anhR4ad6w=4?>lqiqmSy4%q^=V;iM zVOEBDlrv?ML@IT|=6kNuO!3#d_7rdZ9@(vi9v&A-92)C`)zkOjEe8jUm_g7qSYd~< zbC7+I7wLsU z(0i)eI9j}4KRpcs9S{i7d!Fq`W?$_c zg*FTW9u8{2g)=*PTgDe?9Qxf@_JMt?t>1ML&(o>}SI|It?RNu__U0_cUp{OA)p2CWGPLCjg7C#VBlYvtj&QkG zp*p?Wh9NKCc}pG0WxEyJbn{c)Tyd^b*)DoJ6B(+K{tJ232L>jD1QQf@62oMvAuKU_ zZ73Di2_-|M{qWj%jhkaJFWupi=_|)6SLp?V1A8u-NG_+=>pRo<>h5?%;hObSc*h!q zbJx=7ah6|-*5&Jd$>_WKM>!5wTHFXX?W&?QR20M}HFqmz^3Aznf`~N3zWS~U%Brn* zS))EWWx?#m5fzhG^$7~lttioa4`b(~fHwxh$)8N{y7SHq7WO7)d4WpG1?H>QG^6E~ z<0+7N7e$|f%CAYi$c!$(idMe()J@;rhp+KjLaTvuRtpgW^{5O8<;^t$-(ZFJ&aho6VgSb z8Fh*{>-x~}1fCD`w}5LydC?0K6ElKU!yoNF4@!OE+tjUcd%m}HXSenTsdGauyx?h|J5WP=7W`d-yq;z z2wJtI!5x0ORJdTF22_0*aIxWy4(%=V3u;utz_i?|5+#M~S*}3&FAf6c20TB14oR%t zh;mN6cDu)IG6hul+nn*eW@txF_3<3Wv)*s+wET8n@1pSD9tm^jUo{0C!Wo3V#iyHB zHSUCbI4H8Xbm+|N;LlfH*IZsxt63g=_9~Gv8^<76>!rZZuFIk=6Hr_)wg_i7$HzER zp<17Qg);}i#D(}H9edwlY*ctUqwFB{ zDko(dN$ene%G1w|X5-UlpFl~%5tX3q-35mO>g!?8=`s1~WGJb(3f^7eO3&M#q6kL6 z>s~jpmq%%h`j0yuxkQ-l^$7XK#|R|_3S~cRea4YsGZ*Mmf@z0eB9JZeNOb9=2(;Kn z*GHu>ItcLt;Ptr$E-&r`&j_B&#;}P}jp&W5Djs&z7>vhj3Ap1Smdn zAzv0rKV!Da%d_(Vy?OY_%cW?_e@jxd$7y(C1Wk0eYb#6&nwpn!GE%CW7;ci$7jU>c zSDEGD>7A4IsYDC76jbC@ErWJsJFFL4d99TTXr8y_q32O?~v*K|3bXW#lb zG0PY|B1;|4Z=d-h-BT)~^XaQCx#5(Mshpj>?J4O`QI%>k16&EXsS}DwGwIU7>$HCPXw(EUHdf^b+1+K2%AE@*}9Fi4W>OCxXC^ zKT0I4i@e=iVPE!phV@FpV>&X!$heHHs-<#AVrbvK2gvjkwK{9y%@(<)BfNaxhkyGh8`2#0Kw4aQiEG(1}bAs}YS6BCkj6+y*7r=`eO{-eeB!bx zjh@sCq>fy8vSlp7!T(Xbd2Av-dvHZex2yaRWs?7E8r$j$dg?V5wyI=|&iCNf zIXfn$$Keuc;*Nk-fV#$&TNm;H05SQm86u5yb7mkSePOc+q`8>`7{9$jf|k#FD@^f8 z;62Up>A9C#)a4_9&XY8lp?9a`n2DqD+Gg>pk?(t#&Jla^@a6mj>aCp1gGrV3xzC zRpCwDQ!5BZY;myNqmF`y#S2-R{ez|v%viBY!Op(-vw#hrHN-u;uTi1h5 zj$#S1U`1Z{9DMT1LP9JyipJ6V!`+Uvj(ybKMf57lOj?UJu2&BTm5r%mi${De(l&l7 zExq+1Y)OfFhpz)eOSop|Q_zu#f!TtT-!2RqR7Tow3&c$52#?;= zmWIqV07?61+WaY>MYYxOLzNG8=^~z8+ju;O) zG!W1$5BY6_p6+|k-Xod1bW6oz>Q0yW*O658k!9W4wtgeisD(R=r~c-NC28m4nXHoS zUKfU?B5B(#AJj^e-eEnAscVWu^L+UH0Lq8H9?@O^#Imaj=4wysItlGs`0H(P5V?0& z!j$gsaJ87#>@-EYU~O<)2>DWaf`Dh8R{{i*|0?NN#v-B0?G-yyR@v($*JawY6f2xC zwj>d|3A$f~_rikosZHEs4M+KhfidWVxGm#k{uFEeclTesah%A(h5R_Fipq9Suw)tr zKN?=Nujq3tjbLlxke8m`B=0r)qQ(p;5PeI<3Nl5Y*0YxX=Kw^reDmh? zlm)M~`Ou@3Y*<$NX5o4@``yh7)J;3)4$7DarzmFawJY}-4W#+$j(P+j z{iO7q8z0+-D0E0{q8;LUfSYY<-sA4X@iH~*;sR|%3y9wN;9ZQ!8C9>&A)>j*42^KGx5I1ILPr$fU7e>OHrkYWA z-3(_th&Zpvi0pHO(*r7FuJ%$7Cfakr#=W}Ot3QrS0t3?&%yxt$2sZgJuBXX^z3aI>XM}D3x`{fqExjL zoceWkb`xf$y>15PO1&8Q@g8)&<|AqEurFpOaIk++tmFynKA6Bx%BLDrvlB-OS55wY@)9&b!!A~mSM8l-BluPTAm&_fV} zNKLq=Pb5ee9*!qfi~kX@@dr%+RV)avOAPX3CjqBP?rcXE-dc@IJiBrtNu(x0eHQHh zcGEwp`j;I39eeZtS2@%S{+1<~Lf=`?Sr!6r1ApOH{rem+t&qOaG+gent>8Jk$k9~^ z@PPkaHUFl1|0B577~t=!`8NZ+%=_gWplXI9(mOZf5BPBJ*V6Y65b*g!(i%GIG1=cO z^iK=?M}$|q@9Rj_U=rfZJ)Lna#_`GA)Uk@Wr}y}&re{C5-8H)>!-M`c+52Pp9XH`MY#QIDyl#nefH*R68~ONugi!Kb=d& zR{+0;z#lEJ#b-FO5%qI0DUF+zPP&_)lL^gx)1(BjW%it;pnOF} zMw6{M9HSo5L!@HdpO*fQ;zTK*g_7chawV9+gCV(w6V*~6e5I<01XHRfm2FiYE&CR) z!vBf?fTR)INp-(8G?GZSO+s>>@%=$jCboAV&HGzK_?y4~2MsqQ;fVji0;C`O6VVpo zJ=z_3r6-DC);1=LzZTDXzAb56i{2C(DZQlmN}BO5+|9(~FKpgFM$D)`1CN{AV@eVd z@@WT1TtM8 zp}NT?RsbB|jA&;oqUNSOq6-kgsP6Vps-DV{Df~eY2@Uk^0;%6XFEF75EpfOz*scfy z({G@EF-Tu^Dt3ahiRn#gwv)-VJKfTOM{BPryFOCoD5*Gu=nVsXmGd`rnM^z2UbKzB z!XrcloSyJhM9Z_bDSQ#Proq7mvn4~^4xrD1n)?g6=X^I$XEX&47Jogy-KBR>T+qa| zY6LMx7rR(a&HaeJvBC3jdFsaV=JC*&JFK<*9f3fN%3~Yv0bzTAyHi_BwxNXAn^w6 zcV{sl-JEaO@ApwujqKM?A?ITpN^B#vrvab2H|eX`ZW~spUZ@uX2R1QP)YQeh_1LmA z%z$LsO{$rHL_fNpe0#y`ie~t|-pu@YL;4oXl{N^RddgxpWi>O{=hN(?_2v0uCre36ZC zabVDtE=Zdaau>yOg!;eHnmz8^ZfoW>$4^yi)R&fzJef?;IC+j+7A9!YiH^i`a1lx#gx z@RV2E1*IS|L7&dl7IyW&#W0%Ly)C4cLTA&&c9?)A@y>X`{XGTyzuvj=$L_d0fApB# z|3qzlqnF#M?hqTKCa4YV7s14rhuRZx8;MNiR0y+O&4Bi>(~M|=zf zRmWma{N;m^`}3S8I;#mXbBfNP9M8IuyKgo0YcrL~Qm8gp3ZX=|$_Ll?sAzRTO;eyrakk(|g2na07k)r= zALN{A*XoMDuN`^Yrshmn3>`;Nc!ZXkMq(SjlPgJx29p-R3v`Hl*y12QFssdGLF7ht z07R8;=0X0XR%rrSuIALsC^|u0tv#r(mL{l70?zz+8jR;dmE;?uxBXP-j|iBbr3n8~ zOZL(IGq%H#wsumG-q6YHck-1h)bMl=P`8;CDy`g$W1ZCe^|+;s3NVq=)g?&_^U>F- z)Hm~cwXpcOxw5K~l&gnqZ*7H5n=462mHmj-Yh^R!8eq|UUcjaPv9cW|d1zUW;|=oS z4K2i*JQ&YK0o}W^h6qB3wAU%a7|Hp|A~#$xygF9$n=7887fkLoUnCe{tEwAuA>kEg zGA5u|Gq05AL&+y2_L4};ZM(R{TXj8L(uLhZXiY-KOg)Q7{OQ_SZ}Z{C@$@gtuT9?m zZ<}XoebW~z50Gd@>|CJSS5IDk2jaMubD?0eUr_%qh>fCl>8v)cbAy{BwC&-Np^C-t z`b3pjRJ5f$-0pT3ZtznDtl_>4Jp=5aDvk1ZM`1-MKV-ru_eyWE1v2T_k%cyil5*)# z#A^4Y`hZ8i`PoH?5G(F`j82J(J84zxk3c4ZqB6t8q}51a;IB~d52Im&=)^@_az3j^ zY9Q~Dwoa0=x?0dVz-g6y7!okvr0RQXNa+!gYm6ue(|WYSq*t|_ZLv{RYEg`c$bacT z9;}#1&T)sgat;;Y`+QuEhk2nhD1VKu*=ZcA#JZrf3G~g4?f+sk%EA2VbAJNh1^3ta z$4x+wa`;>4ec3!p!(GInMe`WYt=_n{u{L;M_F<8}3%~lsB+&q!F2Q%oIv0vfx|5OZ zwZ0GLF^mte$d7$HS^B4}Ir~RfUNbnLT2E#)?0F|dCZt3h=o96SnS1-BE)@~f@M{aF zd^Gm9n65gL;4OEt>6Vgp&ci&rj4o{bh{ulM*Y;w*f>kaOO4C$SwAAy0baSj|p< zxYfN;H{G?@4T=zFmpsR}KWl5x0on-y0-)|&kGq!2Ry>v|?YEm92aoyxTEbU@&qRYu zGMAP=t-W2<)6&0c+^$oo~$1`pd!|!CYKF3mH_X4;mWv(l>$p;I1=W>8JW5+JV z-93z@-SDfrII z`%n~+&9L4lc7fK>jG$d-;i}(UUv;W(tf1=+G+u|s=w-9o&J7MlP7W9#T<4S%z z`S&;Pnl+Frh|a1f`ar)PFfH+qUqDYL_gvE3EklBP76!x2=rR^V-BlUz4-7{MGP#vU zQ=3XM?oeQ#Ttk^=la-@1#g*>bV>;|-`PgWr*MejyCuz&n!E+@^IM&C9N1}INehpoc z_;z=$M^vVaI=j~JLTbhXFQ(0b->S1ES!Q_Gv+qr}`Ov%u1VOa-YZ1Ey9D_b|gc9PP;L36t>FJ6{ZQJ~QPB z9J%NOPR4HxVI7*U5bk67I6xSfN&DSL>DcD)4kyro_=45FxtR+2+{a4w(Oy?It>eNQ z-oAMEXe&N%5&7XRyq(lv^G-t+IO0GK38N37&@4w(vUz}xDRuX#SwGkJY0mryKl*sz zO1X>ghj^a3W1z&%pKE(SyEA_<$~ASzpxv1fA7X?vSD~1Yr4=(kxrz1r9nkvdCLhxn za;XBJS=9#GY77g7zJ_ue54NU5jskMB@a zXRS4{5(jp2YmsL~@WWI@PW4nngO}y~q^;RBPp{cqQq@hc5!|m~M^d59GTptQV$|c# zp8uvq$}wqCL_TN{AIa6q$5v^;gHL%jykDBfk0T=7olC$vTouN+E}3Hab)^+lD3qZiH7@mjR~S z2c!u!Amx{pP{rq`Y+3G}Fu9u-3vR;mX8HwlCp4JoljT1rE%%7%Vm-Q7=RECjbkp<5 zwzIeBK6TtgUjEE<%gZbStN}SS&qLk(8Rg={@(!_1eEcVSV)ntl&;`oTEZ>X=#kUbsT1At zLGG4{>#LpK--Z*tbV%&kUiS#^F7bMUbc$+wnPl+e@GSKg$!<TD2_D!oH-Qi%h(hwy#7$IjY^I3JwL2L8Lp4ywsDmY{P%nBg<$*^~5VzD{i_v3bER@6FUKqnj-yxqp+I1jX*X*6G699Z4A0!DpcgOsJ%O1hgPCR^zcx5%VqznvIE|VW+ZkNXRGEx(87t|%SIHj0lV*LbmD{&{ zf){F_7xO_9T#ZZuz_^pjqqk{3a0qe*hOD0`?er1ShFa%?CQc2dVn5-r#Gk{p2@ptdKmT?PSO#82A?G!8Gw-TT!Uy6e4?ayqgI+rzDTQc)9S$%(1hLSmCUtU3!w*tk;VYwJ;i~%Pd8~@^eU9mIB8|*@wv}Vdcjpi;K%1 zq1b#^MD7X`KUX~&n)n?i;! z@^V%aM?@xT%f9ceJ0o?!FLhEXRrRo z;sfW(eV9BhbJ&hMa0N5}#8Xr#k?wi{H3!w$fzkox{R2uew-0i}r>y1zW6kGJBHM;FEr8y$P$__Tj)<@}p|%uhEdrGzNJ#LB@B_mE;o49LH4G5(6U zd$|CZsz~Z^3`TT8sUiFyTc3Z$lJ|0S0_5_UHT3R0xs~*o=<(PE2viPOEEARlN<0+{lgcatl z`0&=gR*ilbS%&J16kHBF~4gn|%c47SBXsX5Ba)e0lz1HdG;e zpL!XT)&X}^ijDp(@$v-R`CKy?#NK-zTb6RRABLne!UUl*`%oFx7nj`1HZ5f2YFg9} zloHN}G}$>Q+~F|r$KV$ln=aZqYP!0^?7d-7TPw897VSu;durqfZtD6up7rxtHY_WV zUIGUr$oeBphTV8q!Nz(OdK%fd_{yGe&?xP5vkafnD9M)I-wYSfbhcp|ol!j>QD%nx z(7JG^?&jnT(8iP)C%>PUO`Uk}x|EzYfZ24)j@1MeMoDcEB8(ZqfyZ94K9P9)*7vM0 z5XYSW3FLZIN)RbNZYrzo`Q%hCX!3q>-ZR6AV@}T=-w%vu7K}Lkz(taaX3WjCk+`o= z+D`0MdusU3caGj8f}%$;Mxxp;mWUi)L)Mwl?t$i3i-f6I`a z^YeOYRP$=^r;qBcsx%za@7IE89#;s|JCSb@78}iY`qvRtTd8PtX=QC>%~w9t+wFX+ zZdOh%x&*G6;K-{}i!W%3NnB}AHUX&Yvy7ajSTWveWyZ4NW7M6z_rRCMB6#G~=38U; zp7up`-h=s24en@bHL~ewoAx%fwj0!{_WaxdU06}dW9|>RYp;J zVbpIq0}Vej3x9w8rwl`zq!L?q-3`L?{jkcJTlw3GA^BC0J!Gln+QNA4MCv*v_<7bO z7UeBa9uxKud>+9&zls!R43;s3CNFAIL5be|t;O+1^$Wf?xp&`xUBCI+YqWysveS>t zHnB-@-i0})3@gfL(*_h4Y~!e4$B$T6*Po#4!p?Mcm2Ixlf0hWXJu^DbsU`CG94glf ziSG`WSrMhi#i54yJl(AQLDhG7(+5s%&brn7pb+cnj<zBa4rQ@GvYch{@DBXR055CO=w-(W9pCwm0x@N$f^^7A@lNJxeKdZ+E6829es4GX@&RjjCqe$(0P^tvPc!Ch&fn zd~r+u%TCuD6xSDTQl{e9Un8cIE^$f^%|)GwA2E4K<<;Ho_>vN+++(As)}yKvhC-9p zKV@l3XIAAI#;#q|f(y`D7&W%E&3|Umw|a7HXCVvHaYVbfJvwpk2vgXxSR4Q&RJH2M zx&{iRC+N^{a_Lo9l!v#)Dht;(U3l?*H8ixJ;^E!5XKu-}eXp@1c;3N_5+jB6lQ^BmLbMVO0UzBO(=c&B$6ov_&w**KP~kh( zW3Mldl~E|jnp4)3cnLB0B^=)B1haV?Pt_UfquSoszvqys$ z!PI(vP6wfa+Wy#;M^#ws`|Gu}Mh3>>n(S}%QeV*A)ceBPwos_M=6wv%XlVR9Bgb!n zCX_$no8P<~TtJWp?$9?+Y1?_;$?5Md>A(8@Sf|@7#41@oec7c-8=HI5z|f^%I6Wel zTa&l?y5jS|Gfg_Z$wT}<`3?We;`XQZW>{M4%UeA^xsrc!A^*3V?)S!Qpo00y+x(mP z94NkivIqa{f&9-t{rmG|nmOTl#FRzm!Qq2#kx!1AkGeO>2TC%XTjb8!o|bXXMTOjf z&%ap~|MPkNzj}>XG_D}sXYxUhs`~B9KJ%88m518R`Nfak5@8M8On-5j_d&XALGs_m zsQflcS*Cbx&^pPx>%Jt{H9S2g5b4pFqnlOjU2GGI3vv z!3`y!&4oXXpExez>%J@H`V;v24*>p~yzKuWvY>$Wh%N=e+y7^; z_jPa;B<6LYS2u+mBnt^nbRe{$9p` zKvu6IIZh?6$vnhz_lsU^q#OS(jZPJlXscSBS2d64qyzcuB-));=Slg*s(jsmmC_fe z|0Fpj8fBe4d?K?9J)oO&e zkky)t)1ih3_YfDBN6TM3=NyJ<8AV=lLIuqPG4UAGKlO~#;&=krTN`}5@^yAt8(AQ1Q2SXw>==jJ z)RWXXI0XSRc~)cr?J*!ahzd$YeiQgjbEa-QtbY3vwLO6w5}|mqEqIkKWJr3n6YTWm@53>x@!B4R=l}SFj}bqCv&L zM(nOm1+6pmMCmKr(%PnHGHQUTEs$I7+Y2Mci8Z#YhC@Mvy1|0XiW+0l9d_ymdh8#M zgVaJ(sbUV&o2p;6-MYz*mh_<*OA>5mV`TYE&e+53oCrL-#2|$VTKPM zr~@`z0I8v?6Ie~IM@fdc#-9`C2ugdqd4^KTFW;vJ%Z5b>w~~3ycuM**2iK(H<>g?) zCErkMHTcd_%P-H^lTYGU-l;jX+E`ST%k$%7agB;f!!;I;g|;5V(wv6!>W!(AKoBVJ z?b7i?m|KGW!*7q|?zKyx{C6kpq4f}N#4gZ2vU@OQv%b?eo0A#$7yzXtIC%rk*}WNj z?K8{2gf;zJ7-E=&>}o`g1N|1X^LNxDWa|ZPR}i^2LE$0n9v4(64?SWfI8XW?u@e}9 zQD)LEqp`(MIPJGQ#X-F%uGTT&!P1uvJdqL9-8mUX`*8dH)<$YU!29_oq^F`rXRU3` zPQ(j+r#PQn`${~EVh{FVF}p>8w=-`>$}W?Ei&MBjYNI&oO^t?RP{G1LUd>(n7;os> zoM*l7je($u($=d&QB9E&*P7nQGHt~jq9hTNWGQ@0^=uc-Y~$#9d8y{Yx z%+FLjVbf%_h_VjVB7c@vFTI7depiAXK$ggR&va4g4wx(p3afP-D9rnJyQ;$gQ;56{ zeVKhpS>OOQW<^8jOkrn=4hiNXgV}W%bg}u1{WR{ z&e-^sEbV)RP<&{aUND|R2&dihXJufe;GwH`Bpc&hR!j-1DZ#S@=}(>o-?5KWQ%!Jp zp2lM1#BV=^k_XEU)O+fkw$4AleTZxS2#T8;q<4$f$3QN^ifyVIZVuJl$hRGJCWq5T zZ5G>{CrDhot0JM65g|QZ8r!#nwnl)Kkb*8N2yyd_%AL{Q94u3Ndon;&7d5rHdB%!i z)$W@b?dk9$U{J+;ZC%!>Qk`t$Ms!!yNq_eL_FdEts&H_A zn$#lcqAk*)MsN*t4idGSj+#6pL=UoA8{v*MbmXDiGatFF+a(w)r{|kg!+|M}d!xwi zrG%I22}LQ%fv}P=Z zk2xLuppb)fOm7K~lHCSG<)2gunQ;wwg%dyZr4vqo8mhcpeRN~E+uq%)A9_g>S#ny= zIHn@6>k;vNuM^kFxCU*9vNAG6>7THIC1784NH+} zBRH4xu|iw301xqIrI9$TiJT&3h2ZVoGVF3AucK`(Ti+!wBl z?UeS#w=F0WjZYOtHgM*a&u2XhW_*49$zz07*F3Tkvgl)HmI$d-09LZvv3Wbt&g7)N zFw!PpsYQu`tO*#rTtxFVGe##E2U4p_E3eKl@}y}|cYrERz%Fvk!M{?vGG=9XIh98% zC(Ih*7f_#;i5ppW_Z7aPqGk+gox@ItwR=h2pzbF* zBHU7%tNDxSJtL1T8z+e@*j=+q%UavbJzcU{vz-yFqK#iP9P1sa}1V;Ustn>6|=L~FoWn1o5 zTLKLyUt}5jb)5nP=HkO%p}~ALbn)?@l2x0cZ{86+MfD1ukH<7(=t$y% zFb#S40=KBfHM(5&nN!8WP#9aCh2O`r&~yeA)KWp7rdWHebepk(=CI0{X3&aE`LQdA6H{cEymL;o82_npBOz+tn-nOA7&lS8p7s zyzr%Qtj`aXnc|F1OqUJ-2r9!sJ1;Tn`IyP1Pu*C5-2DULaaTRn6Cw6u;ZFAwt)lMp zw`aUKlbd?fO+4Zn%EA;AT7y4blcHVi@cLF}qGk5gDrx%kuy{F{QHJli1t%47lIKUY zyuF?Ev=)*k$|VP4Cz1Xs0W(!h7iU{mdd@6$O@-5CqGwbRW~i@CEU6g@KXn^g2R9Rf zH3$OIm)#-I?sh~|PcU2I%cH9{u?8NOfG8}jq>H*W(dvDd(a`iL)_jWS&SZ_q8Gj!g@O)2apn|MnclS{ZjX+QzgeIUW+K3cqgGH z6gO_f6>Mqa@9(lT*Hz|E*0vO%s{3TY_N8MkAJyETk-N(ftK!c~IZ|5jVZg&g%Nw~J zhln}ycIp#KtA049(?iB|fTZ`lwTQue`B&Kd!d?}wm~r@avmfd-G2OUb?(vwusZ_9& zH=fr^rGs1OLVJ6<9YqAS65UZR&|!Q+)~d!2zd?b)HJqo~**6rwjEL`$n_j>ufD;~th+s=m7P z2F?5lg;TbsUT6DvbXeS8H_6tOX0I@_mB&a2M(8kp5VW$o-cipG0csU2a6b;^9n}={ z?Yx&%J5Rd-+WtZDYPU9TIXO(k$M6t2b=cuq&|1GgfeVrs&9nu^J!1V_osW0$rFis~ z6-AG{71v1qK_Q4f>G&adq`>0KBq!EO0xA`jRcN|G>=n{Ao-oThKHaBl=kE3X>FxO- z7X2|49bU^&$575u5&SlL>l&}{s$;Curk)h$;FJ;a`$~HksYucVKd$`nz>pX)%6!0o zAj4&M@QgN&=taP=m!?ENI|P#3m-~xc1$Lo*X z1UH?JI0n!Cu*PzE&@z!s72DmK=p`bXK+1F``I;-y`E>hq0?p@eZtKnUgG-)^h@_Mh zm+_;G_Ck}qHH*f59}H0mJtnkf{UXj_^E9A3u4OgW;P$;!UvFS_>*VV+6aCLQiZD<| zR>wZMbEz>}3%9lRgTf3_0B-%T;H626St7 z6}M*C6N@>%Ff4@(kbP3yhkHOU2ps*8depM-o@!%`f-;ogQg68=1zuqgp=fk2EUYn~ zn&58rU~GxbH>&rB3KT(P86ujRjlG)2&lnyHW9N8QGt)?PsT#P_KU+@9m{nl|V@968 zZ%&sOYeqdz6)O@tcIM+&cVEJn!QR6J?gOO;x3!@;w|rEs!>FjVT4e0a9ax#_cvBRk z{_VE!r#xaDAv9zvI3Cv!@!bHuTb01uH8eJ9ds;%if812lUQi}B@bzL0p7HjH<5ebq zsptAvdaXZ8?*H`lR^eU+;vfb?T(4#NXY=eMt!ip8A%)EcYjzAT+6)t=uw^EcqZGPo z-;Fs_F~E%1rQOe9H%)mv6UpC>Y|JAcOB=rvWR!^to(SviA}S;VZyIBu5E|uFoGrKJ zFhARKV!3Qmer=gUkGZG9pi7(eRiQWWjT!|83bP%fUm|%t7m7)3@Pg$8rWDUix9IxO z!GuMk<-YK$fzA~R3wx(z$5x)c_iQ)gU)NuOf6viq3emTQZ69H}l+^7%qdlE4Qw2Sb zQ)@)QhxuiqG+zAuM^}L%lh{>xne3Xo{o3~qGzKPZ=3aLjGp`x;U8h{ojo)JVB=GjV z!;+#R*w#mY@E}=I+qShK*269uX+9GwZ-hxAR-Q2ximo=V)0MeDRPfoMbweFJAgEUd{j|pQ19}p+r*Mw#w%8>b& zAn|j1RwUfyM?7t7sM5^oTC1%3Y0L#EQ&lLcxjQMxw!9ax{m;qre0^mFWsLdo{cMe@jS9`QmYpNfTFifxWS7hP-(K84(7-Tdb$`q2- zY?)8r3PlKoaztsKhaC?}(J_JTibny%X5{yQZ!XZY?sigZqtVud6`3FIz@Pyw^Gtk z`#&f&OOhu?ho08emBv0!nB5d*G!620r}utM}JiE34eQ^mUm*XVfW zLivqDbOwa;u|^*aAKPE2rrqNy_m>1G>Fahgd^I>hROiQv2mHA2fO~ zD|>m{@SQDJnO(rCs$~6Cv`L&~{iW&%!xxfk0(~@bsx)}i*fN>XDWtn9=)-FKi>c@5zc95| z7+QORAe&GhIF+;G=;y)&e z&!k`33!j%$`G5kTsUaB!##UeKEJUpAFRf%Qmgt$OW{@2QnP+5z%BZdD_fh`g=J_T| zObOp%63|s*B_YaEpec}Mv16B+-9@+De6>U|<+7wa|0@jl7 z1NBwA0g@e|CW0wzxmuv@3eW*N;_B#B_|-?$%}tLwxuVM_ZyCY&-qC*~PRf(Y>dp;c z=@TOJ&xkVHZhmXarqVvg?ifg~s?Mjm5PaiH)ijlzor{0{@r3!lrCf;14+__Zj~Yp0rn6rJ1OA zy)K{C6ds`tlOo(6X#$a5+G?U{#;U%Khz2 zj9~LfJ`yMe!NK9RIY*e>!kXPt!LMY6S@2yQMqnUTxWP~%x3?OxRSyirw7jp8wmGHP2IHLCw=qyH=09P_(?KIh_5 zz2OgvecA3R*`Js9-rt(LfBDM{uwckg|DbR{A59FW4*!!)aXR)LRXRV-M*AiAU>Q&>3?kSH_v0zgRXpfQ)9Ij~FxR#dR>dm(9rW2-Q9gUb4 zOhi)K$~L#;X4`rwbZ1M9gYx2{>a)jsMAEof2E9K$Rp%06NVoA7rDVCl^c$`8Es+mMMv;o<74z{O9twQJcEYQW>kgh!6OjDiTm=(&U(>Fgbl>hco{=3Ar#b-BIPo^zALJgg<*t9Qn;wc;omYb_RV>+DO4V$p_}zHRV1F4|>grv0!0xI%_sbH}H1rSItF!iD^; z^xNN3=up0n{4QzWRa{~)c0{=+S}F3X8omSQ8l)#zw;*(0G^In%iAjii1d-}#2%WY! z?*_3vny4Pnq;c6F^a9Pa+49sLeuC~R$mxkc=e2$x8uctUyTt~b?8&a_C)^3Rt|ZGE znbVt~Y%_JSO)5#-TRbmE78ev_R3DXw3yvL~dbPZ9h(Px27dI^_oh=Jxn$?JF<3)9K7{0sg^9PZYr$gDbd((@K2Kwhq zp$oz<3e24o&N81ozoBAa>QzvA`2frynIUz{cIXEM!vMK{rR#9fb;W68H?0lDHPWh* zth9P410JqXnue}^9N6JH4;{GuT#DT-l`iL=mA_`Rm_SPlE4NUN480mGZK&?zQdO3} zmvU;x(WfU>&AY_NnsS?(70}DRD)~FJmU|{VPdH6Ep7_!TmZxTyua8aspa{{~(vWjU zHu_|JSi+qiyGM}f&VtWE=&2PCYt|m!i7;xj_}po3WM(X55^o`Lfi>#v)o_O>Iy?9X z8{`YD@LU%RnL!$BGAT&QH0sLu-nZg7CdmfR%cq&w<1B*4Go2jWiszU;zv#%eGkUEW zgak8>mw}_9HqF4gP4=vHm47{x)tCg%^8(vXTMrdFLzq-K-O^F2^OPQvp=-T5aYyVSV?0$;U-fnN_c3=Xs#+T`Om1l{qt8A$&(vBphBJjL zpt`fB_k_Cq5^xOTVEw%OquA8gMF6u|rj6L-U>q%6or8a$`4m^yV&lYT%IO z9IdYpYZ?Bi_|urWD>QxC#JM~czE)tu4L^T@WoFaTR94pajCYgoM_+2|CEW3~*fCw% zjSzX&nTZF4)m_`FQWG9RGwf#aH9g_AnIOZ?aicxYF&8S%Z1jLlmdjZ5I84p~~ z#RA`|RYW*%(&@_VzpQX~<>8s`MESNEqYoB#E`EBi02)_8urM_k#8VC3wRxTEy>rm* z(0X)_4-LS>T-rlUcQEJgQPTJCzwdSbYv23dZ=d*M8^ZMGwfisC?|;`;3U*@_rZMXV zKt@B=w#h$>@RtfqHP$UiRNPB1YJy3}7dAh#wQ=(DX#3MDzhL&im)*jHzbm_mwo~hM zjBT{xB3^oFZfJ0?;+T*jTWpA>&}8ewSjh{y9g84Mfs1VFtT);&8Az>*s}lH#%LX3` zF?Ykm>TZsb_?w3JIm{RcqJisWYtqzD_qCZODZ{Yc>PhnbmI>nX+NBHE8t>KnH+e}9 z4j#!v*?h8dKzCAC5|T2LsB5B@4WtPQ)wS)PQ2z2?FKP0M3%ty^n{1jIW6?h0#Y9jF zQM_!+Ts0glmBiG&(y(t3{~2r}VUlX=kUqTTe8N4VEHaZnoL=Qh1m&J7o&BUOgmPQ! zP_&6jOvgJ*J@+u?O{{nx!h*Nt>R6kdOH!WywQqLgXU*=I=3mdui`zy4s2d@N(_-dj z)Vo$INlyJip$H>KVHX&1WsC(WSr}r-S3J37#ycnqIZmpj8Q*F~!zO9U&_DC7b&lV$96Sk#=L1tR?eZ=!CU z9_gNcVd#4K5+CVecAIskcVe^8RjkzBPA(`B#{gD%>q_iZW@zAM=m25EsmTP9(eFScs>2N899mK^m^3t~uyPmhVacGs@KE9_}cAYhE zSpMBc--w3^ZK1Yh;s)$_XF1f}rv#|@;Pal_fYG1cXOJn{P5I%F{Ke@ci{^gS>2v~* zp+W9*p;>>UESvk`!cCw$n9KR%Si3tM9AVMgq(z%i;lV0Q04kK(r0lg$f;Q9aYN6xx znuumQZm|c1r2gD2@$-zgW)sFBe&x(`D_YsMCSis4`8K^a34TKZD&auM-q_Womzoz! z45EVTR<;c3ikTK9;x`PUXVm=_$DKik{0#|CfzE3tFjenoGk5DWHuGcDE+03I4Zh4e z@B|s}zwd||(5VKE;c-V48Tec$osC^MX$xL*&?fIq05x6WB7I1{Sd8!5-nX1&uN!($ z%Wkq~u%+^q`O5l9Kebi5D^E={2r)EGPZ<9fsX)aS5+0LS`O+>O`)+f=1%du7Px>!G++xK<5INDpU?}n&+On%S*YS20- z1Plk}vayi?U;K!;Ws21B4xS%bg;-zjYqG_aGyBTR%^q^qCk#INK6#}!VHCUEu=Q}@ zR7;Y*ed*U=qf^rf4<{{=Qe}=;13JY0yo=m&i6#BpYoHk}zwKJ4<=K`x=6;0KO(*Q2 zWLsB%eG#)*vxlW0((~e41)ba#xjUC%eZNQ+bR&B!1#PD=!zQ`3{#MrI8FT|>okpJp zt!N5@=W~l>n8e)Q?tBT;_3#5}n|*L|Zv}xr5CxW6lVYa=3#@~z&?UZmLyH=nx;$a7 z*BU!FZ!Rv}x+OKgRaSQZ-BqeZSYuR78HTV4NI=8!n&d3EK|}K0HN$IX7P@8t!vlwz zk{y?J^Qp8>Joz9NtjVp20f;TvuZ460#CCkZt8GlczD@{AW0AmDoCe(;eS@YV*do5f0|{(p!%|Gu19|i~ z-O5^6;J^{@iWPs1*T{%DenttuDk6LW5J^Jiehzmv_DE4(R7I&6~D1f1UVgb zC-IyqHVvo8ojTeSJ~Tz1MOYA|3Im0`>}RMi?LS7zHYX>S>p*im&iUa4 zy5QVu#%kCblE%8SbZ3C|xU@TvsK||$?M7jmTx6IMnp+c(#qJw}t~*~5v*`BI3{&`c zIoy`PN~7Ug0VEU$prI2-l(QDMJo~(=WMB}465!P_dCxYy_G$`wo_xEnhB+^oGWi=LK`TV&!YJm zlocon1Xo<=FM-ze(fhsYeDIYw64d^!J)Lr56YHOdcUe>?sCdkWhu7%9g>cs1W%ZkflkiI$Ev$u~uvwC6tk)MxJn12uc$Ygxaea4SY!Qz6qh49kpgw3>Ou z6dQ;AP6(W&2(m2SxJaWB#dNFw{JDam5-s3?G?sX+ z9`h<$e9+5%$}=DISRy24t?TI!cjYVd*lXs4c2|O>^;z20*+ksC$LALLdtrejSNtX- z;HtKG&!eikUNqRuZjjg5?paM$b?kzx%Y_04)*BTHEWV1mItW9#TVS@fNe37VQ@LEX z7WRvRZ~5fULX%&;{wqS1zXI|9@iYIlqnU;LD^TyHOzl&3>v{Ww0$^E5>@z^=Cq+f- zE>##py=w-zR_W65=bIPu=PE$iGJD13-o~q+pO;=U5D>OZMO&1XdWSzttuaSJJG8Rt z7397sN)B07YGn;zskDrKP?RZl$;3F%m!Yq5Ux;FNYLSY#Fwc6nS#t(4n%JPofc2t; zBB?uF%p`-c+M;?GvaRFbFB|%1c@SPybsP<7MQLT5)OE>(h#$!6os%<-qpwLp!YJC`^SmPf*n$#quh-NN-fp2{<3~GSdYn! zO9$-!n1K;Hq{EiI9hz@V?c3ZXi!a6NcV!%^i<~w_A)3W_Y^43AkQty(1E@Z8=;+!} z0XEha{=DE#BEXBau`xlehqN9qrEmyrya|Mtfsvpe6w%i+qobD)t%#MnfQmjdYl89& zU+z>mi<{!ugMMeo1@&xoFLw35=~tPRZvE2A3-<}Fbh@VN?s_^@QJujrc79NdRs%y0 zqQ6jo27yOMNPSmeREfD0iX$`boZOp}qpW7Y9(zjXU_4+Ng-yj#*^Y5iaU)3BUjYq z;%s<=S0s_a^lrHglOpkw+MtGn$u}jciYfWLl?gHjHxsTO^EZC#WaWH0K;GYg!dHM- zPxY2!@DGZsv&`486%@37>@$;@!i=7Brad{1Tb|??&fAdOpuJNNH|UoXF(lmS9_4mF z?o7nXc30uHmzh%<6bsoTB(V%X{8nCRI$yc5N+e^3YRyx(asU{#Ag9}(9%G3HZ*eKD zrH<-mqlk@?Zy!f7&w1C<2y3>Y_r|vRh#qn*Et<_bupbmLz(`(iX@!Ph!p3>BZ6$<# zd6XtUZN-quy2%mBw7)!dH8{m-592Z4t6-9vkU=i80o<0|SnUD%q#*wG{^`e1kw6>$C9 z7GxD*Ed(cy&Tron>_#Zwv>~!RcNJgq_?)ul;g^RMsSck$&uAo8{Ky z3cV=)cyR8T_3lJrE#Ghy;uBN`<~*>7?f?k`S{)*rV7uZapWZqa5(eMXlzhFnK;$yI zuda`J*<`|KvI}wbF7F;MI>8glZjnY^BJ1l?e#VMU{XluCyz1S)8-62Lii%ofroUC6 zz&w)gm!CKe8tY()I@$r(GhbtAWZ$zCdl7^RO&|Xto1W4RI$e$_oJMRZcm!Wd=l(UH z`oD#!e?!(k)2IK=iTJ18u%E)J&ixaZ|I{5Tphx;4xWcmtiqSJ`o{dZ1LK4d!Qo$o_ zR-fD0gv{r+*5+bZS|VG#;dcV)@>9Yn4ICBrTn&VoVF!hMNU~! z@)+T{@MX{2bM(5XD`I&VK;^q3`{a~`$OSs`siN1d5PT#pJ?Z6Ws6MK!*L94Fp$6uH zc6YdZu}&|%eY50s=%*JHK5=-;#!;Qug*7tN3z=A%WX>{tQgn97^MIE8C$*v=x;@WnI=LHBgkcG-$pY=4mJ#9Jz^C(U`3g)bzYX^5AaBjyny_B;jOeQ<1!z$PhOvJw$`;NI^NPp7u;@0GY z)pgb7vy7v9_a4tmK}AJ-$hgUt#J82PKm^7fcbAtwo?V6TEF5Yfl9BVRHaP`m4s(U_ zC_YzuRuMeI`qC|)6|2F0)7kRo{gv@2#OcLC{H>b+W6ET7F2r(L%W=}-=;AVJKj z-_BsQ;;oOqv2E*hyIrKX_uPSgqn3#@+HH)6^5T9f9lW6R0Ya$(%N&dhf47DcV4RFa|@R z0FMg>U+A3Vs!K{K?8yKF1IjbwMItkx!_i}9QAKZBg-681R1VbRY>&r&)pF}NGZL?| zue7=Wcb|?!5%_~@RP&eVjqbp#9X+K!C#qbialDMOd2-vB&!3rACZW?@yL0yP0Vkta zxX_2#HQpsVc(qI?5E(=3Izq(EB06F~M=VpqikDVGGPOS0PD%{b=%h^=o857D&r!GH zT#-zb41EkTX=Zs0xw&ZP&?p!1K=dx@l)Lk+5=%!8EMY#}ZygmP7wDwrzUI@Gt9&}i zf?j^H9XfCkR3Q+h!okOB%uYG}Jtw@HUlIist(@@2VKc5vCLEyv>Wk+Y$%XnJPTfz+ zGjQFRzI(IA=$nk(4b>}#S04MFe5qlY>;StLe2r&O2sxJuLlVyw0VeI?7{H|c`$Uw2 zu)ma?@vp1rA5t{_5asu~@UOpHbpNOC|5P9Rn{cr3A;oJ@6CL7i62cAltqOqn_QiDT zQHx(U+pQ|~h;Q0%%1a-cRq%7q3Q;^YLMm;Rku7ygX=1aAnIpQoj`F4OmW)iAntTmE zUto6nJ=cU<9=)o;V~XrWe*JGA&f;^V9{U-%j#juz{|;PKC%jqvlj$;Z?^qzhgjHlZ z`DVcT{wE3*@OcKh_7n7+hQli%MWjdROIRl9$Z@kW7muCcz%-$yXnXmA&Sf9Sj(Gvc zvEgG5Iy}S}F@pt+x5BNb7|Cr;El;&+JRlPKl7VQbS7p$r{}l-N?f-wGu2=r}*!;)D z^?zWEf0@Gm@BWPg8FY2<8Da8GmDNx_5IQk}o=;vM$$D4^&pKwHa(R(sv3NFF;f>&HAk^=2DeWQLt-uUwYZ3yza3_vSPB_odR_(1j{q9@yy!eZbBht_YU?J_0Uifryy1X`&+}HopdNb0=4x zPG0{S+mG8n%6s=Jog`#T^*A5`D**a;gI81uC5b{(0U+V8a)wESb;U5$qCqn>{ zsXJy*ph|Wt6gKOVlu8-}Qyx%)YKzON%8LfQl;IqdIs*j-$KRXBIdzCVqi@hsznBWh z^{-95vh7#?j3;V*&D~BLt)qYa=H!lF?-Kk~%L2+^mxv9@(PCy)<2GZ*1=|rP^>Z1?k^Cx@6V3B7}biH}SQP6+(aSMm_rKGfF zV)EsFA(XbFb7fKOD-rmD>5RsNvf%lBUuuOREN-!M+r`CGPO;MvGCaElHu(Pa&re5{ z?DhX#;s3I_{B}PBsVPipKxoR);CjB@;!#(T05P`fxZjo?Nud80|E)!ZRu0E+hCe+| zbLzxPu-gZp0VQ=8?|6CfYE_?A;&Yjz*U|Iqau)IK0^@?-!?Q46Rle1UHyd!8^58Ae zGoiM&9NWMKYbHl4gJ2(5m;}oH7Z$kt` zX~p4+l!8T(o+@MH$6xtt{>MS-4hKNHH0ZZ>=?{uSPHQkHg&SWb-T+wDO-N}4g#l}e z!zgdN`t97kOWa~5THccPFNF9k-H$D?gS@K@(xg0Vq)v2AX-+`Bxg>%|6%?l4^|BBI z7!ZbD$+)UA87AJDapm<;6V-8=7FB+jU+Vya-qI+}!S<*MH~i?6;X4m!opo)W`+JG% zB&u9DWMebH0A!SBXOlctwV#d@k%G3Efz~j_rb8Y7Bsm*CQhPtV9m|n?;%PHm)Bk5j!pUKw=aiQ{p zlrKdj`Fiu^m6$%qPF}65@&#$Dbio}Fuz7V3e{;VITG4n8&wGqIH|QGGANSQb&I&(O zx}-HFx5lp5+nroK$yPJ?JOS`Nv_~0KiM28Gob!#I5fxVv`tBO|&cE=}=WN~J`GM(D zGi~QXse!NTRrcREkm>^iIuMCPxQr@c@eSDuNjQ%C;#!s88WcL{Nb=yk+a|JIlaT|G z?B2=~swj69jp6ar`grH^dDyo)W|AuKIY{FR{dwcqFe^mE4~m7hWt=ypkSzU5mEqy9EMdpG0T#1O1^a_yl@X8`rxgm&GPxOSwHWpq znVG6H``txUmj$8|efDNpX>JtF#_DQD%ROMY;lBF&Vs}XGfoQxPUqPM&bKUtAZGxoi zqW_$4i}C19loqRa`EJD9YtiRu+9Gd{PI-MfX(wIcysh`(p@XKPub$?2pa{Ej=P$~z zDE~jW+Estjfc-W{`p-Siu$O>Kr0J|sVU0!Z@;)vI@ubgkFdZ)JWT|z^_bj_j@ZxIw zCG8x=N4MJexx*yAR0+uo9jb%817zV`q^*gL1yHobe%~B3?U_$sK0ie<2EJQtXwb5K zLQ?pl_ZlfQS2{&)c-$HHs}L%wPE#)*d{;`Cu>AEGU8l1pi$V9Iz$T~5D%Q_JLSd*ioEmLLc(46t*5npy#$OxnI?XdM=j$4glWAq%^ zFZ6wvNRG2T{xzBz9 z&Q6XgzdV_JeHzw4Pyf#|0D%hhSohDC_n*(zusQ%6{>mTxzco_e|6s3x4D#u-K(MDM zVimZ_IVD!P@S%VM!0Ld*$1t9lUrk(VS+!5D_+!2J^FjY1;I1I7CR&-0w=zr1)bn{I z8Bob-R#c5;sHc4#sChqQFtf7SDDLoJK+&;9?%{%=>-WTi{3DCf{s|KZk}Nj<%X7?L z;ANMk-}@7ZMYp^WS)Nt=T;;pxR|)O+Pcj3`oE+Ceb!y&Db%b zu$=oue9w8bi?5buCe?fk!Trc0B}u$DJy0U*+j&*vEeAjrI9=;B4i<6d`sFpl>`!*7 zyWUs0qovLKIIMsC>y@p3URZ-)%p0u*>y0bAkSDiJ($m<+Y&3@o;8f%E%h8pXvXJ|) z4WRT|Zgh79>Eff@EkZ%Z-mgEQc+~ykJRocz9+yKxhO;w%btRhW7q+Z$J_h1=OQN9i zH=VrI)@MeQ_>9k&@6xF@rjY(V8)~lop&xwJRG%j^++1qf=FH@hQtq>5f8Qn>xiK?lZxZ!AI{UQx z_r$V=r^OD~%A=jiW&aTMB(1CQz%FR~wfid5Zn1y;TOa*;-*R_XV1+RytNx4n>-g`# zP6NkpGBCo-gRc*C(g~_rz+xBeR4(YTDFgx>asUh7lch2sN4a>J+W!*%y8idyRA5sO zcr#kyO5l*p{I&J>U+e$#1fHx)Z#SU~T)YMjL!tSUh;y}8FkfB`oC0l4?|z$m{m8CU zFL&+s`EKPA?Z5fmG~1q2$M{VI56S}%uq-^9iRRzMXoqpBP2T%!bxnKOwy#>*^1LN) zlkR2Qd-aKJvVXT#d4DJh?bpPR-X;%LkzO7x}`E_>qj6>hQ zz0i%4b@I5NK2sxu(=8=5>{CxNmjUCmbp-4U2d1Ft`=3+3Z2x-sPcJ{;3$uTc7av~E zjq_CKoI7=y!uB(7o?9@KCg0kbX~*|cd-2_foA+Kxl}ygcUUjrG@1n`JOAFaddu(#% zMK!jDg)zv-Wv8S0Odd5kX5|8>Xn>0~7yRk5sN;F@dfA<*nES8FfnBL>`?t-i?wsJM ze(PyuYRw`I9!a*l3m9Ks=CI>GsD5jmUXAbixNKq1e50&SdpF&Q-XoXLJ28m0``xKm zp%Yd!6>+M}y^oeV(fq#rDRAxl85`iq1LdYAv38HWE+=l?b>-dGnU}5C=ZA?-^O@xK zP$XjxbDu~7TT$ietH5dpC5@uT8T9-nv}}W3L_p4sR+XCnm-E;4zyE-XY@Pt`5k$>= z(8HbyXeZM?v$5O$eV*3Ut=4PRUVAk~YkOy0d*=~3ck!f$Gy1jM8InR? UxmUd;dEGXt>%6I Date: Thu, 22 Jun 2023 17:09:13 -0700 Subject: [PATCH 05/47] newline after pic in readme.md --- Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md b/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md index a4a13e26797..707ce93dc34 100644 --- a/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md +++ b/Solutions/Infoblox Cloud Data Connector/Playbooks/readme.md @@ -42,6 +42,7 @@ You may wish to import everything, or you may only need a handful of threat clas You can modify or create copies of these playbooks and tweak the action **Get TIDE Data** API call within the playbook to suit your needs. Keep in mind due to [current limitations](https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-limits-and-config?tabs=consumption%2Cazure-portal), there is a 105MB download limit per API call and a 120 second HTTP timeout. This is why you may only need to import new emails on a weekly basis, whereas hosts should be imported more frequently with an ```rlimit``` parameter because there are so many more. + ![](images/tide.jpg) Use the following TIDE endpoints to see what is available for you to import. You can also view indicators in the [CSP](https://csp.infoblox.com/#/threat_intelligence/active-threat-indicators). From a7204ee4799eb48df27f3f3abd97561d7bb6f182 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:11:16 -0700 Subject: [PATCH 06/47] Update SolutionMetadata.json --- .../Infoblox Cloud Data Connector/SolutionMetadata.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json b/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json index bf5fc36aae1..7503659713e 100644 --- a/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json +++ b/Solutions/Infoblox Cloud Data Connector/SolutionMetadata.json @@ -2,14 +2,14 @@ "publisherId": "infoblox", "offerId": "infoblox-cdc-solution", "firstPublishDate": "2021-10-20", - "providers": ["InfoBlox"], + "providers": ["Infoblox"], "categories": { - "domains" : ["Security - Threat Protection"], + "domains" : ["Networking", "Security - Threat Protection", "Security - Network", "Security - Threat Intelligence" ], "verticals": [] }, "support": { - "name": "InfoBlox", + "name": "Infoblox", "tier": "Partner", "link": "https://support.infoblox.com/" } -} \ No newline at end of file +} From 69dddfa2ae8f3815be1431f3d06df3314c6c0191 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:13:21 -0700 Subject: [PATCH 07/47] Update Solution_Infoblox.json --- .../Data/Solution_Infoblox.json | 45 +++++++++++++------ 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json b/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json index a2d56eef958..cc5c81b387f 100644 --- a/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json +++ b/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json @@ -4,23 +4,40 @@ "Logo": "", "Description": "The [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)", "Workbooks": [ - "Workbooks/InfobloxCDCB1TDWorkbook.json" - ], + "Workbooks/InfobloxCDCB1TDWorkbook.json" + ], "Analytic Rules": [ - "Analytic Rules/Infoblox-HighNumberOfHighThreatLevelQueriesDetected.yaml", - "Analytic Rules/Infoblox-HighNumberOfNXDOMAINDNSResponsesDetected.yaml", - "Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml" + "Analytic Rules/Infoblox-DataExfiltrationAttack.yaml", + "Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml", + "Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml", + "Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml", + "Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml", + "Analytic Rules/Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2.yaml", + "Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml", + "Analytic Rules/Infoblox-TI-SyslogMatchFound-URL.yaml" ], "Data Connectors": [ "Data Connectors/InfobloxCloudDataConnector.json" ], - "Parsers": [ - "Parsers/InfobloxCDC.txt" - ], - "Metadata": "SolutionMetadata.json", - "BasePath": "C:\\GitHub\\azure-sentinel\\Solutions\\Infoblox Cloud Data Connector", - "Version": "2.0.10", - "TemplateSpec": true, + "Parsers": [ + "Parsers/InfobloxCDC.txt" + ], + "Playbooks": [ + "Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json", + "Playbooks/Infoblox-Import-Emails-Weekly/azuredeploy.json", + "Playbooks/Infoblox-Import-Hashes-Weekly/azuredeploy.json", + "Playbooks/Infoblox-Import-Hosts-Daily-LookalikeDomains/azuredeploy.json", + "Playbooks/Infoblox-Import-Hosts-Daily-MalwareC2DGA/azuredeploy.json", + "Playbooks/Infoblox-Import-Hosts-Daily-Phishing/azuredeploy.json", + "Playbooks/Infoblox-Import-Hosts-Hourly/azuredeploy.json", + "Playbooks/Infoblox-Import-IPs-Hourly/azuredeploy.json", + "Playbooks/Infoblox-Import-URLs-Hourly/azuredeploy.json", + "Playbooks/Infoblox-Incident-Enrichment-Domains/azuredeploy.json", + "Playbooks/Infoblox-Incident-Send-Email/azuredeploy.json" + ], + "Metadata": "SolutionMetadata.json", + "BasePath": "C:\\GitHub\\azure-sentinel\\Solutions\\Infoblox Cloud Data Connector", + "Version": "3.0.0", + "TemplateSpec": true, "Is1PConnector": false - } - +} From 905ec275bc42d08c490de3d97ff67ef6fd740285 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 17:17:09 -0700 Subject: [PATCH 08/47] Update infoblox_logo.svg in Logos --- Logos/infoblox_logo.svg | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/Logos/infoblox_logo.svg b/Logos/infoblox_logo.svg index 458f4db2ee1..98c894b0fab 100644 --- a/Logos/infoblox_logo.svg +++ b/Logos/infoblox_logo.svg @@ -1,11 +1,18 @@ - - - - - - - - - - + + + + + + + + + + + + + \ No newline at end of file From f2bba51dc0adc5eb9230a2d2aa6dc8681a12dda3 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 18:30:45 -0700 Subject: [PATCH 09/47] remove newline in description in analytics --- .../Analytic Rules/Infoblox-DataExfiltrationAttack.yaml | 4 +--- .../Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml | 4 +--- ...blox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml | 4 +--- .../Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml | 4 +--- .../Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml | 4 +--- .../Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml | 4 +--- 6 files changed, 6 insertions(+), 18 deletions(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml index 5e5b244db24..ebc59144725 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml @@ -1,9 +1,7 @@ id: 8db2b374-0337-49bd-94c9-cfbf8e5d83ad name: Infoblox - Data Exfiltration Attack description: | - 'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. - -This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml index 5897d273217..199b65528bf 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-HighThreatLevelQueryNotBlockedDetected.yaml @@ -1,9 +1,7 @@ id: dfd8b74c-735e-48e4-9b2d-7f1216cb2283 name: Infoblox - High Threat Level Query Not Blocked Detected description: | - 'At least 1 high threat level query generated by single host in 1 hour that is not blocked or redirected. Customize query count, scheduling, responses and more. - -This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'At least 1 high threat level query generated by single host in 1 hour that is not blocked or redirected. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml index 015827d40f7..1f0385658a7 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml @@ -1,9 +1,7 @@ id: 3822b794-fa89-4420-aad6-0e1a2307f419 name: Infoblox - Many High Threat Level Queries From Single Host Detected description: | - 'At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. - -This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml index 7351de5dc57..5fef11bdd9a 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelSingleQueryDetected.yaml @@ -1,9 +1,7 @@ id: 99278700-79ca-4b0f-b416-bf57ec699e1a name: Infoblox - Many High Threat Level Single Query Detected description: | - 'Single high threat level domain queried at least 200 times in 1 hour regardless of source. Customize query count, scheduling, responses and more. - -This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'Single high threat level domain queried at least 200 times in 1 hour regardless of source. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml index 8c5660eb29f..24c35aa5c0f 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml @@ -1,9 +1,7 @@ id: b2f34315-9065-488e-88d0-a171d2b0da8e name: Infoblox - Many NXDOMAIN DNS Responses Detected description: | - 'Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. - -This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml index 3f0a8a858e1..f298b6da80d 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains.yaml @@ -1,9 +1,7 @@ id: 568730be-b39d-45e3-a392-941e00837d52 name: Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains description: | - 'InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. - -This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' severity: Medium status: Available requiredDataConnectors: From 0f9a5a1d70c97a6abfa50ab60fd164189ce15387 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 18:40:50 -0700 Subject: [PATCH 10/47] remove data-name from infoblox_logo.svg --- Logos/infoblox_logo.svg | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Logos/infoblox_logo.svg b/Logos/infoblox_logo.svg index 98c894b0fab..1b75acc3064 100644 --- a/Logos/infoblox_logo.svg +++ b/Logos/infoblox_logo.svg @@ -1,5 +1,5 @@ - + - \ No newline at end of file + From 571b043f6c8708ae03636b960d0d91e6ae4a6384 Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Thu, 22 Jun 2023 18:48:30 -0700 Subject: [PATCH 11/47] change id in new infoblox_logo.svg to old one --- Logos/infoblox_logo.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Logos/infoblox_logo.svg b/Logos/infoblox_logo.svg index 1b75acc3064..865f8187914 100644 --- a/Logos/infoblox_logo.svg +++ b/Logos/infoblox_logo.svg @@ -1,5 +1,5 @@ - + Q|-puS|#7=xmm}@%5!Bd#P+w_2%~o+l=&Wbv&mkWxUC`jx5uU1%Fhz+no94) z54%-u=5E5?d$57`lv;-KVGDcVYr6;0m7p||pZ|>hDbE1;oG>!m?twrWf7J{?I?dkd zajAzS?f?rV1~wNMz88D94Crnh0u@5CjlW0z%^hYBxYtINsBC@XXxGlxF8B17x8*o0 zyF9;oF2(Qo5ffRRLNMIzrnsJ;anvn<`DvfdW|oa8=@OWa6WJ?j^>VY{I-@-~;8J(B zlH036W;8N!O0sB$iloulQBJ1n|m(61b>+90`A5?D|%(VHH>){@@C-KTJ^zG%?^BddcykPi>;B; z(HauEH?BroyR%62VZ_*Ih+SUQ2@B8WqKJ6xhod>*ryn-+&_0n+v|mZhTDiq=1S!kC zh7~&$+6){mZPoRPM5L{<$;#b1GkJQmpX_}&k9@6^d~8I)m0X9jY98NSTtr!$S9k-T-#m5TK%RV^>z%8pg68H-sQt$;uFdt*4XFyF1y@ z=AwS>=3JDrNqtWIEo{*K?54(09j7I$E0t>7ZY3KRz`NI~8Hl{y4d&^ax_MSD&b=K9 zkQ-RmHg;9Go9KbP9d#vpyClHZk&hs+LX0-@R$7Y%8i<=BoyJvjm=3S%i?OR~6|HKq zYRe4OQq9Io(?X5Q7|rKy9D6%7pw|+ttxRh0S5pIfyBf+i_DO#)r||i%UUzQ@LIP^RU?JQ zshn)!n`@!H9n~N&uj9QPI+&YlR?t^hOnbXp{ zo4_*7OP9)^?s$#ns}dc%bY3Sr`q=by6rk4_tS#<;P;v(Lw^fvFZWI1qX8)j+{s-zD z?H^Rl_PI-DbAS#m%PWn)N2dmBrWdTj?9#Pn_3D-8wHRER8+3q|8tlz>a*$UmLz~+w z%2uaIUw7xv-VQC;&A5$p#uHQ^x5et&x~tO~hVr$b6+l6SiQ2U7cFjh$T;Zx^jCErs z_)YgeB&8rPyMIX3FgM-*kaRKaZ>#y+UL*d4#0=i_LVU_(p(jL)wJ}FR)+B1Mi9Qfk*DEN^lQ~wEL z;YQkpMZ@fYz!ape%v8Vj17L{wZ}T7QxPwC4!5w|rQ?W;kw$gd+_Is2ZY4%(W0uJBZ zmjUi+mefUld5PGwGbG|8VNq*tp<9frh1tevvvv2@%gjBY#a3DPt}3QF23O;X<2oHF zdx|e15xkH6ApL2U$LT_7r2^=0&1mxR8_3FT-gUUid$UZLS^Xni-vGWcRNmDAwDsqSGN1D39`7U zI|c~;84>sOiNmDmW_757=u>f)78uA1$(A^=77z$BS5Az~M5|mK{wCZFt<1eg!#O_@ zb4j6N#E!IgOm|GXJdw#I4h?lotE>QvXl)s*B=v?aC$a+8qrWTaSOu(5gqlXMh}DWH z^H^4q=1h&gNI*_I&8;QyTWVk*L)aAau#|64pKi}h{6GKBOILKPkgF~u>GS=0EWGxYfhE_I=iYNVXAY({rZ#y`< z896?49A6&%@KQ!L&<6UBPX%k_FOz*;u5>5Or<;l1Su#~tll3*-ELB$M1063|hB}=T zE6uBDm&P$DlKM0OF63%4ejx_(oO75h)WJ3fWulDHuj73Ua&##!6Su;AVq~E%M;I#_ zSfMUZ2I^+8j8#e~gIrdT228urBm`&!b*%v4Q13EdeBgxziVuw8Ez^B@wsc@Fk+o_& z?8r_Xj#KA!uudHz45gi+X^XTGoZHRAIO*6DNB~X@r*9d5$n&}IcGm>7$b z!)dzn$rE0t2h#E}^xeh#(zOUZPb&y|o}%}~tu1dvkHnIJdT>47Tt2BG3qv1)4Ga9>snex>yzRcM|8vjnJ~D} zV&!{gWYN}}~_Q@Qh2gajI1Z(Z&X)N)QgG%mvz#NCg$HgkjY|xlc?aRy1_38_p z*pSM-sZ!3A73V4qX}75&K2@sfjYJV=BbLP8lg6WG>Sg_YY#vxl&TUFIMsO^U)BV;? zf{R2APN>#q%{oq&;DGj zwF)Vv5J_c}lZ9{qfeEV-O0JEVQ4$4v3?1OodO?W{|8j)O1$+P8(JkVDOz$^)q(`a$ z1q_Uny5iZu+=8Q_u^)m_X_!)r@Rt7S6?>bkM%ES$f9zS1W;HA?9(x-*zPpT&_kq^{ z9SmQ)hpZz9t{fYd0)X=LuGjYCKhO&$mh4H~!}txy4FNh`2(LVVo*YIgKg^qR(^ZB9 zZ*wIJ#`{pyXKy5d{X?NwyW(l@l2Gz+WKE@Ty%`{n)C4*c9aj}I+ z#MK|M>QKEGG|>7gxcZ8v(CcVTgG8=E_9Z1n-jSge&KXPoqM)G+B!v^5ak5cJ(Qt6RDZg1~K-`3&wj>3%4Zw;f0P&&2&&W;p3R!KjChX zO#XV9#Fmbzjpib%!=?gNMYxFvK=}jR&@*fywwF!0N8ldLIgJ=ic4yC3&m-#3&!ZTp z*Om7PLsZAvO+!iyGvwI8)J{QmIfX)(2_blkZ%O5vDhC%ohAgN&K~@hFGu^R$r#8Ju z9%+!up{IF>3cs9UZ-S9{UIO$ZZX66(iVxV0hjcf}-eZ5*HEWvqNfEZSBY>0&s28!{ zW{p2H#-+vWh+v?m0q1(NgtBFUaH752E@5m$$Fr8LSkX3aSh_HZN*gI$1K4%1R%JGK z&;NbG-8f_%UyXI0E=vOkkl&xXZ?D}=Byh%;tu}hUugVu~)WhsfuC6SW0Pvoar~Q5u7J80`B%K zRkFKnu9$w&?cTsz&#qWM*IX7fn{C>(abmb|PHhSx4$K|dgNxg*WNsq8Ol1R<`+@OK zV*vn`3E;-e$kudHXqK&14Z&`x@Zw$jvt7~J85FvH%`$y#7jC}W&`QEGuI@Xy1I%*f zT-kh67lKLmQgKqpTNa}!`zBw_XT2IGt@(p(7L^rdyj*XW5Xl>hh!MCUU~rKwDlw&t z7V>`FdJnlP7PTO_Kx7cm4`W@trM>v7vjvB!eyvtb_ z_a~^g{cVH~=mdL)bpd!5{x1kr~l z*n#L%VFYW9lY~C$JmVdpI@qXDV2uz5(>vBL)@Cil0SDlb7Y`eFlc996UU*%QqcKi} zIP-~em)t&%8%&Ds4)adj8EFxNSkmyao$*${y|3!dy^O#x-ov2#hDP5J(p9J)810Z) z8bS%dc0R}3g~v^($nS6otQcFCRvz4SO{m7k3u+Q;06Su$2^Z9>I1V#GZBbSm)@Y~$ zwA@%{;xB8%7zz59#Gl_dPn`oj!nXAk;WBBDegpxMXP(hmF~Vqn<-G=+Tfk#qNSywF z&KzJZFnj+&Hjs265_lrM(5~)TfO(=tLmj|P07dMZ_`w6%HzrKAKKWb!r}KVt0-|6f z;BB{{eTL{3(Q6GRgvNt!lM|&tX1;99;u+_D%$y9pm z&qKx^@K-KI?>K?5vqT8kAT4aZ{-RfR_@9_8(c9s9mv(x??)hyixXV5xw@%mQWe}g$ zot-jZZ#;(W>5OJ}oOP$JzjfqWNEV`)QE}~io2a`JVl!IrCWlW)xdvezzJ1A@NnDP} z=i&wJgxI7XYm_ zUdTH}3GwZleM}Lp<5ii0cn!HYT&@5i?bcfbu<5TPa z>m)l5ASmlvhZz&Jt(6OdrQ8N&hk`{bna^CV6q{M=JOQSNAC3pcD{ItB$B7j0iR zoB)_BN{tnwa_Ip*?@^KgWX|B;wdUX#iGT4jIHLI;eYwYsJ+xoTjSFE+cX`8xq~ zpwms)~V@8p6BtbQ-j}XLfQlu3@nITv))OFZ3b& zHNn5v=4^vH%1x$at>8yWZq4R2AHIWxtYCmbL`wza-(vc3KJnDI{Q3)E95qI$>otZ6 zK11Nc@?dt5z}=rC5NiLf>IXLyz3i^o^TKPV1}*v!jf@E-`8Hbac@K5<`QiF{_xgPa zjxZ$h_scMM(LGq^;^E@`TUnIiKrR4T99gyj{ci%PG(w z*c&JKF}E;Tj1p>3eL|`~L4R&Q?BL9g?M*@s@xQ?;f|%!~i-so~4j?||wJ9u4AV?V_ z5W10!6sX?-(|E%Ru9NS1yOvXr4)Og;@`A1f@{?^r@gLYaJ4dkXQv`4a)1fme%gDbV zyKVbCLf)aQDLp80-p#xMUx70^%nR_tO$UGvWumHY$JyUT*?7!GOfMc&L4)_p#ZqAY`(!-I2({)=GdzvF3b~!)WvM@l#Bxp zV+VM%Jm*H~0C*3fGdz0%UYGUj27Nd5XJAWq90nac^`3IsSs0bIVeRWlY z>2QjgAOGY-BD3FM%C^rKK+2ctBL8}jz&K?voPO=2KMD+=2+6nmu~U`gGsRPTWZoE=RiR;%~%hh9QiQ#g=sAyO|yk1ruu$OoD_< z)H=0+2oC`GQ`TqEBKMfJ2r!}sDbpsvAbD+jTv zWaO#_z(l3fyXCK+;Gau0nuzN2J?vj=WuJ6*b^#>rV-r#MF zm3x`wjycoXXfL31K#s+vDHT}M5I{tT}*B)__kNixa^>pYCiR9-G3|Np{gIX zwaSd7Cz?fjlQnDWJ-flqqLKb=pSYPxfx{ek-hqN<45ZIVU=YXZv}}=|MHu>NKZVtR z-_kC|8|0(UmBH;Jr#~sgn-3eZ;rxt3!g6&~Qm{yT)t~y2YK6-P@L37)zYkgRm#Kr^ zJE08&<{l_f`aS|`7w&0PVK8tle&gNuNhsrg)LC(0x@Q&rq2^mLD9$}&4OfRhsSC}C za-Xg=;k@yeN^X!0<>K$FqfZE%k#s(aN+F@X_&%;FSeYm3Z21m!XL0Q6aYr-~D=vnpkt{n_XBrn+mIb$qH+nW)~ z-5o9^n4yl~9C5F#m7EkUHISo?2-iM%>3E|VA{1j3FC(1DC163F5XUN$Kgx1Mz>Jfo zyzv>JZ>vpUA{Z7-?sNH2_x+RORofD*qz1oRLkn)d#Jr>yZQ5MCzXsH&A(RDV<({=S zkh|nAW1vNa6;fc8@JHNJ)7JnfBe**WYO;)b8@E6MEJxH@25K5b-Bs8)01H(J0XtlV zVxnj?}X7l_7@=kRinU(STAk1%`+8k0;cTmd6++5s8*Qqm5iqq@cXO zoWrl-DC(xeeK6D9+$k}02TKA~c1Wn=(DB%oY#-fdNoK`U5G6nIT`Z)I?AST|rbb8@ zTUK1;K3KT|Y$B4wia>b+p+COw*=`U(48lF?oD8Wte_7Qee_-JocjDo2?7{b5;v(>B zpuE5YytaT1Esd3d2K1z+`pQ59T1sO)n1r5?zdV7yEpiNMLloM)BV@GIVm|@_y#*EEthSQ55(j7CRNs!U|MAQ^C zJeM>^Pe1g8@-1C@Px`Urge&99Qv-kE`v9j(;WNI8B7&~>OL(Ga_s-?$G<{9`lS+R{Gn7H`Ir=q+{5?pKAmWLLw0%E> zf}TEBq(_^5Y(<*{bop&Lu2fNu&rss*@gct|G^>!d&LlU=m}`>7*0_d(NeZuIGcpQ+ zY>noJJn)ozA8)=eyQFo$F-V*g`-GlQdQ&zmeu2 zy-1xRV}ZueBmzF({koC)uKsKoW@0!n<(*$<^SaFrgbupc+9ib+xu|N2uj?95F zA)%hg&4xC9rR;%XQO3muyId$sM`_fLWr=3(0biX|v1MmiY4U-pk8RB`5EP*LOr0&L zZHAyH?@O3$sQnUUGdrzwRDzc(SDFpoo2tpt=e;mq z>YX2TVj>D|EyY4~?%fFd_4b1+=3=@OHtUvSY~l6VzhHVe02K)nc?LlegpL@q(uWeX z3n^ybQ9&W^ZMTCX;*kE9LUSh`vzbg6_2>HK;*+Gpc9(yTO3Jpd z%z{@S0R~whi~9Ljt?2LWaFF>nE9nAhM~YPViEKr3Nd(v8GZd2!`m{rJqxvPy3Rh$^ zkzeVI;lC<%T)whVot_Y}=D+3t9L^ZZE@McK8%~F|?_QjdE?7w}x9%1Fg_FLlVVw7< zz*ow#q`k8YP=oH$+*>xubY3UZX^~8|5js&%wORO2T|#PH@Z(@7L?(OC#Y4y}b*HVX zkTV!r5e&VE13lnA%oH}RN~FA((oR3rqnlosI;2BQos*PnxYfFdz{}0Jknkl`An(@# zJjfDigwCT7%~%D~719^-ga#~vi!nMPpsds762XRrK|+b_{$ zFkp9wx`h~8-IMNdHe#lp!;GhOb3Ify)i(xq~PUAU1 zh-o^7g(MA7wsq-QAoBLU$esgdu6- zB@l*N01VtdNauJyZ<{a_JeanLQ3mTqNAPRg1K>bnKBm1r-jG9AlOrA;OH%Lx#J2$( zqNM!sPc}5*;2KiHJk~_*iBL_0D3YKV^~MsQnh8zfYc(9YY#Uxq?Vb&5QDemL1DmJcG)0UO1)@rhioMmkOXRDgio;K?EGk{ZRH5y>UZ|_KXsc*Lx0B!!b zf`3^j$LjDn?@U*yAPQGW%U5L4#(n_O8n^0FWc)RI?CJx-!s9k^TswkR>Xfcw#R1v} zZ96wEH%yyZF*3SKOg5vtXSR&fF!-6q?2~Gr@&P!(vJ$dt2$dt|p-eXp6SHdXrL0vM z$9&Nxj4B0v+X?jGfcR4Gd|PB@7~}fPzBO zJCuVAW@=dVX{ZPtZrH56qH9ztGrIG2Y+NqT{>C;7x)|TW(l+kkws>a4Kn^$xqB?M8 zenCClX^l28e6K+v)ot~riehSz{p1#NsGh+fe`(O8p_0+&Job*PyvFq|D?V5uN0cH< zoKY-8kh*{hWaAT&^A8bO5S}Qe(do&ogyXBGM_OZs;}?x%9C2bW!IJUbrNacWJ9%1?%t{JILGEv8p+hobnic~Lfxmk#D&5g!)CXs5=DvSHljNi+- zxm%OAqMrkVFQ;=>oGmF#&Z=(6m>V@pPJEkUER)tahgTxWGnCOPNs66G3-7vEZ1jgD z#z4d%)brDQ2(LB@ODA$;a^_*+4Ujjuj8&+ORw;kQBHv9mbnnSs5rm%J(@=cX8dGyI z%(f3`MdtSG@~^ehAUu2jjFaC9719>Wf9%{D{o+?jGW?;tpo&k9c;jjK7s0^}uHNRY{%J}xcD=D<%Ehncp@I} ziPopj-C0&Q_Eaidw2D9j5GfC@OE*h%pt40eH~T-jZw}yRE9pPFFLd6_wER|#(!bJP zKaq-BkgI6ZMJ@8&T|E>;Hn4K$moc zFEW@wQ(zgW0!^XWzXDX5Hjj=1CrK5^0x;QXL5ZjC|F-#<0FzI!De3d1glU}vo<3>f zba4z9d?U7-6&TJg6v9QoW;?i)9lqnIYU|5x#A`0oCxH{>j+Ep{WrUpgOMXYqcUO0U zBv+fAZD`@N(nGqTlB;`bu?(#CdD}kNnXzYG_MN7IC3XaLQf-QP1gK(?dwPgn|DE&Q`uDq(gU%GOm`_A{@Q!!v za$VidF9EK;n>zPkX4{FKX3qb2i#t;~EdGD$m8OYSDR1qff>&)gG14s0o7NKc&8UhJ zx3}kwr6*rlqPh37RUTL~Bt+JsTA8CbGD+Cp6ZpmW{hDRzQ zFUomxPWE7U5*60MSr@`>)+tS-5J)YSJVq!IRWWPt3=RPI5k?A{PzYt3uL^(T1xvOS zZg=ABO=0_X|K`JZ|IYVIZn|w?wjaY$MFx#2U~X^Ybh-;=(WWzu1%^cDm#7CxMhXP& zV8YVJA=TE2`L6Ij$cGsI+wsO_4-$LZxHlAo=-52fXMwd z!8&cGW*;5)7_yZm(C>eVKXK$sP##;ZF5RVQt`n8Z@eQn*BhPjcI^Wie8POv$odQ_( z(qGUWN@c7I5Zp>*Xp@<`caca9aQN>tl+GXpeBrj#MFK(z;T} z3bL|GBD2z_1JE-Hi)zqoauE?w3iTw{gg<6sC9OCqERYTv&U`ux?VX(`<;hCzFv}o` zBxaG?5p}`c^`L|C2O9oDoAQEOzBif^!--|I0tCpy&DcNd1ZM<&pVh--rfUVG_u}nPhKQ{CBDqaAc8{SJJ}Bre&M# z0ctEth!aOqw#?rzE1F$ql^v_A6I`f)+%hVv0ad(aREkK#e*8kl;a+Cx#?H=CsqnmQ ziHH3^$;sb=AHWXC0EIQ|wu|FtmvAjL%Po#O=A|%EWq1@5 z$eb3Nftl;*b#7FB|JHuE{|8%sXc-35}vJNkz+}49{qN<7qBArzlT_ALZxhmxcMCseA$F#_MR%g^% z479BL8{oJ7IG(MC9me`pTX+F*jaa$SLx>!MeIQ-;8v%RQ6nRw#W;> zek3FnB<7(^2+z|bkl|h;RZA`0Pd1p;!3A)$Zm?R5;@fF<@+jWR7{`~$^A$>U)ffn_ zHjz*((+H0bie(W+3p=9kZX$H2U&R7;eUYS6?D!|0UNj|UDM7JG5G}vm0pz3x-+neI zX8JN;yup9sYn02?mbTYC6J{H9umxzdHH?}3DaaCoT#1p#W9-LC!!wFTE5ee+T>guz zNOM}>P!g$7KzbslRn{|+mCjwC1}&LqZ5@BmK|gwPlt7+N-UvK<%^5yR7izF+bI7b6 z6PMSc%XkJ3ae9;p_Irejp>`ic_Pf_@!`X=apb_aevb{%r?F3f9tgzj%>J#}Reu}+Z z)AxuV(uae9wit&~+eZ*RQHF7i0oCQ144_{~`ko`)HJ{{-N%R*G~l1*TIU>Oct zIzf;GLjqhr);a2zY<<_A0z>E}X!y$2)YKcZVk9pzfk4A?m=7nTSJf@3IZBDZ-RV(I z;yw{$Pb>MUSJ1Fk6;RPImRK?igg$jeY61ZJl^8t)N5V$z?KA$>FeL}zAnY(ofvHKn z2ErhUlD%7wXeohvMVe7mpKvw_dNvro!Y~bhr<*7_gjK^>SOFW$xxy(w6r>$UHToU( zH-$SffgW=w=GqSSLZWNHE1qAa+rE|>4mFjb!MgD2NKqQgqs>4rAe$p60$(>{FDH9r zCOcl80YyDm>d}04e5_ zzYDxPDGbP=%>`mS%<(EzAvq)y(sBe~i?^?*P@D3ZrPt%uQHSotQ1g`$HP^fO`w<0y zpetwK6IrL|{vz}1L&BLv0roI`D8Bv{Uw1Co_=_lo^_Qvr4e%F72A>Bo5OEKL&I~Cq zHGz&aS=*!^=|oi8XI*kh`qfr={q@AV<>zhtNGUBk1hVBbjH!fGSd*a-thJ*V-h}9@ zagy|3WJ^LKG$omoH}_)jf3Gbakoc8uFQn@vwZP(br?@+Xa~Sx@AF}GN97P`S=S)N{ z;VoYQ;Tcf3QU$c+FN&KO(eh1b<{lftRF?>R@`_IPDqN|5R&5u$1%XJ9QEkt_@)VjR zrBlzPI5z?gepuCzT2V_n5`2hP5Ks?N3-}90WXw=Z7|^W29blC^YAcW{GD9Qy?py#k z{H(mRI3pF)7?mgA@HsT&x|yypF(as?KvbWH2txQj*g)^^rg%TtNQ#9919Pc;eFm_? zkq#MBzuz_!P>@N*vy(8b9QSh*Zh)Ea2=}Z_nXEfsz-{qp&GBtdDlsI)l|Cg|BfGDvYDN@5U^6k5Y2up0LYQ^W?4=R$C`#)+dQ78)>` zL;|rrYOu=)po25)T#nwjiT69JL|${`ymcpCF&3A?%}I z|C&jO)#LJToU4wlHvV_$0^UVTmI{`}bKiZ)I}h{$1p-q*1uTTZE8iiMC%4lW>Md_U z2HZ_{QLrk~u+?cyg=iC(L41(+oz3@5!H>)`5G+V;gkA>`A3G7XaZ!z|U)^~XcYb7I zZ3Ad;XGcCyQlgOnOSi0QATY>FRfz&qr<~J=7UH53J56dyh^s=|A2so$z>?h~qNFVE z3^u$}BjPng1VRe@^ry<+AzFibo?UBJMaC-GKT*4N0pwFnrhJ&nz{H~Y;CG&j4ws|} zZ$|^f`OsJ6ium3H2^W4iX5Bhlos3S}g2X(3t#^1yLJ^RwT6{q>+iUs4oOg!z(t${O zH3BE#I_B*RUnH*>Ga$AHs8>kt>P^90P@qo1gt|mTZ%kE&FV2`chA)@pHzU@o zra=rx+sc9^kO%cfO-=&Z!jQ!LDUK@5*u;zyS+4cXI*C5y31*yGBf219z=KdWNR`o? z&Ul*0u-Jtfo2*qf!G6aV)~!* zxD_C^B@2lEdN$GEf1WLc7juA|30*1uQbH!Y|Ci%Fjsx5cb=c!x^r1JQ`mB#99L|o` z_rv#Bf45=JV>>@~67eF+9z@yu z^FN~ldqatJs(B+cy;z?!Cv*;Beop~a(|n$0ag2<2Pc)F=gM0AHc&`3hou5$BVrX}` zbkrMi3qa7wgi>SlW~uZw@sn4AXiI0HnJL zUeLl4lOql-vtTC-?B1+wI;3Za1%{7l%7<+dP+OpT28cj;tgQ!4@mNAY=|dJ}Ft$Uen*>qTU7vogBG`=;#JB<6eXRXwlhYIxg)hySB$md#HU3r~ zUfT_;BqfSi^S>-azCC~hI^&!BUmOM}R>nMkz~klCSmaHP|Kyuu499NDujK*dtPf*H z_BVr&53^xQ-1#?9;_E?h;ZCkVr03I6)ySD3ztB-~+z5t@Wd*hh2Ph>(=H#}{n*=^) zmveWyNO}B~lC+*_DzZ)vJj6_rP(uoDisT8lg<(s`F{5 z?R<--?Yif*8GK~X>ppQn>Reh5NE0k9NQtD347xK4QtJJ_F*KOo!|lbtg7m5JGl0xTn6y!ZIkS_cxd1y+x|0WVi-&oGLT}br zTON6SZEa3S4WQIkqYEt(3#NY3olQeV)|`JYS$bC5y-4N{43OpxJ1wZ>;d`K-J(=)P z>gzR`*SYg_*xm^vy_*1kB2(dJ^+knIF;kO429jpuwWUinfZyT21-tqa963gLbou z@eLEdjXCjMmb+%OqwrY^c68y9%$5lJ*^OANx&Uw9VFI zRIG)iPBF@Ue|Dr6IJ`pZ_J=kz_H+8`+dUvXc3`~SQ!<7wTzCy4<`J_$1V{CM=-QW^Ovw?IP#h^Z3 zLnZLaXvVcrs`nBpzRURNurz4d_;l7XP)>lB@OUfXX9c&WrKDsNBXaYG6&k+@?HBrh5-oc`z%+9-^ikm=|DKrAx zCdJ`>`#sd565k7oAvW%pX#_KgN9@J$Bt)7r{L1w4bR>lw2r#>zWRL5QnW7K)0T8cB zjF1YmoA`7YJF2i?OI)()V7E^NJn><3tZ6B zx0B~Ob=LRv-*h8<&qX9)3!qbGYWb!%aS$&G~$NkjSR+~@$j|b8RBCpi zR&fOo2}Lk-8Y?0mLN!>R3u^7e?>B&9eyKICrt*Hbu*e`vi?>&Oc4A=Iix>+kQy&Aj zCWg0@kTp{TRpG*ggaS!8>qFxXmowCcA^v~;p&8Bm49F)Yov;RTH-sKfhR!8h*!1(eb z;lOkVtT5@>bEUY$zRsLrzKe}~7aG;}OJWr>c>|BasR-NzadgIWy+Nq##MU?XPHhV@ zewG2-@!$ZRh;eT1Wtp&mK2=@?2DWk8C43g`#J{cjel{6+-}2y*JMX_#Z=v#bf^ht2 zEdylgLm2I+_L2QGfV-{4A2jXeNu>zUfxPwg?%C9-+C%L=>|Exi_)!6+!7dy`2QcOm zo`Q*4b~UE!{jrMfqNtI`vUl0gv|Q{^QBOFzOFS9K>G$9QJ>G41TB5Ph>6~|G0&X)f z-P(xRZNbUjrkYVl^0~6M>@vgbfj}m4a&5Ii`g#l5 zk>B)w&mr6c@5mgDY5^TaPFcfAa@e-?aF^a^>9=;@No-`d4hGFCRv{XX`9tEw<}vK$ zFbE3(Y4l_!u;_9mRD6=y9T7nhGLcw?HrkOC(k`X71xJPcO@eZcae7dEX;#R z^>U3|-XXC)vx?)>degBEB?acWK%H(f z&Mfs@g@PGbX9O9Mug*A~V4iY0UT>t{CCgAl&1-TP$q=jFEFU&|A)l0*>4a=9mNJ=h z6}@q#;LThS)3L=_XL_a3yh{I4Vf|{lWWl`gv}XtR9AzVpI!b)519dt{`j z6ifQJf40j~%u+9$`8eVWX*u4;FU~n-GOf z*XNczGyi4kk-s*Rqjsi})|A=2z6B}|;LBpyEYM*t%oG3G&FE+I56>+ZV795*gnRe+ z1w`SszFZHKlqT}%OZwg?ZLf^hgk3U(zSzSi@+8W#FR{gsTV7m@jmY8pG}f8X#T+3? z02v}aM(%FzAW^u&C5ruDz`@$~3?!_gPF&hWPSJ&L809pBbuQx*>S{~lTw4$wtb46W z@qqRqirSNlNb)!DNKCP8HHPOS*DK(S2)Gyh-nGokILFd(3^n2><2(yOjTiGn*iPP2 zzm#!%YZIa}J=2M_QL7+W%#e4LNv|F}uoIMkXDey@7AANl&_M5dmnrEatF~nAJ2}ytoV15ReAW-Hm z!%;Eh7$SC|?PLr!fj#N}*_;^e`hbtJsdKCSFx>r}E`@SC`!L@FuoYfC7W~M7KBvB@;$-vbe!i-GHvw?h9knh5ND= z2Eq6SBi5#zY^BX0niURzUHvFT5R}unFnxt2dL-@*P<@@LygC9s!UYz)q}c7xS3R>N_pU~9m3%dQ6JuX zTvQ;Elh$ToFAm&ayV?Aw9W?2H+@y>gW^e8l@sgLByOorgr^-%#rRhhozQzIXq=L6w z`Y5{da*$5tLk>@r(63I-Qdv4_AwZJbEBeu&!^iPQd*GuqTH5mI+9dgRPu4F{uePF& zU4qs_QKOm~REpAKWW04Dgw?ooF=2Ay=8O}MH!Q6c8#x@Q-oPALs?I&V&*P0&>$X)Q zIiGN~wG!wM)~>`cJK+DLT6$ca7S4rP2UHVUg|xw~6RGb^)lP`pW_6WY{MCpeSw`JT zy)D4hEm^|WREcV$o!ELCcWKdRC@B#jQ4p&xVQD3K$@$ot*S<=ot?xQgs> z9)V1HwbD#I%t~6Oq+8)3Xf&f`zE$yjPIQTL>AfCjeBTB%CN9UF_CqzG|-yY zH&~N@vAVYzbHl9=cyp6C6|Nup-yXuJ8Ee9o&k)~hJjSVK1CPCBAL3x(#v4X@LF{75 zskTbd?1L-dl(e*Pvd&cqhqD?0Ma)(i3)Zp*?vL;JIz(&&Erj`@6F{4OrKSQD>s}IT zD^=!v_VuIsS;D@Zg(ujO7~x1RMkcK$yH4;_n zb2qbU8}V?_RD}fM9(oc3_+0y_V{zblkn*B2zJv%Aw=wUe#UDDiGt{FJBN(eQK~5*0 z6U4*~q>Mp-X9UhdafE|OAJwxZ)-iyvOmy-JY9q$9Z#Pns+KNBO#!)a~vjA)KD3^U+ z1%)i~)KKIdOtUl)-5Zr~{GsPqTJ~=+Gr4sV z8c!!^0LPOjPeKHhrKLSMVHuH^R@Ax~9JoLH|K{kNg0)VCw>__>uyfcwil1q7hMl z_6|6`-F_vZ=-f|@@M&ijyd0#hkZWVq@0RhhGom>mT<*G|!%XrBOzwwu%|2A96Y7p= z;%9gdKhbE^Uja&lRlIOQJJs9|-s{HbvcH9zH%A*nuHh9fcZDA>@CMJ{^T`|Il& zd21L&YCzlCsy$SVh5AYy+ z&mLh0J*Utho?b7ng}S0%p|Ab@J{cuL0aw>xStBSPkCZWl-;A=$BBTC96ZtnvHGc0$>V-7S5XBs&UmRe}Vx1~+ zikG(m2B`}wi;k6UNPTo2_LZTKJA*AZ_BR)10yZZ{Wv?PfYVBo~EiLpA>4TOg^1+rDWRTdSFaN z7T6!U0yV?M;-e30gpp}|MDCi5BII6(=Ckf1rP1=5#VI7P;Yk>Qd)C2ur19lN3#vme z5Q;zo0=y#4RndlXdGLYJ1%>N_Q~_S+fV1b--8q7ryp^q7R|SrQ(Qwz>nTvla{!Qxq zxsn;O?3zbDnvSMdp|nkjN*^Oo5Tu~Y{_Bv3))c-JC>69`9uZI?tjzBxxTfMSYWyAO zaq-^oji;Q1-!i1XM+o6h}V7_KbptB)p0+X#P`!++h)(F3ae z>@BGMK2K+F_X6SWSQVqmlImD3BEfR6G2{{5B5y*VTwyXjDK*u*4QL@qbM+uw|4A;ZoQXH4Gb;Lq(gWfE{a1TQoX`pFZbNC? zb?ICc;v_MJk92~rENiM2P%=ex0#2>MSEA$T@zNjG8eXe~2ca=VQJMbkVA!pc%Ps*F zy?T$u3^#rKF#R9+f!#~eRp41R@1KudAH67Ry@u!xd(cs_D0)2*OyX0f!X4wZ8jwpi zUc`UVRCA;H_l&2YuHfBuHs!X`n|&Da!u@$Ha|?kbc=IBeNU7G6!i>XL%|Y_rDH$^GHW8X4%ISf2Cv0b6UYXUer?Onea@$QBjATob9VL3KUA6fqg}Qq+G%v9m8< zK1^-p_-J;p+Htsw&H;>4CP;DoS+y(%NsIq%*o~iN{zn)8ml*309_@vGe`QQ8zQs#o zfSHG$Slks~E<+}VUayRANU4fq2wNX7n{1Do951WPgw{E*;>}I0tMyI%S zoG8zd*5qhTR@CHBMfj%%agwTkl%;Chk#^KrpLfKx+)F~^>5(#9(&9z?@BVE&Yg3{s zmmYv@q8KjoG_2Y>52WY-;Wf!R?|1ZMu+0ip6x9S64$OOSoyezREZT?AI00StqbzXN zNbaKHHRn_2j5P)0t^VXVcR>|t>yZ$z1}|AUt0(~EqOOa;T3~qNuu3b_Tw6I!O7PheRvRNJ!#+ELIgq)ztE_?9{2{{4^1!{@Y)H+#hm*xv_q_Z-c2?eq; zZ>Hwww*v_cGA3Nd!5bduI0Dj!fm@Xx`eC-Zz69(t0NyH zoxkrGUh&>QPD(WQ3}_)Y^BnMAN7i^Tl^a_Yqc#yTqcIZ_f1;C^%*lbxueOG$tRwV# ztsRWLd5PuoYjU5ES}?l+1l(gE;xWDu@F0$&?RUe8cH6Y5GLH?v7=Fu4!1qkPpp+d&zY$$ z(dmFQoYRLv@pZ-kF8sq8B@oJRN)LuRk~fIq)KkR5%GHEFcR8oicS(S*KUqoe@5S6j zUbbW!ZsRg<8t%o|#jJMXQeKd!KCL~!JFlJacizBydK`zuu(DDA+q84hl1X;-yvY(?1uwv^Aio_ zV&({fpIE=!LuAv#AH0hmg-atw3)6MG(U>`%;s3&c4!)%V69ljx3ZO2a!7j1w`>qS{ zQkVH!XZTFyg$Z~E>-WCbX(&{SnAwJ+t#doGbaab0R;}STkHzP@rhj&yG|=rs(yc#0 zm3whB07M0n5D9~|v$@O_5}K2%g?U)mLK@wQp}O87OaR&AU&Ae7?4FFoe)y+i)f90T zK=C>_GOEH%mqPv~$$X`Tle{@U-&!t|E00iV#dt5LH`oEnOR0bl5Gq!w#qC3%u0Yhfl0Wj>zSoWr$|utl5Jl;RW2Z zxy93LtHs{k2h1kN4+-qIVIR(epn4FK)-0!%Z$+VIv&+GTe*3kuv&-Le`T0F5DzcH3 z1LmhZ0mqcd4p8wJw_D`P*Wy1XIvU3I=?PzcCF`OF$tTF3`KnK7c1!m|1c-zKbo;K` z7ci06IKZV!l0x`q;x45jSc;@k_IlDr_idhJoasBD7_9{JI*^aEho}S812A_!N%D@f zw*o9EQGy82G7yKZ-M8mDixZu-$Hgt8XAkUp8WX+>?5gQhJx>ZE?D1S(_!giLQ!zP%{=09$X}$mjch z{&EkMu^cT<7Mh3|(xj>uqp5`L1d0ajdW_8VI&7D6{-xM%0U+YV0+iR{} zE-~MM(VB6IOvswCi|+RkDB0lKQ&A))JQp+;yyBPC-^Nl??n{eH3Z|K|_IFsLCPN*{2ev5WoBfkI*L5uEp`(Ba6`KH^~ zT0jA_U`!a<{!jw_-om24&;qgNA>lmRpjkmun^%0|0Lbpw! z5&(&6SJ#F=FyBHC`794-FrU2PrIBWk6ER1J8)r(x5orD9=E= zKMTi*${FiRkimkz?J2*(!6oW}L1k_FqyAYKn+F}Y?ur&Zb?d9u3VvqIE4(IU7$~YI z9h&F~I#t8lF`knDh81m)eDag+#c>mRB4E3(r|hfsUAMGgTXxz*B5&MV&Z9CWQtwTcR8jWK$UG& z9c8Ut{t?*HJHKggIG?*=+ENK_YmXIzYxeB-o31~r?bp+hY2*9N*E!$p&xvDo2l&r- zkH=kWHs3d-&qps^Pv0!sccV7P55Cz4xRs%b*vB&4$w2MDf4&)FN;lU1K2wINkqqo{j(B;SXHAO`WMAG z@&aNccK2Bze4f`ZuA8lae%4wx;mmY&^}HMnAzBO)Qc8&9TIeoboUCozz#F?B&}+Mg zlG*p~uiM@myT2jqeX zsF~Rd6^L^J5{|Wn>BE^5DhCJnlPFYhL7Uu=8dNZ=hVO9v7Y=E54sy47LP$vD_<&4XanKhvnd1PYsc6Kye zCLD|qmCy`>ThC+E4cBFqxx)y=&DR@;XRAw)3@-zjn7$u~X+{Li|1COt$Izs0uj6oet9TzLw%XAkTA zf{@(YU82!F-oVndB|++U&FoBh1srAN0;pABI%Es13Uy$D97axpBY^*7KQ?!Pwlj5V z4oCOE#wv<8N(V+UnF%lgR*gTCv8jz-%o&5n^Bfph*T7)lkYmgt}r(JNYrv$RQ_ZtY;b^h1zy4*Z}~drJ%vVe_J2dj zz82t2@Bp^la0*H7C^#F$*f=0j)s2JJedHb_U6lzadqR* zNHO6|hr0T{;B^wa+*9o_QIkQVyoTYgIm@Px%Q&-_)RsB%_F6Z)etUwiZY7gE?w9)iak8M*yMW0|F+fu~cZvDyQ;edv(ftE z^{qYC?vhpOUUmlS2?xQ%^_}I7utZ5V0a2iaI*tg8zHYW!FZ4NtGA)70+aQZ#21*(T za#zDT?#=+|L*Q^A?c|sCIwD_VJY@+VNc>a}I3DN~urFB~v}b6`yGsY0(@-??V?J=X zA^=n>MLX&LhIysc4&dD5IJn1Ud#1erEU8rm*5N-0>S2Pza43VsV33htoPs|)VK%(T z<@LM!-rqf1{S2;8qSHl{*3xPq%2D!+*}V^i1L;DBg%iTYyD;Xjb^*=O8x0GX347R? z!dQ74z+jd}(v8KH*#hE9Xo<$HBt2WhyQ}Z8+w&;tTH`*-wYWxk=Q5+w5;L^AF$5v7 zSK;OZPieJJHlZsi4x+Ghh91)LcfXOR?aQ%W<__rp4BhBq+fFl!&cUn1R{U+>09Ps! za{3UB3rGYSrIZf?J^{Ze5tKWe1ye`^Bs+pJCn62MMYO`^#nw^v_rC)=Z~!|L-MqcJ zvi9n2U8H1Mx}4E-EIGQlzp0GRFO>wV*yk~H>^R6SXW1Y-%!tz>r@RuOMR)|Da12aI zuSN#HR|U(zRRKhaI;a!k-^*r7_XgfZQl7C}*$rTYYd%qGqYvW;IX2beqq<*<1r?fm z#aY{}KFinn*As6!<=P|NBkjY;+olIGvaZj5uS5uvfB~&V^co%?db8sH>mN~Tmxh@3 z(FcvtfW%9WdC3LoK9--7K8n#Axa4|Xhw8v>SB-)Tm~sZW?N@>Koc8o6E?Dg#T4+i_ zXntsC0`SC7a;pZw)kByLVH5v1ZW0<*idTroK_a0Z!r~TkJ_|7PxEb5U#Qf0SX6tGl<>AN%ZDVZJ=3) z9DPu()Mv_q8tOLwt#%ANNDv)j81Oy}g?K4{nxPvq5wa6e;@EYz5RVC-Y!1-JG&%k+ znB|aBg-f?_7H$?jPSuT{Dx_MqSBHTgBeRKix~}!XA#GcLtXHKM6_a4K9XxT`D5%d3 zk_m{ut3fw&Nt0Z1`qny0H15Gqpn|QRM4k|En=h$t+Ss1W8`I>L>`dx7)yP{u&gD!n zV>k^@Eyvv}Zmch84Y9Ao3Zao)zewrdveEDpKiWMw_Fb663A8h0;s86_*l;Xs*7zM# z!Cc}lwA=fD6q;ZMx=1U+rCh6BRP5GN7d<6DEFn*){*t=A>@Fs>Nn2d_%k^O6YckW< z1N?CyjHHs|ADs_>nhVWQMmdw}tQ3>%ClW2p|9zwlTnIl%V5{HcCq z-t@hkyOFYG50U6M;fC<1s|iu`%r@5mT(B_2nAgM5{S^F>RriTNIehfsYIf+@0lYZx zEp9vLbY(GEC3%+q`2x0ZIbL)+d2t{6!%_#PQB}n^gVko903o|0tmJ;Vh3gm_g&Qx! zkx+5galX4(zIQ}1$jbS2>wxJZ5Pierya_u1?>A9WS?Dm3;pRcmk)mgTwEomB@Mh9< zzk68~5f%&Sc9D9PBVTjJK85_V9eBP=yj;D1#C>iRI{=FT5{_mCQ3zWlB1(_1YVw%$ z;{!lcg9`ulk@Fye3Im<}vKieG$Qv^Or@$;d?tt({%>=s2XtjCv=G4+S?$r;e1hL?s z{geEJMj@;{?4pPTsrTU7p*YdN{di?R#Zacb*aco|aKWin7FOK?-Qu9tvq_9Zq*4bI ztsWZyg0oY=Bt-wn7gWdg$dtFj;Gz5lTJZ}49J~X_l?w8-g5_iX9F;&_nq{jJaSIRX z-enu-&?K@fOhfBe6vPTG4eP`4L!(-v)x>O^BBi6#%C6(yP*PiqM9->V*vn=Kdmh5t zFPvh#-3LuzNx%a<7P!7b!>IwmgnOX(dqAvD(C;_&b3a9M5ggu=;^du)iz`9)fgC~= znNRu(e**|tUWjew<>sEjf$fcra=q*v+A~4ieuQislyo*8eWWuIOJ@w;Dgu(*o1{IJ z9$2M(<_ypRJ+1?=HYh9PheqY}v_Wz6+=JckM9|@Y1O6;Fgh%&1CHW0w%o8k>2P?fA zZoR?Naf~M)B?b66>ASa%a4#T)2e_F8aXLfpvL%cH&wrT+=>#x{AV#|3s@OAesS}5h z$mC70q($V70gfZNPP4?DcV)8}f$c)sg|P8U-pFsj(?!`f1)#SdWX{t9iv*#?d19}p zq<0CSs>H|%DvfEGk_(g;fxA8O4l^){5do=}{*qL{q}H6EBlb*A=rmwdbvfX^E6+Pk z0=#!eN|e^v-~YSYzAGQue7L1&jHGCg&@`8%1qvmbKAJ&8pNy7*hUDg#`UBpZ1#zJ& zf(jZX8^Hoo%L=+fH|N}$BNCS}kGt9lLVLcm6scv#QOx2Aq2cR;p8n_~xvmJI-=v_a zc_;y79_$jPnDO@;`wU+33JISi_U%LHs8u=Sr;4(L)n@hY$jS&YX;|mC;Cyqvnp#3H z1Uw)H)A_8iwS6npe`byJ!E@BodTj<)rWj&83&6oCT;c@G#!{R=T=HzKpW&1%)oPD$ z*g|6GlG9s#qZ|iIG6{0Sb^Te)XVRAnAtQE0Gm!FtK}0qLe8|< zvSFx_3;B)u)WNLCL`O-+&&Ad>Z*aEgPq3?T08T2_sDzo9>792BKCaoz?CR$><(1tJ zkQ|w=?@R!hn!$D`i)r%qi0a!fB6!);J?vNIepG-`gB(ujk_R=QUzctNQN2q@V~Ts} zTH<^Y9MF`O)_CoYktuP@bHqEo1aE&7`Xo*r;8B8b3ZFYs4&t7bb7d6FT4w&kR^(n2 zcSw{!#tG7H1>qnYWvvmHOI*@oMtvnTGB=X`03u%w?6sthCJFw?Elwb}(gF>3S?0|1 z2FR)I&jF7g=cw~pn7K+` z<-Yxu3Z<*FSa&r1qC?H?9zBq7vgOczdypKAYsy2jUY~W2F>|>#ElgBCr8X_dknxvl zIN^8pp+s`1!kF~aH#6>;x7Vk5X!l7 zYd?a8_Gqj80fP2qNprcV!5vbkcBz-Lc)>Fa#hZ*F&|GQxhi$c;hiXx^UA#*7OiXk1 z@hpuOcd^v)-AOt(=FAg}!TSPrvUSX|+VD9?WJ(86U6d9UJzgJboDS6BPHBJa+~6ih zekz;DR!?ECFo|D*BBh2|S>qwj|-^_Z#KO9{mHKoQURe8EaConO7e!b!K0@&5)Nn)7PlN7YmVbJ1= z2|0V2O-H=?+?eRsYdkr$oe^Hhpn-6^&>`|CY`ywrbm@b&7DwT*@X-}G9baije=g~&b$JxV==hMjppLOp*FQn@jpZ^`q1zg__rj7S^1EBR@B3)A8 zXM=qY>Z1-vOT(E9o>h(aCl3CnuU_?0F;|Cq7t#Om{KU)N^94`2aoZ7UGE zoBOU;%jsOM<@{mp#mPS-z;GF=QiZI}HZWEs8SsXoZ(3IXUly9e?=K*8+Ge zY>!;<8ekjGro*>jriNY)pIvBl%E$gh@Vxakl^Cc4Sb@d5Hyk9?)1Y)9yWy;6hhEAXL*Sb!4HA*hg zeRm9fP%RJvqT9G?zsNkq0IludY0tv=eLILhK7 zh+0X3qSFI_#e@EI7RT&Esw|d%t53*8>6eP&g_kVhGLf*FdW8yumxSfS4D79@G3YH5 zn)sfOdgK^*iH##}2VMCeztQBm_E;RikunbKel91mmLX|A;2mV;84n>RCB}1;h%Nr*XnrDC0lb zJhi(NuH}7CNEjWdHzqNB~byrDavc^kt!Wt$;Wm{0y z*Yl(Mx|BH0%N|p-QV@g3wPf_|zqKn$qzF9;uq8t&2IM35*UqEY8}s*B1pwEhy?`uH=!R+ z6vw6{NM>v0nP&ypWXZ+08^e3jrFT8f646FEfkaWzr-xHx;s;6<& z>^$blYop1hrYsKD5Cq04owSq0jjh%uv8s9lqiXuF`$Ws7($R&}9 z?K`nk>+G*$3FdLR_93NYPmAOBKRauDQN|EKsmqPU#h3{PCFF3J5bfpLwOntyr+^oK5!~c*U`e(Q^xNX-N zaySQJx#~Nae>9xQZUaWrR;J_9Kh_;h7pt#uS1`nHjt{jAL{LXycW6QBQs>zyVfn$r z>XX>gZS65$lEp9abyY6?<8ZY8;6HfRIMwp1hVrxv-#l-b3$(0FV+JL;u0hR*o2 zni?BMEp3JhzhIW(H7Ta_7LDSb{>b=ptmG0D9XFtAjm9P26`^4$Yu0+kLc;R&NVL>uv|E#(6a9 z*U4l3=T+bFqc)cfm~qSm4dSFGrs+JePl#-yrY@o%Q6!=guX~5jCv_(#TD*;9ftU$h z`R*#H`XdjslYL;H;ag-^=T`6Bpc~Z99U9*1dtV&glrb9=bQPV`VXs5b+NeLKsPc#& z1==0pue>3-LGkVtU5f+beq0w@630j8J|QJT)-3+jt6oHD+fW~1{!Y0+XoHRky~`v9 z>fJK0lV1~1#J2ZlXy*8z7tJccYI^hn`*yD5H+!}zhT8(t7UK{FJ$UNFJ=>fg3SgQ1_CRS(yOlCkG<_+VlDS6=<-%JZLd-Lc^-S zfr=ve*4@-GuJb*UGN7)k4kIq%=_O60ILPs40}f2_w8o_d#UA3+rr~E44{i)2Htfdp zm=BVh&{WXUHw(wKjfdf+?k+;SRYT%N^%!Hqhakvp%dUC`bW8(olClsVJ39ITfuwv_ zeL-67OMS2PzA8?}*m~$Qdpj=Rd3Kve?q)8)b_|FDuV2P_k~I*>n_g z?L4zX`QNR#X!fEs2#0ueXb?GF{PHG}LoC4cT|-_#HkM~XcZJ2V#p3uBamfk1P!e{I z68N<2A(nfEeX(e~O}F{Mv8d4aO6{`;RgrvK{KHL2gYXKPAWb5>f1m(1hzP#sx!)Mw z?hg|G;&3qQLh|`|6|~Mf?3|W1)7d^qto=QFNHlLxT)5`g;1Odw z*x)(A+j8X1PH|iveWubM)z_PjMSq+BY&#xh;j4MOGo6aH$r;L2&m~^H}VD9F5w^?Q!sPX zF-wTk7uve?ib=jVbQ|2Sks>4eMX9E}-RkNa3QPCj8s3k99!9d&S|=-c8jIc7tCHUdgX;LBBB(nY!BkCvJ1t7V z3J>XCa8~QU>1KE`LP+@6ljSx2Wf!?$SjZP^HXgk%{VGGz6#W7HYGL}r;J9l@i+xzI;rYyIL`<;NprQ zsR4oS`Vk6n0>`T3p5fI3hYCyj7K}<~8MIf>F5b!o(E3KtLV(Ie9V@h3EMeE&MLk9i z{@z~dfRtl(zocM{g-nXjdJ|IQpC6Pso05aUO7^=mNA0#9uTDB*VPeT0z%QT;4|@)( z2c50ObFynt$Oe4FxbJrwxJB05e-!|t|Jff`ZS)DQwemh4<)AeiI>PA&aX+DR(v27L z9ZVYp12CXUFY2)n238FSEeA#%VTU}ZO*+sf!ybt(>(L6JH6n-oC~N|aJ$d|w9X~Hv zkm?GKsuImet1O~}C>3hk@ff)@=imJj+wz=&%GNqoAd5yW1d>-m=JSu2lxv8472=Br z3h)0--HjFAw^N)X?bL|lwKZ(Ie!C1H%FHq?7ULrg(&*XHbU8H3G)dc>J%*OYE23%UR(I78RZXpDU2%d*-jb(tEa_CEAq*TaweOok8jkz%r| zhgWP@uXNN;?C2}j`)O6#A@EfdW}4fz#-65ZD?3;?b0im|yeeMHX`j+vHe7ai!;CK_ zf4J?DDxdWrIg1WadR1T+$>OOW-K&`z_jft%ajyt%oL*!tm#Vo&uvfe=YYFBi11Tz@ zNvNbJqSYupMx&M}B;!jNHh&Tlnr|&fX|~NFETKg1i~7Arn8BUyM=GEkDdJ@sFrXfFH0+&#eyX)rJ!K@+74 z0ImK;R$m~R+~ddoLY+VRuaKbdJ+?gUshULw%Cl7)_VwJYwF@6;oemmt~Z!Y|G1zvRh%wDST_d>Fn2jA*u z7JC%+xLAGOlHKP`?AjYaNeT$nXW=^Q+Y}gQ4M9<4a3OKkBk9g9N!fLjo}_)=?dGan z)=BvJF}29e;c1cC`Oa$q2|JXYAQZMEH8|F@lCAOP*cq&bLqfxWTZY7OoT7p)sXO4V zWKJtUBIh<;1*q#al9$~URp6j6^7_4F5Kw6)v(a>+1_>|eWs7i8!I+f5nb4i}&9e($c)hGFk+L!pJf*I8k(k=^%7%VddZab6!Nr`1H4W zLRJJ_!Fw|}-{~1Mn~?`!(rLnJpRPEv>=-bDwg8I@PFon&3v#ZJw&^xG>@7{ZN9Gb$bSl-2LABafFcWw@?1FrTWQUEvPjzq^xLUqgcMC7yR^^X z?ak?GiKw)=QU07dsl&wr%m*Q0$b7XnP45hsESMtx#F?8kxvGv&f-;}!@3x_Zn>JUo zo?mVXM<4!tW8fu-OSlklELY;uK;%(A2|o5{=n~aV|c1VxX z``5y|I|^DeK;GhP0k=b31w53kBTOMQ7O_}=aizKxaZ{QMmZ>rdNI2ZR=24pshZJrl-Q`) z>@dOk4w4v!NiUU7f0>#jRSV-)a-y&3>>!ocsw~ZI;hX(*tZ6{#@hJ3{S!~wS;{5gn zXur5;wOMiVaia6p(&$i_sdu$y>G?+aer!$lyP0Jvuh}1^1`llnWpv?XPz6Y|vw*U{ z`vuSiDV#-5R1Lqxc|h5NP%Ld&1#|%#I64qx2Z6;I@gk_gSvV>ey*2_%0M0LSgnS1< z#i6v5fD+`^Z!^UZMbHJuy+Xg0|6?qf7ep7<9`Hx0WBjieA!aDS z?DuY+*A=y&l~Q?Vp6h4|FUu32vU<(34oa1un#wD4YRb<49E&&SDladx zQ*Q|^FRme8RFrm{o5Q(M3H>7mu$z62ATWvYONDV?`n7{abK`N1gN24e7Vl=so6~w9 z?Hw8m2fpI53SOq{R{pgYIR#36H@a&V+VG!3-vO%_wwW&iFv zDr8V?42-Wbr&3>4>l<2>+!vcy<#y7q($)Z!az`j2xv3`>#J`oV7j8nBy| z|1l0U?D@ksatP*k^f*u2XWVoA@i|8g`U4k~(`8HU@LwJ7^7s?C?9aA!Q18@v02e12P-hc^?BocaLyy1Rc#UUIJfoIB#Dm1vUMC|X zojg!tdp6xAIOh0)YsAfMUwsByBcI0k5|h1yKKzt>wF@M0wI5faFcBq;f^=S%nN1f58*q8W z=iL_p`m1y36WdZt#%gB%Dsx=P)6HejW|G# z^$aBBI96FOc4Ah!D0F~X)H@!mXRQ{fQ9n6pMHa`wAY9ZZ)G2*tP=~JM($%Li&gRce zJAFd)Tk5Xz)7bMJ9y-A;Er^v^<}Dy=HV}m`61v{fxtXL$gvtkKKnIjr=1Initnw#k zh1d9Ja3g60D~qW9a{LW-xDp?$;&1u}er^`G>p@qb^l%sWns`jsA*dB4)bGOwl!%);@AMSgKPV`7!x zdRqwgKj{Hhaaj&!4RBXUoEvd;(SY9!>&q(QQEs3zfaRFgGXXn?4Umu57zB>|s=N&a z@#9>Tf|<>Ioj{=Z#mM<}rC(-OIDzoRSzxbc@str<^3Xe`B9V9Oi5ZuV|;YO+>8!~I^kUHr9 zQwg9!OX7C9E1OgwL&FYkSz&4c>D_r|d!(cYY{WMxpnkMptKdI))nyZ(j-}I@sC>## z$=yAMIHMQNi@f&_iK^JN|JwV9T4S=vCs&<(vdCvbFY(Jf(cIziRb!RWXahSdv&j3m zeJl&<@myEj>>f`4caay8FXWGUl5lk3ig%LmG`qbvA&bwNzE6B;*$SqNPRCf8TK*&9 zdDJ;nd52&{O`OJO_1n)su9xGIco~j<6UXk;ENhh+7-E)I`cwd*L zi{+SQ$}7;zkD|;Je_paOy5&5OA<7AgB%wuVb~Mfky{LDy7U@wQJjg6{7lyIkh^GAp z(q%6uzce7r#af)Y^U3{|SW4l%l!Ep9#HwlNb_)eT>YoEnBdXr{K@?0-Zx#B*WT1hA zjNP37s8lk?iA;gePP6kiUH47VLeLBPA$HJl{1lf%`NvLFgO30s=r5gH(&NQB_h7(p zvLcR9{!TEidF~#kg;ff{#MMid z=z?|^4;tJPAh=8L#e)-^#ogWAHMm=FXJK)IJHdl{g1fsrci->cKi{3H>N9fYnK@H) zs(ZS+`&lsr^gP?KL>OirZ0GwTu;^*WA$QM*5>$r@Evr`#n z&N@T>tLkf5B-M3&-4oqXSVSgU$GuSZ$xoMfbG}v~;B)xM%HNZc=vtkrvsKiWhX%Ku z>pIzui1>}WPR54HHO%;2$OaA0Yh#}bVl(G!q8iQj^xKTXZoqXPYFRqg6z;^`gy2EII%m^Jpt+EC=d}?@o)2>#qn6^3@ zkFXkUIW$F^;s>#UaO$%^)~I7cCC$;MQ?VB=ACVkEJn~*8PG+p6sE#0NZWxV5bK?D> zbS>>;cgyK^GWc(fpxBr>uqa*&q>biiRr8ZBhd^13AFctLp%B5D^kvg-SL&Tg7o-rL%!? zWLLlJGq&7xhA!oaby~V5ST3xG!95Vrg94~H(6Z+WynW*bRAvfU`+Por#q+F8wLpJ5 z%^EQA1AIP4^sMau_se0YQ%IQC+sl(tvvR<=(FosWZE2$x9~~Wok+%}%&hE{`Nz6Gx z-Bo5Dq!1EG^Cg4s;Q%vMb&s_BDzV zZzvh4liv7xeQx#sT_$DX$*CSC=SRPzjBnB}-+;!SFh){ASsIzs!pKEyhK}{5@t-Wj zY``-_VLMHfJR79L=YIfY5In?Le?-y+%40{-WFzI&T1$*^kKZh8*-`t)I_~oNmI`Oq ze#myl);6VFWMkUNs2Da4qD2A4s*ak}lI47yS~|-UR>A;5nhAqkFDU2aO7m+E(X02> zoxFnRud|MlTsjoqO6OmJ?eOyh_V)l6F7AJwq>Bc1aj>F$-Di5q2`&mWCovdJ2;Yj zaX(f{TqpARVW^S0v6Kmk-C}LS*tD!&0(dJoYQ?6LtYO){`zbZRhjX#hneNp*=7%5% z$0B~xMk&~+-LtF9Zb8-no1@u?O~5}Q%U)}SXdeHBBUNXDH$^g}u&SZwoHXt#W#Pbw zt;Ng-DcKK+L2-#$+&p{R0Oi9$z4ln1+Y;KgZ6Md+K8u>+WpSZf{Gl0`h z(Mc>MWo+I}`Gi7LMP~I;Wi{{V&n%U`nmW$q%ZTL(vqXL7{dXE}quvC1bV~K?s3_}n z^|9Zv(*l=f#vu<_2^uBlFkYadlfVw`HW7Wj5f<_q2pZfK0}l^*O;Z`D5D-}>dJX`S z*GS?Yd!8Zh%xnJ&>}a$1p;ATd%pVBq&}K&-u7Lc8y@E)_!g|e<(k&IzXS1?S5?f?0 z;V6je+chm#lIal+SNz~EdR!Gwt7a9ztlIV;JG1IiwBY)*0~&{k+kyJX<~?%i!ceqN zniD&g8l*oQS$~Ht1#qqu<@t?d!MH(x!sd}|z}4znihCd0kVx{Y8MXm#pas#uwl<<8 zYdvA-*uV;e{!c$Ee0&u9Cxsbn=8#-c#~nvADn2fZ>4F*=PQ5BVs&7=O=W-p?Ip90o zQg~L7Y*cj>eLfC053)zFY1Ay{9@Ca*LZ7gn9^R-7{zYu?pUiBm+^CdoDPuGg>D5B8 z0MYa`@?)yES%1l6C~_=SEpJX;yV6I^N13pGzUJUVt$C9qQ5N2)!* zFu0K6bxd_-vCRGk!h%E{t2=GpMd;8B31@%zrRA5d{MfxawA_Ed{95Nig#k|@L0B~v z_z6maDa!@LS>zk8xYsX76yrEVn1GDjt@Sc$&rCCVE4hu4P)e6xL~TV!Me>#LGa&WY ziup*|eqR&oet7+A z^RGw|#w5IJBJ7{jSe%JFX*TG)woQ51U@VP$72#QbZ?W4sZB?%ply`p1Eui{-#wypm z*P?$5nmHBQw9ZBTIr;R2c3qbtk!w(;lq`Fm0Y$~n7}_pmgBm^6HvQSut#%zrncP=A z>vcF23V=@Tr(x}*TSe{47Pu!IR%u;M78-vt-&d8S#2uxjx^p}HRBLqWvdMC1@naDQ z=?N>aivsIV29E~o@C_@8iOK_3(qxyq_)V^ed=i_)3EIdaWp1$ieN}oiK}3i#pz0aJ z%Kw=mL3P%q)g{6tmzTrn%2q%j3WUL^!Y#yiKHO%%Lj6%;ucbAdWTOH)8w@~EgwkoSQ8g?o!4n13N6$^r z;=zu;%CEF$Ac>s6t~&AI7z$1ju8aeC!3Mh?<13Hpu&+!}9WCslX;);!8lYQ>#fYlR zt&<)Qf`;1>Rm@Z}p%w#W_L_S2Q6HBJ$gE1nr}U@~?-2GsoEOOLcOATW;b(g;cY^DG<3$c*pOLdKaF z&qKhS|3G0{uj*#VN^7q>aMaI(j-mUlmlS1Bi492t4;SP{f_&*30p__co+>!(#E>5v za_SX5llBWh26QMKz8@0jIO0hgl<*TDv}QqdGiiHX5@ zq`&;(z;DVk-#Rp|WCAlw8DJ~Do@NMJhLYpno$i?ROSW*73qu#a+#OBOfWu=#6#gJ7 zp-W&PN)*K8OIEgJBjKj`H=jSN@bHIRtIq2FLF9hUy|n3z3=cb8@)&fG*eZ^WOB{<6 zU_k~Px|nE6yryA1sIW}#Um3P~%(T-ITBn`iESs*-EybP%@% z7zxlX!XW6a80a7~kRUz2MIQ|)Br(B@)5G?7h3LuT($^z8G*Y#PZ85)L!*;(8+n7&$ z`DMm4#K{Y-dW_BXl*n|DMN6L-6zi`1GMY4At+=7MZ@=QXYHqJlz`sWx9f$APQWXIb zjcpgVR}wt9ASGpVDD7?Ha9VjSPi@($#|-tBjj_b`SeEYUKL$?Z+fmJ)LfB{s1949w zF`-pghk(mVW1&=##C$zTZJBdBAR5AfR$I2R0*GEJOvOj|ps8l4+`bV&TwuJ2{6#)) z_?D8Zrx5=HhRM1y2HLqypzEvqN)4yQzwk^nCaBr!Jy1KAGh?4fj<1m84iuP}74l)% zXWfwU;Z#S$2aR3{ze&JEFZpKbk+48)9y!IA@9l2?3>=}B_Y|g~aa_+_zlFqm>3@$B zAf{5YBKM9r#U;2LrU`aRUuE-%M976WGMpTwAGUmi#TB_Vuy^FqiW$h~z|#L;92| zgmWdZ2~n2%6XLwCzf-ll>}i0P$Bv<>44*8K>rCLs^oHXhkM~o}Io|OcX_9hwLwgfp zrUPmq*nTcSs;qx#t_~&;1prZAT=)cNT=H)~$`jIt@zwTP$QSO?+L#>z zd@1b|`a$^$6DDc;R5N;<4w6_$Z6T^Z-SHBIlcs6_MY(eb6^7Ms%Rwsm|EqjIjJeW2 zUUIWX-9A%lk2sBove0f}^%1`7woEe}Dcfs()7atgS(4tt=7`Ju5xme!6#PMZpGSpT z@?2R&F$|BGn-bO=Lgx;^+>Hsk6lwLmsMQbX;~9iY5a?F#;_y*Gll;zq=58u}{V-!? zQ1oGZ3-$(gYIaWr_P?PMy1o#~dx$7D*B?pTyAv}&+UuB<0zz#OOm}e^X~27O?Zd^Qb`QtHGYQZ0Ad;Fel(C2_ocExfnXG z3|T$S9Qe?_Sm*O8c_ACUeL-mjAv_837pn#nP54j@r&-6;ojF4QhwH4;7 zLBfU-1v3FGlDnWMl3Q(xPp*i12fdlLWS{^@?K8Pz<3^$27d2QflpXp6FiEAONG|b` zE%||Z*M{XH%g>UJQ}CA8e*ECpK!N$x_iFz~y%4*M-+?H`yIxOGut4ns!p^(WGfl_n z35&Jn4Q+D8V{-PRDS*KEcleFNr66$pB8EWK?~F0%77suGGzha%p7NT&1i&@WquOUO zVi?T{`cFNZloKb_+SY3d9Un{T+iTh-{`pfQfiYba^D!_lZ%(@dkf6^cg-5KQYVv!M!IfDfMNpp0D{~B0#?M?s?PaSa5FaXnG+K~?Try8Ty z4w_-&4(UKN$?VH=ZiQT|%#T>?(jj$w7n7x)7it?(&(6kvb| zCu-VU8!>S1OCvYDWSD~(emQF&fX-~d-1S#1mD|nJ?imYhWfZv5f1rch~<1_>>sVgWx zCdq%|C_j>J`4ZSGM@w3#xpg4TFijVE03u{jH)DczmmOTe2lU$Q)!ACuFE#=HDNGF5 zMK2o@4!JX7x;N&mU$^A&PA_kn?zuPc7-u!p+k<`ZnpX$7n~Ma0iZsLtmi#9}scFEPhoiok)I8u)DTL zkb7H_mI#pfFI>Z{H4)6InzEM&5X8fjpL4|X`w@8*zeu1nGUovH6t_XuO$PSV6(NLk z9e(MsZ9zHtemCbedhgFsnt96a85-?ret6y~1#~v{o}5yV@>i)o!KZ)ewXT6cJ>c05 zxN%#d!k5Nn<*;J;jDXIz%IkugA3^sPc(ak=LWUX1r%XWmbV#-^-ct1QvD|jXiTLRvpYYDURzR+*w@;GseITbD_!vKwY-hu`Xlu@VdOq>* zY^(?~S;@JC)6OY;#-fjO~m#sTv^P06%JUE7zp3UK+1d3iIthG zxOAk9kP3ELHz|a#TZsuMQ7urNGPd90sFLWPI36-bYFHa^w0F!(i58$I=E)%^}wBS+yzo zJkHx)@}muNwr27?jll#_R*cE6pbXZb1|-S_u$eMD}|SKP{9+uY44oFKb)b*Jj%5Y)fh zdSqHv%&d`|jh(KyKJC~aUK_WTJ%=w9z$Yv~Tfv=Dxy^@QJ-HG9EYbjXcb2vbFLZ4u z?|Po_;#jDdJWt93?Xu=`;~?W3`z=fFVtMBmLA{n*-w!^RnxI@xd;Go5r5dajp7YOw zNR)PVZG5+xC#P-NIy3!TdyPGL{!^V2L`(MXkFMC6 zEvO=mSKT{B(albIN;PN%n^e9aF0OMwwgjBH9oOo3+S-QdbF8Nto<=}>*# z^soSjfoerNPQmM^GKZ2X&QhW1ysf@YE{Mn0TZglsQMNu>vyjKMp+`}dW6&6{`t&){hwT5Wwl!c?>DJ?A;IfBzs&a+ z4SPc$Ed3eBhv(VVfnRQ<9Bj*ob}Qp{ZL?q3GE8mRUeA>0wP;T5YM%wHr(L<|`B(P- z&edj|^%q~fVWt0b|vk^k(lR0C_Whs4<@i2q4zw?V!6bb-3II_x=JK^CiCx zF)w^Qo_(=8m<5mg+AadO-v~c(`LVgap@r{AEAA_rPk2cy@~Ar$nByWe$iZ0j{&JTk z!0MNeWkQi`aK%F4!HuFTOsk8Q{*nkQ!P$^KFF~4!5yKR`?UB=QB0>Ey@{6FdcS_=5 ztEJ=!wA?E}Ta)>FGmf#X!CrA#quz8tsh&jzpKMr3iprIZKT0OF1ky5HjZC3GCxgH; z^T$+KNb#eT2bPik2}@L*F$3t>^IVb^4~QX`*nB_n*Qwhb2jt8x0U9wuPE~+-N71KC z-hP?4KP=wchkr1g*1GvUvzuxEC8dl_ma=r3#;8bBw=B-%mMr^rPtXdyjrq;Ya|+-tibP2eQ!ft>4RDE8EEq0 z-T9-2A~j7lehqxtbIf^P+^e%cN>@l#UtgBBWW_}|kr6wm{@rgzF$FUpeO1K3g%YW6 zp>g0P%eg)MYdoOhj7C|x}D>M%aC}Q@1%{FE8RNwE^2zHVPd)%xEd0ea|A@^@z z(|C0)HBKPH$k{b}C3GU^+?REhUAKl%=H7}`%fq1S=j3)pFADzR>H-FD_%=H^sVHvG zTWV`)9D`OydkiN%-apw*ZrIO0iu7 zX0Puxv*BssT=iU$nV)KUtnE&Xd$enyH-Gnof4b(0_4@_mDegH0b`Ut`0>n5vsdH31O85lqnxAXJ6R)dl+ zo9lOUJY$|zhyYco{LJ?`3vDnnwiwjHe7w4{{fbO_ImX!ue(Tyvi>fD)1-G`Hlw#BP z#;;M2D!I9#DqCMYWGmMfIm8OZIP}hYW}M*s5+@znCF3+q1g3y*#wFH$4|aNJHuGYRlyl|AsBN zqrLnwp4aV_$^Wtcwh@3o^LOzJ@3BF}qMQ^n|6XS#rorMcPoMdagPHBqMeIavL6vnT;zYq&Uwzs0 z6CZt>vW1v7+8H+tjf@7i_2mxEfr=@-lC+WLg+n8vk&5E|k-3_7#~*c@2z&87>bC(= zVsei~NeCq+h#>k5&Xg}$86Q$*E^Z5k_=6VJyk(8bJeFLx;j)@)93Pa$IMeo2Mf>P7 zXye}Jcdy7p@sE5m)vKPO=Br-tI5%|4cQ1>xfd$LqGF)=Fur3UN&k~Jd^U2+`yTVp# zrf!rtpGQY+7doJJd&!xkJLv;MzTn631~M1^^qZxmK%J;wIsT5@#=PAY*-i~U4eMJm zvrI(dA6~pGK6E@|9TjOl37i>6Nvd`rvrQ_<$@^aiN_vB&=F|Lde|!N2nu9|%d^>$a zeqX^SzNy|OFBmB--)0(jxg1B0L;0Eaj?83quDIuiZCUJ)kSaYGlRK)?+FD%J$)N$X zii>E>2_Gslqk$E0hnPC~aqug!R^#$_3AhIOu08ttRwaXaES_G{|AfZmJ_oI|k}6T$ zZp-IxX8WhEOE90N2VXhjdO4}uXYG}KwHG}()68f$pG&QcqMW zk$~#;ss@^Tmo~&M{mg!@+)s0{M{-onZ$CSFW;;7+xAyb!;Aq=iRB%YgL+%-v+hk!M zEUP$ED#>{eHi2Jh>{(?!k(Ufem+!^uZEc|c&d%8aPBL^c+Tgqj6D*`nKh;3OtD8A zFVIZm7IPW?-oY_I;jMh0Q`hc@*B-El?o3D9>)3*hDREC8)x5vY8RmDs8N$CN;f=#f zaLP;2+P!{!ohkQJn59H^fArn)V_AIm^nQKh5q1Vm261`}@tZY!z#u}X50iDD;_tGM z@u~&6eYvFNxRpSIvKN+oA?~oJse?)`E3%S=Hh_N_Ho6e<1JzZqTZjmn-)^!1!PnqK zU)P@_Qnb%));gHug2uF*soWUXqHllEjlp`hbA?XG^6V~-#?6|m6~gzOquEe?E>ay2 zAf-)ZI9K1%mep|ncp!HX3q$_+3dd5+1-4IYrq;z>p~B$@{HnXv!PSiP?`JI?F1#BH0nlt6`?EG~zD4^fZNbdsn^@dk4#o8iHn}2hGUO%dUY4^kOEA)_`Rs{FGHakJ# zIAbP8;dlkUXax5$5lZ3s3~J#x6eim8`Z`%bp?yc}`yB3*)4?vWrTnb9vugQa>GJI9 zG0>Q??RF8&7a)9Rp8MYawEXr?O1c(sV=$e*za~J6Xqr#E5Ol6PxIU4cu=bSj5u_Tb zSeeuLe7KH(XZoefx8vdK+tJuHt?P3J!H>0F9GiekFrMdE598OCfX6LIpdlAXvh*oI9FIOIY6Q{a|RTQ0^!a?3b;0-q8g5>xlTSzTYm%YUKH!jj+T=Z27;CewxIk-%LjNf?VP`>9?4n zXfD=Ve_7^O*pwSKc(mBKMYP_|7HuR}c8zG2;@F1iM(y}ORi!h_ielx4Q-UZaJ5AmuS; zq>-C*IVGo|DEilKIm$fbx6ISBMBj_-Y-sSvOSJPq)JlLu9PS)k#Ah`xDjIRrz5V*?WXP1T%M}s`z}Ne{t~KZ zZS^U7oLcO5$mrM?%>JRKvi`~3C=C->1L%T%Xye72;l z3buS})1JA~FnlDgQ}Gl+MO$Cv@HIQHxOT4~MH1-+Al!ez?eITnkU953H=H$}=x1m- z@X2CCXvQSy?Dp4nOE71HgI5X6qaxiv>b4475*!V%lDK2Y1#F)_5|&YX)PM% zUx!I2o+3)6OK5zlm0;VXz7mifpV5{bEhD|mQaNaI)+qt)ClhRD4Xf%>+xEbZ7Ss+` z;metMjKf%hwjHnGpThZyAwpH#{I1{f(iA-_MRL{*!ua*P{`PPG1GqiuiOV=3=dhrK z7q2<-lQLj~Q$2UHy&#@DtZq#Ayx(YHeO}_*3~?ofy@jsRk}Z+xJ_~sHZ}tvc+3q0{ z#05}&EFhHIL+vPRY;w&qI`FwZ{A$gTL)(!d;#;4~pFXKTZy4@Qq3cADQQLeX`IU^r;Y_q6fX#^bwI+&A?ROS{FB3S@Fa%5!|)pB8e zr$dn2E;FC8><_s(DS@^fhu5*3$FMgqphu__ju-#@DlTw=^>8~|1MBx#79y$l?VTMK zd;7P7*MYi|5sjry(c7M@i7M%bm8b5z-K}mqX#-nL{5@>BRb2j8NftwBM*9gaziBDG zDvWV+Y`b)j`<@+Nc2v%s=g9NBh){}f`&O}eInZs8z-8$R*Y53#*~a&J?4(~poxO8W z*-yiLJAAUTzww?;P6%>+Yz;4$TnZ%VKX%9^swU+=ZJPH`MaQ<7NfabAHPH+w9g zCp`va7i-?u9&{7LQ^yXpVX4wP+dsD_3FoyFWq02TjR&R3iXyS1c?NX4RdogsvQJ-^ za#-J~vf@UpXi22xW>SRK6n4g=5Q_f3z_)T62Q16lW4|!YlLdgA(%Z2I@;;8ZYU~{9 zoTtxS@0@vMqY9tJqKKYYglW$6;!P!+mMp5J?k!OB(B5S!oGRvV1DsS>PjddyQCvnjXqs%6;-v{wemDpMLo8HNpmDe~oqsSk6$P*2`6f+Z=+4 z4ECi%seee%Ava>vPC_l)I_vlo^W1Nv2%84mFh7b;g>e%_}!ZfL*eEFJ7Oo7|ygMdGyVDq}b=MwS`%rdK%~ z$q+MjLam6A-wTQGLaPgK6=9Zy1`R|9?8*yFm;Nbp97x0kI)kFFUL~oul!45ZUwM69 z)S}W!DH&3$tKjYw^nGS3Wd?JPoJagEou(-A;x#;XN46t1^m8ulbH^2C@*3J8n zTtw)P&tGsMm`|>-D!BSGX;NF<`=tI_Kl#T)9P~f2fGx7spKlm6&MmPM_L52~b`Fdb zoo}KBH!9{!q@eD@q4T!kp>49<_>boX9*K#0{)UoCW<9ob-hV}lnz|Q5n9LZn7|kU1 zFn5Ig)yM9$+x;=SqSJbY|G93>_r7kvtzG1|{7z%}nnvqcZv{D7ez^;TVaDfIolKXf zm%wxzSqSYVq20+Kj@;TJ{}*S0Zp9d*SyLdhsKmma)Xj&XLfNss@}$^X=>??eHb*?Q zb}{nL^DtWC@EiGZH9QQLNu@ZUJ-c{w{SKof2Lp=>zy$yR9{_^YcpCd*$j>9F002G^ z03d)K{ojj;vzZaJ8i$p*nYop{m8+G5J&U!AgZ=*xV&uLEamxn))QXV-SpN&*4GL{% fWM!{rX6I-Nh5CP&BOw0Q3l_SDLfgX1|Mvb5Q4lph literal 0 HcmV?d00001 diff --git a/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json b/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json index da8e4271146..e56519b6806 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json @@ -1,204 +1,302 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", - "handler": "Microsoft.Azure.CreateUIDef", - "version": "0.1.2-preview", - "parameters": { - "config": { - "isWizard": false, - "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this solution, please refer to them before installing._\n\nThe [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about solutions](https://aka.ms/azuresentinelsolutionsdoc)", - "subscription": { - "resourceProviders": [ - "Microsoft.OperationsManagement/solutions", - "Microsoft.OperationalInsights/workspaces/providers/alertRules", - "Microsoft.Insights/workbooks", - "Microsoft.Logic/workflows" - ] - }, - "location": { - "metadata": { - "hidden": "Hiding location, we get it from the log analytics workspace" - }, - "visible": false - }, - "resourceGroup": { - "allowExisting": true - } - } - }, - "basics": [ - { - "name": "getLAWorkspace", - "type": "Microsoft.Solutions.ArmApiControl", - "toolTip": "This filters by workspaces that exist in the Resource Group selected", - "condition": "[greater(length(resourceGroup().name),0)]", - "request": { - "method": "GET", - "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" - } - }, - { - "name": "workspace", - "type": "Microsoft.Common.DropDown", - "label": "Workspace", - "placeholder": "Select a workspace", - "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", - "constraints": { - "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", - "required": true - }, - "visible": true - } - ], - "steps": [ - { - "name": "dataconnectors", - "label": "Data Connectors", - "bladeTitle": "Data Connectors", - "elements": [ - { - "name": "dataconnectors1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This solution installs the data connector for ingesting Infoblox BloxOne data into Microsoft Sentinel. You can get Infoblox Cloud Data Connector CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, - { - "name": "dataconnectors-parser-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "The solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." - } - }, - { - "name": "dataconnectors-link2", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more about connecting data sources", - "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" - } - } - } - ] - }, - { - "name": "workbooks", - "label": "Workbooks", - "subLabel": { - "preValidation": "Configure the workbooks", - "postValidation": "Done" - }, - "bladeTitle": "Workbooks", - "elements": [ - { - "name": "workbooks-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." - } - }, - { - "name": "workbooks-link", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more", - "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" - } - } - }, - { - "name": "workbook1", - "type": "Microsoft.Common.Section", - "label": "Infoblox CDC BloxOne DDI & Threat Defense Workbook", - "elements": [ - { - "name": "workbook1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.Supported BloxOne Cloud Source log types are Threat Defense Query/Response Logs, Threat Defense Threat Feeds Hits Logs, DDI Query/Response Logs and DDI DHCP Lease Logs." - } - } - ] - } - ] - }, - { - "name": "analytics", - "label": "Analytics", - "subLabel": { - "preValidation": "Configure the analytics", - "postValidation": "Done" - }, - "bladeTitle": "Analytics", - "elements": [ - { - "name": "analytics-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." - } - }, - { - "name": "analytics-link", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more", - "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" - } - } - }, - { - "name": "analytic1", - "type": "Microsoft.Common.Section", - "label": "Infoblox - High Number of High Threat Level Queries Detected", - "elements": [ - { - "name": "analytic1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This creates an incident in the event a single host generates at least 200 high threat level RPZ queries (Threat Defense security hits) in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called InfobloxCDC." - } - } - ] - }, - { - "name": "analytic2", - "type": "Microsoft.Common.Section", - "label": "Infoblox - High Number of NXDOMAIN DNS Responses Detected", - "elements": [ - { - "name": "analytic2-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This creates an incident in the event a single host generates at least 200 DNS responses for non-existent domains in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called InfobloxCDC." - } - } - ] - }, - { - "name": "analytic3", - "type": "Microsoft.Common.Section", - "label": "Infoblox - High Threat Level Query Not Blocked Detected", - "elements": [ - { - "name": "analytic3-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This creates an incident in the event a single host generates at least 1 high threat level query (Threat Defense security hit) that is not blocked or redirected in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called InfobloxCDC." - } - } - ] - } - ] - } - ], - "outputs": { - "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", - "location": "[location()]", - "workspace": "[basics('workspace')]" - } - } -} +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 8, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Infoblox Cloud Data Connector. You can get Infoblox Cloud Data Connector CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-parser-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + } + }, + { + "name": "dataconnectors-link2", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + }, + { + "name": "workbooks", + "label": "Workbooks", + "subLabel": { + "preValidation": "Configure the workbooks", + "postValidation": "Done" + }, + "bladeTitle": "Workbooks", + "elements": [ + { + "name": "workbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + } + }, + { + "name": "workbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" + } + } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "Infoblox Cloud Data Connector", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Sets the time name for analysis" + } + } + ] + } + ] + }, + { + "name": "analytics", + "label": "Analytics", + "subLabel": { + "preValidation": "Configure the analytics", + "postValidation": "Done" + }, + "bladeTitle": "Analytics", + "elements": [ + { + "name": "analytics-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." + } + }, + { + "name": "analytics-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "Infoblox - Data Exfiltration Attack", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + } + } + ] + }, + { + "name": "analytic2", + "type": "Microsoft.Common.Section", + "label": "Infoblox - High Threat Level Query Not Blocked Detected", + "elements": [ + { + "name": "analytic2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "At least 1 high threat level query generated by single host in 1 hour that is not blocked or redirected. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + } + } + ] + }, + { + "name": "analytic3", + "type": "Microsoft.Common.Section", + "label": "Infoblox - Many High Threat Level Queries From Single Host Detected", + "elements": [ + { + "name": "analytic3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + } + } + ] + }, + { + "name": "analytic4", + "type": "Microsoft.Common.Section", + "label": "Infoblox - Many High Threat Level Single Query Detected", + "elements": [ + { + "name": "analytic4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Single high threat level domain queried at least 200 times in 1 hour regardless of source. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + } + } + ] + }, + { + "name": "analytic5", + "type": "Microsoft.Common.Section", + "label": "Infoblox - Many NXDOMAIN DNS Responses Detected", + "elements": [ + { + "name": "analytic5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + } + } + ] + }, + { + "name": "analytic6", + "type": "Microsoft.Common.Section", + "label": "Infoblox - TI - CommonSecurityLog Match Found - MalwareC2", + "elements": [ + { + "name": "analytic6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "CommonSecurityLog (CEF) MalwareC2/MalwareC2DGA match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired." + } + } + ] + }, + { + "name": "analytic7", + "type": "Microsoft.Common.Section", + "label": "Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains", + "elements": [ + { + "name": "analytic7-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + } + } + ] + }, + { + "name": "analytic8", + "type": "Microsoft.Common.Section", + "label": "Infoblox - TI - Syslog Match Found - URL", + "elements": [ + { + "name": "analytic8-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Syslog URL match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired." + } + } + ] + } + ] + }, + { + "name": "playbooks", + "label": "Playbooks", + "subLabel": { + "preValidation": "Configure the playbooks", + "postValidation": "Done" + }, + "bladeTitle": "Playbooks", + "elements": [ + { + "name": "playbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the Playbook templates to help implement your Security Orchestration, Automation and Response (SOAR) operations. After installing the solution, these will be deployed under Playbook Templates in the Automation blade in Microsoft Sentinel. They can be configured and managed from the Manage solution view in Content Hub." + } + }, + { + "name": "playbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index 7a8b54d6989..65d6a51fd42 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -1,1140 +1,8002 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "author": "Microsoft - support@microsoft.com", - "comments": "Solution template for Infoblox Cloud Data Connector" - }, - "parameters": { - "location": { - "type": "string", - "minLength": 1, - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" - } - }, - "workspace-location": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" - } - }, - "workspace": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" - } - }, - "workbook1-name": { - "type": "string", - "defaultValue": "Infoblox Cloud Data Connector", - "minLength": 1, - "metadata": { - "description": "Name for the workbook" - } - } - }, - "variables": { - "solutionId": "infoblox.infoblox-cdc-solution", - "_solutionId": "[variables('solutionId')]", - "email": "support@microsoft.com", - "_email": "[variables('email')]", - "workbookVersion1": "1.0.0", - "workbookContentId1": "InfobloxCDCB1TDWorkbook", - "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "analyticRuleVersion1": "1.0.1", - "analyticRulecontentId1": "57113ad7-7dd6-4150-84d8-252e162aaf4a", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "analyticRuleVersion2": "1.0.1", - "analyticRulecontentId2": "818eddaa-3806-43a2-8930-3defc5a06803", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2')))]", - "analyticRuleVersion3": "1.0.1", - "analyticRulecontentId3": "dc7af829-d716-4774-9d6f-03d9aa7c27a4", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3')))]", - "uiConfigId1": "InfobloxCloudDataConnector", - "_uiConfigId1": "[variables('uiConfigId1')]", - "dataConnectorContentId1": "InfobloxCloudDataConnector", - "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", - "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", - "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "InfobloxCDC-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "parserName1": "Infoblox Cloud Data Connector Data Parser", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]" - }, - "resources": [ - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('workbookTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Infoblox Cloud Data Connector Workbook with template", - "displayName": "Infoblox Cloud Data Connector workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" - ], - "properties": { - "description": "InfobloxCDCB1TDWorkbookWorkbook Workbook with template version 2.0.10", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", - "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "Sets the time name for analysis" - }, - "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the solution.\",\"style\":\"info\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox CDC BloxOne DDI & Threat Defense Workbook\\r\\n\\r\\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \\r\\n\\r\\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\nSupported BloxOne Cloud Source log types:\\r\\n* Threat Defense Query/Response Log\\r\\n* Threat Defense Threat Feeds Hits Log\\r\\n* DDI Query/Response Log\\r\\n* DDI DHCP Lease Log\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS & DHCP Overview\",\"subTarget\":\"DNS & DHCP Overview\",\"style\":\"link\"},{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Overview\",\"subTarget\":\"Security Overview\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Device\",\"subTarget\":\"Events by Device\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Domain\",\"subTarget\":\"Events by Domain\",\"style\":\"link\"},{\"id\":\"2e942b67-07c4-4579-ac5b-f43c5b01c51c\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Filters\",\"subTarget\":\"Filters\",\"style\":\"link\"}]},\"name\":\"links - 16\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9878ee10-a66a-4438-afdd-29789d76bd61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":14400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\\r\\n\\r\\n---\\r\\n\",\"style\":\"info\"},\"customWidth\":\"70\",\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"0 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Device\\r\\n---\\r\\n#### Get a closer look into where threat data is originating. \\r\\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"12793c1f-b77e-4319-99f6-b6b4230d9cfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19099936-395c-4ac9-a462-097e6c1fe50c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"2d6b86ef-4bd8-4afd-be72-83f7cb365585\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8e48699a-6c2e-42b2-bcd8-15cfce54fe4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"f57d037a-57c8-4b7b-93fd-8f6215d1c9c2\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Device in the chart below to further drilldown the device.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Hit Count by Device\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Device\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {ip} - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Feed Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Threat Class Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Class Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"group\":\"ThreatLevel\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"label\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"label\":\"\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"label\":\"\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"label\":\"\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Level Trend for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Action Trend for {ip}\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Queries for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"60%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Queries for {ip}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {ip} by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"80\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Queries for {ip} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Events for {ip} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Total Events for {ip} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Device\"},\"name\":\"Events by Device\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Destination Domain\\r\\n---\\r\\n#### Get a closer look into what is being queried. \\r\\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d2856d9-b23c-4779-916d-abef2e4c50e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a5663eb6-1030-421e-a60a-6af9f4af3f99\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"5cbd5c34-3703-4835-aa3b-228504310c1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3c67b4c6-8cf3-4c75-87ea-4bca83dee296\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"730927d0-a8ce-461d-b20b-fe9cda17c486\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Queries by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Query in the chart below to further drilldown the query.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Hit Count by Query/Domain\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestinationDnsDomain\",\"exportParameterName\":\"domain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Query/Domain\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {domain}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {domain} - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Devices Querying {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Devices Querying {domain}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Devices Querying {domain} by Time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Devices Querying {domain} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Events for {domain} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {domain} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Domain\"},\"name\":\"Events by Domain\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne Threat Defense Security Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne Threat Defense security data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1eedd218-57c0-43e3-a306-a716380b05e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Threat Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(ThreatClass)\",\"size\":3,\"title\":\"Unique Threat Classes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_ThreatClass\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Security Hits (All Actions)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Security Hits (All Actions)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Allowed + Logged Hits (PASSTHRU)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Allowed + Logged Hits (PASSTHRU)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Block\\\" or SimplifiedDeviceAction == \\\"NXDOMAIN\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Blocked Hits (NXDOMAIN)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Blocked Hits (NXDOMAIN)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Redirect\\\" or SimplifiedDeviceAction == \\\"REDIRECT\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Redirects (REDIRECT)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Redirects (REDIRECT)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| where ThreatLevel == \\\"High\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total High Threat Level Hits Not Blocked\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total High Threat Level Hits Not Blocked\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName !has_cs \\\"CAT_\\\" and InfobloxRPZ !has_cs \\\"CAT_\\\" and InfobloxB1FeedName !has_cs \\\"APP_\\\" and InfobloxRPZ !has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Non-Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"coldHot\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Non-Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"yellow\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Application Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\",\"size\":3,\"title\":\"Security Hits over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"60\",\"name\":\"Security Hits over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 50 by count_ desc\",\"size\":2,\"title\":\"Top Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"65\",\"name\":\"Top Indicators\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ desc\",\"size\":3,\"title\":\"Top Impacted IPs\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"35\",\"name\":\"Top Impacted IPs\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Threat Level\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\\\"N/A\\\",1, 0,\\\"Info\\\",2, 0,\\\"Low\\\",3, 0,\\\"Medium\\\",4, 0,\\\"High\\\",5]\\r\\n|union\\r\\n(\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatLevel_count = case(ThreatLevel == \\\"High\\\", 5, ThreatLevel==\\\"Medium\\\", 4, ThreatLevel==\\\"Low\\\", 3, ThreatLevel==\\\"Info\\\", 2, 1)\\r\\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\\r\\n)\\r\\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\\r\\n| sort by ThreatLevel_count asc\",\"size\":0,\"title\":\"Hit Count by Threat Level\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"graph\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"status_count\",\"sortOrderField\":1,\"size\":\"auto\"},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"nodeIdField\":\"Count\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"ThreatLevel\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\"},{\"operator\":\"Default\",\"representation\":\"gray\"}]},\"hivesMargin\":5}},\"customWidth\":\"30\",\"name\":\"Hit Count by Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"70\",\"name\":\"Threat Level Trend\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Feed\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n\\r\\n//| summarize c = count() by InfobloxB1FeedName\\r\\n//| summarize c = sum(c) by InfobloxB1FeedName = tolower(InfobloxB1FeedName)\\r\\n\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Hit Count by Feed\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Feed\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"0\",\"label\":\"N/A\",\"color\":\"green\"},{\"seriesName\":\"1\",\"label\":\"Low/Info\",\"color\":\"blue\"},{\"seriesName\":\"8\",\"label\":\"High\",\"color\":\"red\"},{\"seriesName\":\"5\",\"label\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"70\",\"name\":\"Feed Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Class\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| order by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hit Count by Class\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Class\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Class Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"name\":\"Class Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Action\"},\"name\":\"text - 8 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SimplifiedDeviceAction\\r\\n| top 10 by count_ desc\",\"size\":0,\"title\":\"Hit Count By Action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"30\",\"name\":\"Hit Count By Action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"70\",\"name\":\"Action Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"showPin\":false,\"name\":\"RPZ Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Security Overview\"},\"name\":\"Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne DNS Query/Response & DHCP Leases Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Queries (Domains)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Queries (Domains)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode\",\"size\":0,\"title\":\"DNS Queries over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DNS Queries over Time - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"New DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"New DHCP Leases (Unique IPs)\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false,\"size\":\"full\"}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Updated DHCP Leases \",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Updated DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Released DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Released DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| summarize avg(toint(column_ifexists(\\\"InfobloxLifetime\\\", \\\"\\\")))\",\"size\":3,\"title\":\"Average Lease Lifespan (seconds)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"avg_InfobloxLifetime\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Average Lease Lifespan (seconds)\"}]},\"customWidth\":\"40\",\"name\":\"Totals - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"title\":\"DHCP Leases over Time\",\"color\":\"magenta\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DHCP Leases over Time\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DNS Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Top Requested Domains\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Top Requested Domains\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"title\":\"Response Codes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Response Codes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxB1ConnectionType\",\"size\":3,\"title\":\"Queries by Connection Type\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"\",\"label\":\"unknown\",\"color\":\"orange\"}]}},\"name\":\"Queries by Connection Type\"}]},\"customWidth\":\"30\",\"name\":\"group - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 25 by count_ desc\",\"size\":2,\"title\":\"Top Source IPs by DNS Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"40\",\"name\":\"Top Source IPs by DNS Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DNS Events\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DHCP Events\"},\"name\":\"text - 8 - Copy - Copy - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b71068b1-a89d-4605-8440-802f89726143\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPTypeParam\",\"label\":\"DHCP Operation\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n\\r\\n { \\\"value\\\":\\\"Create\\\"},\\r\\n { \\\"value\\\":\\\"Delete\\\"},\\r\\n { \\\"value\\\":\\\"Update\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, SourceIP, SourceHostName, SourceMACAddress, InfobloxLeaseOp, InfobloxLifetime, InfobloxLeaseUUID, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DHCP Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"DNS & DHCP Overview\"},\"name\":\"DNS Query/Response Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Filters \\r\\n---\\r\\n\\r\\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\\r\\n\\r\\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \\r\\n\\r\\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters).\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\" or InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"All Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"All Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redPurple\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Application Filter Hits\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Category Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CatFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {CatFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Category Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Application Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AppFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {AppFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Application Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}}]},\"name\":\"Overview\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Filters\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9f55f1ff-f771-485f-82a9-52a9f42251cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FilterTypeParam\",\"label\":\"Filter Type\",\"type\":2,\"isRequired\":true,\"value\":\"CAT_\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"CAT_\\\", \\\"label\\\":\\\"Category Filters\\\" },\\r\\n { \\\"value\\\":\\\"APP_\\\", \\\"label\\\":\\\"Application Filters\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":172800000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 15 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Filters by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Filter in the chart below to further drilldown the filter.\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Filter \",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"InfobloxDomainCat\",\"exportParameterName\":\"filter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Filter \",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat\\r\\n| sort by TimeGenerated desc, SourceIP desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {filter}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by SourceIP\\r\\n| top 10 by count_ desc\\r\\n\",\"size\":2,\"title\":\"Top IPs for {filter}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top IPs for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 10 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {filter} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"74\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {filter} by Time\",\"styleSettings\":{\"margin\":\"0 0 0 1%\"}}]},\"name\":\"Category Filter By Type\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Source IP\"},\"name\":\"text - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Source IP in the chart below to further drilldown the IP.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Source IP\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip_cat\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Source IP\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP\\r\\n| sort by TimeGenerated desc, InfobloxDomainCat desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\",\"size\":2,\"title\":\"Top Queries for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 10 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters for {ip_cat} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Filters for {ip_cat} by Time\"}]},\"name\":\"Category Filter by IP\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Filters\"},\"name\":\"Category Filters\"}],\"styleSettings\":{\"spacingStyle\":\"none\"},\"fromTemplateId\":\"sentinel-InfobloxCDCB1TDWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", - "properties": { - "description": "@{workbookKey=InfobloxCDCB1TDWorkbook; logoFileName=infoblox_logo.svg; description=Sets the time name for analysis; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Infoblox Cloud Data Connector; templateRelativePath=InfobloxCDCB1TDWorkbook.json; subtitle=; provider=InfoBlox}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "CommonSecurityLog", - "kind": "DataType" - }, - { - "contentId": "InfobloxCloudDataConnector", - "kind": "DataConnector" - } - ] - } - } - } - ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Infoblox Cloud Data Connector Analytics Rule 1 with template", - "displayName": "Infoblox Cloud Data Connector Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" - ], - "properties": { - "description": "Infoblox-HighNumberOfHighThreatLevelQueriesDetected_AnalyticalRules Analytics Rule with template version 2.0.10", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "This creates an incident in the event a single host generates at least 200 high threat level RPZ queries (Threat Defense security hits) in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).", - "displayName": "Infoblox - High Number of High Threat Level Queries Detected", - "enabled": false, - "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where ThreatLevel_Score >=80\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where ThreatLevel_Score >=80\n ) on SourceIP\n| extend timestamp = TimeGenerated, IPCustomEntity = SourceIP, HostCustomEntity = DeviceName\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "CommonSecurityLog (InfobloxCDC)" - ], - "connectorId": "InfobloxCloudDataConnector" - } - ], - "tactics": [ - "Impact" - ], - "techniques": [ - "T1498", - "T1565" - ], - "entityMappings": [ - { - "entityType": "IP", - "fieldMappings": [ - { - "columnName": "IPCustomEntity", - "identifier": "Address" - } - ] - }, - { - "entityType": "Host", - "fieldMappings": [ - { - "columnName": "HostCustomEntity", - "identifier": "HostName" - } - ] - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", - "properties": { - "description": "Infoblox Cloud Data Connector Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName2')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Infoblox Cloud Data Connector Analytics Rule 2 with template", - "displayName": "Infoblox Cloud Data Connector Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName2'),'/',variables('analyticRuleVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName2'))]" - ], - "properties": { - "description": "Infoblox-HighNumberOfNXDOMAINDNSResponsesDetected_AnalyticalRules Analytics Rule with template version 2.0.10", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId2')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "This creates an incident in the event a single host generates at least 200 DNS responses for non-existent domains in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).", - "displayName": "Infoblox - High Number of NXDOMAIN DNS Responses Detected", - "enabled": false, - "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID == \"DNS Response\"\n| where InfobloxDNSRCode == \"NXDOMAIN\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID == \"DNS Response\"\n | where InfobloxDNSRCode == \"NXDOMAIN\"\n ) on SourceIP\n| extend timestamp = TimeGenerated, IPCustomEntity = SourceIP, HostCustomEntity = DeviceName\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "CommonSecurityLog (InfobloxCDC)" - ], - "connectorId": "InfobloxCloudDataConnector" - } - ], - "tactics": [ - "Impact" - ], - "techniques": [ - "T1498", - "T1565" - ], - "entityMappings": [ - { - "entityType": "IP", - "fieldMappings": [ - { - "columnName": "IPCustomEntity", - "identifier": "Address" - } - ] - }, - { - "entityType": "Host", - "fieldMappings": [ - { - "columnName": "HostCustomEntity", - "identifier": "HostName" - } - ] - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", - "properties": { - "description": "Infoblox Cloud Data Connector Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('analyticRuleTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Infoblox Cloud Data Connector Analytics Rule 3 with template", - "displayName": "Infoblox Cloud Data Connector Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('analyticRuleTemplateSpecName3'),'/',variables('analyticRuleVersion3'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName3'))]" - ], - "properties": { - "description": "Infoblox-HighThreatLevelQueryNotBlockedDetected_AnalyticalRules Analytics Rule with template version 2.0.10", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId3')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "This creates an incident in the event a single host generates at least 1 high threat level query (Threat Defense security hit) that is not blocked or redirected in 1 hour. Query count threshold and scheduling is customizable. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).", - "displayName": "Infoblox - High Threat Level Query Not Blocked Detected", - "enabled": false, - "query": "let threshold = 1;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where ThreatLevel_Score >=80\n| where InfobloxB1PolicyAction == \"Log\" or SimplifiedDeviceAction == \"PASSTHRU\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where ThreatLevel_Score >=80\n | where InfobloxB1PolicyAction == \"Log\" or SimplifiedDeviceAction == \"PASSTHRU\"\n ) on SourceIP\n| extend timestamp = TimeGenerated, IPCustomEntity = SourceIP, HostCustomEntity = DeviceName\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "CommonSecurityLog (InfobloxCDC)" - ], - "connectorId": "InfobloxCloudDataConnector" - } - ], - "tactics": [ - "Impact" - ], - "techniques": [ - "T1498", - "T1565" - ], - "entityMappings": [ - { - "entityType": "IP", - "fieldMappings": [ - { - "columnName": "IPCustomEntity", - "identifier": "Address" - } - ] - }, - { - "entityType": "Host", - "fieldMappings": [ - { - "columnName": "HostCustomEntity", - "identifier": "HostName" - } - ] - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", - "properties": { - "description": "Infoblox Cloud Data Connector Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('dataConnectorTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Infoblox Cloud Data Connector data connector with template", - "displayName": "Infoblox Cloud Data Connector template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" - ], - "properties": { - "description": "Infoblox Cloud Data Connector data connector with template version 2.0.10", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "Infoblox Cloud Data Connector", - "publisher": "Infoblox", - "descriptionMarkdown": "The Infoblox Cloud Data Connector allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "InfobloxCDC", - "baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"" - } - ], - "sampleQueries": [ - { - "description": "Return all BloxOne Threat Defense (TD) security events logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"" - }, - { - "description": "Return all BloxOne Query/Response logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"DNS\"" - }, - { - "description": "Return all Category Filters security events logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=CAT_\"" - }, - { - "description": "Return all Application Filters security events logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=APP_\"" - }, - { - "description": "Return Top 10 TD Domains Hit Count", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by DestinationDnsDomain \n| top 10 by count_ desc" - }, - { - "description": "Return Top 10 TD Source IPs Hit Count", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by SourceIP \n| top 10 by count_ desc" - }, - { - "description": "Return Recently Created DHCP Leases", - "query": "InfobloxCDC\n| where DeviceEventClassID == \"DHCP-LEASE-CREATE\"" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (InfobloxCDC)", - "lastDataReceivedQuery": "InfobloxCDC\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "InfobloxCDC\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the solution." - }, - { - "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Cloud Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Cloud Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Microsoft Sentinel or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Follow the steps below to configure the Infoblox CDC to send BloxOne data to Microsoft Sentinel via the Linux Syslog agent.\n2. Navigate to **Manage > Data Connector**.\n3. Click the **Destination Configuration** tab at the top.\n4. Click **Create > Syslog**. \n - **Name**: Give the new Destination a meaningful **name**, such as **Microsoft-Sentinel-Destination**.\n - **Description**: Optionally give it a meaningful **description**.\n - **State**: Set the state to **Enabled**.\n - **Format**: Set the format to **CEF**.\n - **FQDN/IP**: Enter the IP address of the Linux device on which the Linux agent is installed.\n - **Port**: Leave the port number at **514**.\n - **Protocol**: Select desired protocol and CA certificate if applicable.\n - Click **Save & Close**.\n5. Click the **Traffic Flow Configuration** tab at the top.\n6. Click **Create**.\n - **Name**: Give the new Traffic Flow a meaningful **name**, such as **Microsoft-Sentinel-Flow**.\n - **Description**: Optionally give it a meaningful **description**. \n - **State**: Set the state to **Enabled**. \n - Expand the **CDC Enabled Host** section. \n - **On-Prem Host**: Select your desired on-prem host for which the Data Connector service is enabled. \n - Expand the **Source Configuration** section. \n - **Source**: Select **BloxOne Cloud Source**. \n - Select all desired **log types** you wish to collect. Currently supported log types are:\n - Threat Defense Query/Response Log\n - Threat Defense Threat Feeds Hits Log\n - DDI Query/Response Log\n - DDI DHCP Lease Log\n - Expand the **Destination Configuration** section. \n - Select the **Destination** you just created. \n - Click **Save & Close**. \n7. Allow the configuration some time to activate.", - "title": "2. Configure Infoblox BloxOne to send Syslog data to the Infoblox Cloud Data Connector to forward to the Syslog agent" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "Infoblox Cloud Data Connector", - "publisher": "Infoblox", - "descriptionMarkdown": "The Infoblox Cloud Data Connector allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "InfobloxCDC", - "baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (InfobloxCDC)", - "lastDataReceivedQuery": "InfobloxCDC\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "InfobloxCDC\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Return all BloxOne Threat Defense (TD) security events logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"" - }, - { - "description": "Return all BloxOne Query/Response logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"DNS\"" - }, - { - "description": "Return all Category Filters security events logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=CAT_\"" - }, - { - "description": "Return all Application Filters security events logs", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=APP_\"" - }, - { - "description": "Return Top 10 TD Domains Hit Count", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by DestinationDnsDomain \n| top 10 by count_ desc" - }, - { - "description": "Return Top 10 TD Source IPs Hit Count", - "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by SourceIP \n| top 10 by count_ desc" - }, - { - "description": "Return Recently Created DHCP Leases", - "query": "InfobloxCDC\n| where DeviceEventClassID == \"DHCP-LEASE-CREATE\"" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the solution." - }, - { - "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Cloud Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Cloud Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Microsoft Sentinel or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Follow the steps below to configure the Infoblox CDC to send BloxOne data to Microsoft Sentinel via the Linux Syslog agent.\n2. Navigate to **Manage > Data Connector**.\n3. Click the **Destination Configuration** tab at the top.\n4. Click **Create > Syslog**. \n - **Name**: Give the new Destination a meaningful **name**, such as **Microsoft-Sentinel-Destination**.\n - **Description**: Optionally give it a meaningful **description**.\n - **State**: Set the state to **Enabled**.\n - **Format**: Set the format to **CEF**.\n - **FQDN/IP**: Enter the IP address of the Linux device on which the Linux agent is installed.\n - **Port**: Leave the port number at **514**.\n - **Protocol**: Select desired protocol and CA certificate if applicable.\n - Click **Save & Close**.\n5. Click the **Traffic Flow Configuration** tab at the top.\n6. Click **Create**.\n - **Name**: Give the new Traffic Flow a meaningful **name**, such as **Microsoft-Sentinel-Flow**.\n - **Description**: Optionally give it a meaningful **description**. \n - **State**: Set the state to **Enabled**. \n - Expand the **CDC Enabled Host** section. \n - **On-Prem Host**: Select your desired on-prem host for which the Data Connector service is enabled. \n - Expand the **Source Configuration** section. \n - **Source**: Select **BloxOne Cloud Source**. \n - Select all desired **log types** you wish to collect. Currently supported log types are:\n - Threat Defense Query/Response Log\n - Threat Defense Threat Feeds Hits Log\n - DDI Query/Response Log\n - DDI DHCP Lease Log\n - Expand the **Destination Configuration** section. \n - Select the **Destination** you just created. \n - Click **Save & Close**. \n7. Allow the configuration some time to activate.", - "title": "2. Configure Infoblox BloxOne to send Syslog data to the Infoblox Cloud Data Connector to forward to the Syslog agent" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - } - ], - "id": "[variables('_uiConfigId1')]", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the solution." - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2022-02-01", - "name": "[variables('parserTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, - "properties": { - "description": "InfobloxCDC Data Parser with template", - "displayName": "InfobloxCDC Data Parser template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2022-02-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" - ], - "properties": { - "description": "InfobloxCDC Data Parser with template version 2.0.10", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[variables('_parserName1')]", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Infoblox Cloud Data Connector Data Parser", - "category": "Samples", - "functionAlias": "InfobloxCDC", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\r\n| extend AEcopy = AdditionalExtensions\r\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\r\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\r\n| mv-apply AEcopy on (\r\n summarize AdditionalExtensionsParsedNested = make_bag(pack(tostring(AEcopy[0]), AEcopy[1]))\r\n)\r\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\r\n| evaluate bag_unpack(AdditionalExtensionsParsed)\r\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\r\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\r\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\r\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\r\n ThreatLevel_Score == 0,\"Info\",\r\n \"N/A\" )\r\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\r\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\r\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\r\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\r\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\r\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\r\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\r\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\r\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\r\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\r\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\r\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\r\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\r\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\r\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\r\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\r\n", - "version": 1, - "tags": [ - { - "name": "description", - "value": "Infoblox Cloud Data Connector Data Parser" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserName1')]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", - "source": { - "name": "Infoblox Cloud Data Connector", - "kind": "Solution", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('_parserName1')]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Infoblox Cloud Data Connector Data Parser", - "category": "Samples", - "functionAlias": "InfobloxCDC", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\r\n| extend AEcopy = AdditionalExtensions\r\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\r\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\r\n| mv-apply AEcopy on (\r\n summarize AdditionalExtensionsParsedNested = make_bag(pack(tostring(AEcopy[0]), AEcopy[1]))\r\n)\r\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\r\n| evaluate bag_unpack(AdditionalExtensionsParsed)\r\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\r\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\r\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\r\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\r\n ThreatLevel_Score == 0,\"Info\",\r\n \"N/A\" )\r\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\r\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\r\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\r\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\r\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\r\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\r\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\r\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\r\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\r\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\r\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\r\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\r\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\r\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\r\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\r\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\r\n", - "version": 1 - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserId1')]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "properties": { - "version": "2.0.10", - "kind": "Solution", - "contentSchemaVersion": "2.0.0", - "contentId": "[variables('_solutionId')]", - "parentId": "[variables('_solutionId')]", - "source": { - "kind": "Solution", - "name": "Infoblox Cloud Data Connector", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "InfoBlox", - "tier": "Partner", - "link": "https://support.infoblox.com/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" - }, - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" - }, - { - "kind": "Parser", - "contentId": "[variables('_parserContentId1')]", - "version": "[variables('parserVersion1')]" - } - ] - }, - "firstPublishDate": "2021-10-20", - "providers": [ - "InfoBlox" - ], - "categories": { - "domains": [ - "Security - Threat Protection" - ] - } - }, - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" - } - ], - "outputs": {} -} +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "Microsoft - support@microsoft.com", + "comments": "Solution template for Infoblox Cloud Data Connector" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Infoblox Cloud Data Connector", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } + }, + "variables": { + "email": "support@microsoft.com", + "_email": "[variables('email')]", + "_solutionName": "Infoblox Cloud Data Connector", + "_solutionVersion": "3.0.0", + "solutionId": "infoblox.infoblox-cdc-solution", + "_solutionId": "[variables('solutionId')]", + "workbookVersion1": "1.0.0", + "workbookContentId1": "InfobloxCDCB1TDWorkbook", + "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleVersion1": "1.0.0", + "analyticRulecontentId1": "8db2b374-0337-49bd-94c9-cfbf8e5d83ad", + "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "analyticRuleVersion2": "1.0.0", + "analyticRulecontentId2": "dc7af829-d716-4774-9d6f-03d9aa7c27a4", + "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", + "analyticRuleVersion3": "1.0.0", + "analyticRulecontentId3": "3822b794-fa89-4420-aad6-0e1a2307f419", + "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", + "analyticRuleVersion4": "1.0.0", + "analyticRulecontentId4": "99278700-79ca-4b0f-b416-bf57ec699e1a", + "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", + "analyticRuleVersion5": "1.0.0", + "analyticRulecontentId5": "b2f34315-9065-488e-88d0-a171d2b0da8e", + "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", + "analyticRuleVersion6": "1.0.0", + "analyticRulecontentId6": "5b0864a9-4577-4087-b9fa-de3e14a8a999", + "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", + "analyticRuleVersion7": "1.0.0", + "analyticRulecontentId7": "568730be-b39d-45e3-a392-941e00837d52", + "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", + "analyticRuleVersion8": "1.0.0", + "analyticRulecontentId8": "28ee3c2b-eb4b-44de-a71e-e462843fea72", + "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", + "uiConfigId1": "InfobloxCloudDataConnector", + "_uiConfigId1": "[variables('uiConfigId1')]", + "dataConnectorContentId1": "InfobloxCloudDataConnector", + "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", + "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "_dataConnectorId1": "[variables('dataConnectorId1')]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", + "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "parserName1": "Infoblox Cloud Data Connector Data Parser", + "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", + "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "_parserId1": "[variables('parserId1')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "InfobloxCDC-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "Infoblox-Import-AISCOMM-Weekly": "Infoblox-Import-AISCOMM-Weekly", + "_Infoblox-Import-AISCOMM-Weekly": "[variables('Infoblox-Import-AISCOMM-Weekly')]", + "TemplateEmptyArray": "[json('[]')]", + "playbookVersion1": "1.0", + "playbookContentId1": "Infoblox-Import-AISCOMM-Weekly", + "_playbookContentId1": "[variables('playbookContentId1')]", + "playbookId1": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId1'))]", + "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]", + "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", + "blanks": "[replace('b', 'b', '')]", + "Infoblox-Import-Emails-Weekly": "Infoblox-Import-Emails-Weekly", + "_Infoblox-Import-Emails-Weekly": "[variables('Infoblox-Import-Emails-Weekly')]", + "playbookVersion2": "1.0", + "playbookContentId2": "Infoblox-Import-Emails-Weekly", + "_playbookContentId2": "[variables('playbookContentId2')]", + "playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]", + "playbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2'))))]", + "_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]", + "Infoblox-Import-Hashes-Weekly": "Infoblox-Import-Hashes-Weekly", + "_Infoblox-Import-Hashes-Weekly": "[variables('Infoblox-Import-Hashes-Weekly')]", + "playbookVersion3": "1.0", + "playbookContentId3": "Infoblox-Import-Hashes-Weekly", + "_playbookContentId3": "[variables('playbookContentId3')]", + "playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]", + "playbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3'))))]", + "_playbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId3'),'-', variables('playbookVersion3'))))]", + "Infoblox-Import-Hosts-Daily-LookalikeDomains": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "_Infoblox-Import-Hosts-Daily-LookalikeDomains": "[variables('Infoblox-Import-Hosts-Daily-LookalikeDomains')]", + "playbookVersion4": "1.0", + "playbookContentId4": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "_playbookContentId4": "[variables('playbookContentId4')]", + "playbookId4": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId4'))]", + "playbookTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId4'))))]", + "_playbookcontentProductId4": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId4'),'-', variables('playbookVersion4'))))]", + "Infoblox-Import-Hosts-Daily-MalwareC2DGA": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "_Infoblox-Import-Hosts-Daily-MalwareC2DGA": "[variables('Infoblox-Import-Hosts-Daily-MalwareC2DGA')]", + "playbookVersion5": "1.0", + "playbookContentId5": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "_playbookContentId5": "[variables('playbookContentId5')]", + "playbookId5": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId5'))]", + "playbookTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId5'))))]", + "_playbookcontentProductId5": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId5'),'-', variables('playbookVersion5'))))]", + "Infoblox-Import-Hosts-Daily-Phishing": "Infoblox-Import-Hosts-Daily-Phishing", + "_Infoblox-Import-Hosts-Daily-Phishing": "[variables('Infoblox-Import-Hosts-Daily-Phishing')]", + "playbookVersion6": "1.0", + "playbookContentId6": "Infoblox-Import-Hosts-Daily-Phishing", + "_playbookContentId6": "[variables('playbookContentId6')]", + "playbookId6": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId6'))]", + "playbookTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId6'))))]", + "_playbookcontentProductId6": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId6'),'-', variables('playbookVersion6'))))]", + "Infoblox-Import-Hosts-Hourly": "Infoblox-Import-Hosts-Hourly", + "_Infoblox-Import-Hosts-Hourly": "[variables('Infoblox-Import-Hosts-Hourly')]", + "playbookVersion7": "1.0", + "playbookContentId7": "Infoblox-Import-Hosts-Hourly", + "_playbookContentId7": "[variables('playbookContentId7')]", + "playbookId7": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId7'))]", + "playbookTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId7'))))]", + "_playbookcontentProductId7": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId7'),'-', variables('playbookVersion7'))))]", + "Infoblox-Import-IPs-Hourly": "Infoblox-Import-IPs-Hourly", + "_Infoblox-Import-IPs-Hourly": "[variables('Infoblox-Import-IPs-Hourly')]", + "playbookVersion8": "1.0", + "playbookContentId8": "Infoblox-Import-IPs-Hourly", + "_playbookContentId8": "[variables('playbookContentId8')]", + "playbookId8": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId8'))]", + "playbookTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId8'))))]", + "_playbookcontentProductId8": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId8'),'-', variables('playbookVersion8'))))]", + "Infoblox-Import-URLs-Hourly": "Infoblox-Import-URLs-Hourly", + "_Infoblox-Import-URLs-Hourly": "[variables('Infoblox-Import-URLs-Hourly')]", + "playbookVersion9": "1.0", + "playbookContentId9": "Infoblox-Import-URLs-Hourly", + "_playbookContentId9": "[variables('playbookContentId9')]", + "playbookId9": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId9'))]", + "playbookTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId9'))))]", + "_playbookcontentProductId9": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId9'),'-', variables('playbookVersion9'))))]", + "Infoblox-Incident-Enrichment-Domains": "Infoblox-Incident-Enrichment-Domains", + "_Infoblox-Incident-Enrichment-Domains": "[variables('Infoblox-Incident-Enrichment-Domains')]", + "playbookVersion10": "1.0", + "playbookContentId10": "Infoblox-Incident-Enrichment-Domains", + "_playbookContentId10": "[variables('playbookContentId10')]", + "playbookId10": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId10'))]", + "playbookTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId10'))))]", + "_playbookcontentProductId10": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId10'),'-', variables('playbookVersion10'))))]", + "Infoblox-Incident-Send-Email": "Infoblox-Incident-Send-Email", + "_Infoblox-Incident-Send-Email": "[variables('Infoblox-Incident-Send-Email')]", + "playbookVersion11": "1.0", + "playbookContentId11": "Infoblox-Incident-Send-Email", + "_playbookContentId11": "[variables('playbookContentId11')]", + "playbookId11": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId11'))]", + "playbookTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId11'))))]", + "_playbookcontentProductId11": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId11'),'-', variables('playbookVersion11'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "InfobloxCDCB1TDWorkbookWorkbook Workbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "Sets the time name for analysis" + }, + "properties": { + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox CDC BloxOne DDI & Threat Defense Workbook\\r\\n\\r\\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \\r\\n\\r\\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\nSupported BloxOne Cloud Source log types:\\r\\n* Threat Defense Query/Response Log\\r\\n* Threat Defense Threat Feeds Hits Log\\r\\n* DDI Query/Response Log\\r\\n* DDI DHCP Lease Log\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS & DHCP Overview\",\"subTarget\":\"DNS & DHCP Overview\",\"style\":\"link\"},{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Overview\",\"subTarget\":\"Security Overview\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Device\",\"subTarget\":\"Events by Device\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Domain\",\"subTarget\":\"Events by Domain\",\"style\":\"link\"},{\"id\":\"2e942b67-07c4-4579-ac5b-f43c5b01c51c\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Filters\",\"subTarget\":\"Filters\",\"style\":\"link\"}]},\"name\":\"links - 16\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9878ee10-a66a-4438-afdd-29789d76bd61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":14400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\\r\\n\\r\\n---\\r\\n\",\"style\":\"info\"},\"customWidth\":\"70\",\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"0 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Device\\r\\n---\\r\\n#### Get a closer look into where threat data is originating. \\r\\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"12793c1f-b77e-4319-99f6-b6b4230d9cfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19099936-395c-4ac9-a462-097e6c1fe50c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"2d6b86ef-4bd8-4afd-be72-83f7cb365585\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8e48699a-6c2e-42b2-bcd8-15cfce54fe4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"f57d037a-57c8-4b7b-93fd-8f6215d1c9c2\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Device in the chart below to further drilldown the device.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Hit Count by Device\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Device\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {ip} - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Feed Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Threat Class Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Class Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"group\":\"ThreatLevel\",\"createOtherGroup\":\"\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"label\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"label\":\"\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"label\":\"\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"label\":\"\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Level Trend for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Action Trend for {ip}\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Queries for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"60%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Queries for {ip}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {ip} by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"80\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Queries for {ip} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Events for {ip} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Total Events for {ip} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Device\"},\"name\":\"Events by Device\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Destination Domain\\r\\n---\\r\\n#### Get a closer look into what is being queried. \\r\\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d2856d9-b23c-4779-916d-abef2e4c50e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a5663eb6-1030-421e-a60a-6af9f4af3f99\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"5cbd5c34-3703-4835-aa3b-228504310c1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3c67b4c6-8cf3-4c75-87ea-4bca83dee296\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"730927d0-a8ce-461d-b20b-fe9cda17c486\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Queries by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Query in the chart below to further drilldown the query.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Hit Count by Query/Domain\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestinationDnsDomain\",\"exportParameterName\":\"domain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Query/Domain\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {domain}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {domain} - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Devices Querying {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Devices Querying {domain}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Devices Querying {domain} by Time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Devices Querying {domain} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Events for {domain} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {domain} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Domain\"},\"name\":\"Events by Domain\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne Threat Defense Security Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne Threat Defense security data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1eedd218-57c0-43e3-a306-a716380b05e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Threat Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(ThreatClass)\",\"size\":3,\"title\":\"Unique Threat Classes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_ThreatClass\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Security Hits (All Actions)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Security Hits (All Actions)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Allowed + Logged Hits (PASSTHRU)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Allowed + Logged Hits (PASSTHRU)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Block\\\" or SimplifiedDeviceAction == \\\"NXDOMAIN\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Blocked Hits (NXDOMAIN)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Blocked Hits (NXDOMAIN)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Redirect\\\" or SimplifiedDeviceAction == \\\"REDIRECT\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Redirects (REDIRECT)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Redirects (REDIRECT)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| where ThreatLevel == \\\"High\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total High Threat Level Hits Not Blocked\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total High Threat Level Hits Not Blocked\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName !has_cs \\\"CAT_\\\" and InfobloxRPZ !has_cs \\\"CAT_\\\" and InfobloxB1FeedName !has_cs \\\"APP_\\\" and InfobloxRPZ !has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Non-Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"coldHot\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Non-Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"yellow\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Application Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\",\"size\":3,\"title\":\"Security Hits over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"60\",\"name\":\"Security Hits over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 50 by count_ desc\",\"size\":2,\"title\":\"Top Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"65\",\"name\":\"Top Indicators\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ desc\",\"size\":3,\"title\":\"Top Impacted IPs\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"35\",\"name\":\"Top Impacted IPs\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Threat Level\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\\\"N/A\\\",1, 0,\\\"Info\\\",2, 0,\\\"Low\\\",3, 0,\\\"Medium\\\",4, 0,\\\"High\\\",5]\\r\\n|union\\r\\n(\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatLevel_count = case(ThreatLevel == \\\"High\\\", 5, ThreatLevel==\\\"Medium\\\", 4, ThreatLevel==\\\"Low\\\", 3, ThreatLevel==\\\"Info\\\", 2, 1)\\r\\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\\r\\n)\\r\\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\\r\\n| sort by ThreatLevel_count asc\",\"size\":0,\"title\":\"Hit Count by Threat Level\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"graph\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"status_count\",\"sortOrderField\":1,\"size\":\"auto\"},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"nodeIdField\":\"Count\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"ThreatLevel\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\"},{\"operator\":\"Default\",\"representation\":\"gray\"}]},\"hivesMargin\":5}},\"customWidth\":\"30\",\"name\":\"Hit Count by Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"70\",\"name\":\"Threat Level Trend\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Feed\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n\\r\\n//| summarize c = count() by InfobloxB1FeedName\\r\\n//| summarize c = sum(c) by InfobloxB1FeedName = tolower(InfobloxB1FeedName)\\r\\n\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Hit Count by Feed\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Feed\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"0\",\"label\":\"N/A\",\"color\":\"green\"},{\"seriesName\":\"1\",\"label\":\"Low/Info\",\"color\":\"blue\"},{\"seriesName\":\"8\",\"label\":\"High\",\"color\":\"red\"},{\"seriesName\":\"5\",\"label\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"70\",\"name\":\"Feed Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Class\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| order by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hit Count by Class\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Class\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Class Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"name\":\"Class Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Action\"},\"name\":\"text - 8 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SimplifiedDeviceAction\\r\\n| top 10 by count_ desc\",\"size\":0,\"title\":\"Hit Count By Action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"30\",\"name\":\"Hit Count By Action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"70\",\"name\":\"Action Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"showPin\":false,\"name\":\"RPZ Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Security Overview\"},\"name\":\"Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne DNS Query/Response & DHCP Leases Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Queries (Domains)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Queries (Domains)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode\",\"size\":0,\"title\":\"DNS Queries over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DNS Queries over Time - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"New DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"New DHCP Leases (Unique IPs)\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false,\"size\":\"full\"}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Updated DHCP Leases \",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Updated DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Released DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Released DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| summarize avg(toint(column_ifexists(\\\"InfobloxLifetime\\\", \\\"\\\")))\",\"size\":3,\"title\":\"Average Lease Lifespan (seconds)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"avg_InfobloxLifetime\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Average Lease Lifespan (seconds)\"}]},\"customWidth\":\"40\",\"name\":\"Totals - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"title\":\"DHCP Leases over Time\",\"color\":\"magenta\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DHCP Leases over Time\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DNS Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Top Requested Domains\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Top Requested Domains\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"title\":\"Response Codes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Response Codes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxB1ConnectionType\",\"size\":3,\"title\":\"Queries by Connection Type\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"\",\"label\":\"unknown\",\"color\":\"orange\"}]}},\"name\":\"Queries by Connection Type\"}]},\"customWidth\":\"30\",\"name\":\"group - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 25 by count_ desc\",\"size\":2,\"title\":\"Top Source IPs by DNS Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"40\",\"name\":\"Top Source IPs by DNS Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DNS Events\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DHCP Events\"},\"name\":\"text - 8 - Copy - Copy - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b71068b1-a89d-4605-8440-802f89726143\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPTypeParam\",\"label\":\"DHCP Operation\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n\\r\\n { \\\"value\\\":\\\"Create\\\"},\\r\\n { \\\"value\\\":\\\"Delete\\\"},\\r\\n { \\\"value\\\":\\\"Update\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, SourceIP, SourceHostName, SourceMACAddress, InfobloxLeaseOp, InfobloxLifetime, InfobloxLeaseUUID, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DHCP Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"DNS & DHCP Overview\"},\"name\":\"DNS Query/Response Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Filters \\r\\n---\\r\\n\\r\\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\\r\\n\\r\\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \\r\\n\\r\\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters).\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\" or InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"All Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"All Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redPurple\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Application Filter Hits\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Category Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CatFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {CatFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Category Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Application Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AppFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {AppFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Application Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}}]},\"name\":\"Overview\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Filters\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9f55f1ff-f771-485f-82a9-52a9f42251cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FilterTypeParam\",\"label\":\"Filter Type\",\"type\":2,\"isRequired\":true,\"value\":\"CAT_\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"CAT_\\\", \\\"label\\\":\\\"Category Filters\\\" },\\r\\n { \\\"value\\\":\\\"APP_\\\", \\\"label\\\":\\\"Application Filters\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":172800000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 15 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Filters by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Filter in the chart below to further drilldown the filter.\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Filter \",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"InfobloxDomainCat\",\"exportParameterName\":\"filter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Filter \",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat\\r\\n| sort by TimeGenerated desc, SourceIP desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {filter}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by SourceIP\\r\\n| top 10 by count_ desc\\r\\n\",\"size\":2,\"title\":\"Top IPs for {filter}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top IPs for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 10 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {filter} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"74\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {filter} by Time\",\"styleSettings\":{\"margin\":\"0 0 0 1%\"}}]},\"name\":\"Category Filter By Type\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Source IP\"},\"name\":\"text - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Source IP in the chart below to further drilldown the IP.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Source IP\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip_cat\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Source IP\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP\\r\\n| sort by TimeGenerated desc, InfobloxDomainCat desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\",\"size\":2,\"title\":\"Top Queries for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 10 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters for {ip_cat} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Filters for {ip_cat} by Time\"}]},\"name\":\"Category Filter by IP\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Filters\"},\"name\":\"Category Filters\"}],\"fallbackResourceIds\":[],\"styleSettings\":{\"spacingStyle\":\"none\"},\"fromTemplateId\":\"sentinel-InfobloxCDCB1TDWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "properties": { + "description": "@{workbookKey=InfobloxCDCB1TDWorkbook; logoFileName=infoblox_logo.svg; description=Sets the time name for analysis; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Infoblox Cloud Data Connector; templateRelativePath=InfobloxCDCB1TDWorkbook.json; subtitle=; provider=InfoBlox}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "InfobloxCloudDataConnector", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-DataExfiltrationAttack_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId1')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "displayName": "Infoblox - Data Exfiltration Attack", + "enabled": false, + "query": "let threshold = 1;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where InfobloxB1FeedName == \"Threat Insight - Data Exfiltration\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=innerunique (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where InfobloxB1FeedName == \"Threat Insight - Data Exfiltration\"\n ) on SourceIP\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "InfobloxCloudDataConnector", + "dataTypes": [ + "CommonSecurityLog (InfobloxCDC)" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SourceIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "DeviceName", + "identifier": "HostName" + }, + { + "columnName": "InfobloxB1SrcOSVersion", + "identifier": "OSVersion" + }, + { + "columnName": "SourceUserName", + "identifier": "FullName" + } + ] + }, + { + "entityType": "Malware", + "fieldMappings": [ + { + "columnName": "InfobloxB1FeedName", + "identifier": "Name" + }, + { + "columnName": "InfobloxB1FeedName", + "identifier": "Category" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1FeedName": "InfobloxB1FeedName", + "InfobloxB1Action": "InfobloxB1PolicyAction", + "InfobloxB1PolicyName": "InfobloxB1PolicyName", + "SourceMACAddress": "SourceMACAddress" + }, + "incidentConfiguration": { + "groupingConfiguration": { + "reopenClosedIncident": true, + "matchingMethod": "AllEntities", + "lookbackDuration": "7d", + "enabled": true + }, + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 1", + "parentId": "[variables('analyticRuleId1')]", + "contentId": "[variables('_analyticRulecontentId1')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion1')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - Data Exfiltration Attack", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-HighThreatLevelQueryNotBlockedDetected_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId2')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "At least 1 high threat level query generated by single host in 1 hour that is not blocked or redirected. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "displayName": "Infoblox - High Threat Level Query Not Blocked Detected", + "enabled": false, + "query": "let threshold = 1;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where ThreatLevel_Score >=80\n| where InfobloxB1PolicyAction == \"Log\" or SimplifiedDeviceAction == \"PASSTHRU\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where ThreatLevel_Score >=80\n | where InfobloxB1PolicyAction == \"Log\" or SimplifiedDeviceAction == \"PASSTHRU\"\n ) on SourceIP\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "InfobloxCloudDataConnector", + "dataTypes": [ + "CommonSecurityLog (InfobloxCDC)" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SourceIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "DeviceName", + "identifier": "HostName" + }, + { + "columnName": "InfobloxB1SrcOSVersion", + "identifier": "OSVersion" + }, + { + "columnName": "SourceUserName", + "identifier": "FullName" + } + ] + }, + { + "entityType": "DNS", + "fieldMappings": [ + { + "columnName": "DestinationDnsDomain", + "identifier": "DomainName" + } + ] + }, + { + "entityType": "Malware", + "fieldMappings": [ + { + "columnName": "ThreatProperty", + "identifier": "Name" + }, + { + "columnName": "ThreatClass", + "identifier": "Category" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1FeedName": "InfobloxB1FeedName", + "InfobloxB1Action": "InfobloxB1PolicyAction", + "InfobloxB1PolicyName": "InfobloxB1PolicyName", + "SourceMACAddress": "SourceMACAddress" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 2", + "parentId": "[variables('analyticRuleId2')]", + "contentId": "[variables('_analyticRulecontentId2')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion2')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId2')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - High Threat Level Query Not Blocked Detected", + "contentProductId": "[variables('_analyticRulecontentProductId2')]", + "id": "[variables('_analyticRulecontentProductId2')]", + "version": "[variables('analyticRuleVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName3')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion3')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId3')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "displayName": "Infoblox - Many High Threat Level Queries From Single Host Detected", + "enabled": false, + "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where ThreatLevel_Score >= 80\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where ThreatLevel_Score >= 80\n ) on SourceIP\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "InfobloxCloudDataConnector", + "dataTypes": [ + "CommonSecurityLog (InfobloxCDC)" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SourceIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "DeviceName", + "identifier": "HostName" + }, + { + "columnName": "InfobloxB1SrcOSVersion", + "identifier": "OSVersion" + }, + { + "columnName": "SourceUserName", + "identifier": "FullName" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "SourceMACAddress": "SourceMACAddress" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 3", + "parentId": "[variables('analyticRuleId3')]", + "contentId": "[variables('_analyticRulecontentId3')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion3')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId3')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - Many High Threat Level Queries From Single Host Detected", + "contentProductId": "[variables('_analyticRulecontentProductId3')]", + "id": "[variables('_analyticRulecontentProductId3')]", + "version": "[variables('analyticRuleVersion3')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName4')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-ManyHighThreatLevelSingleQueryDetected_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion4')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId4')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Single high threat level domain queried at least 200 times in 1 hour regardless of source. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "displayName": "Infoblox - Many High Threat Level Single Query Detected", + "enabled": false, + "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where ThreatLevel_Score >= 80\n| summarize count() by DestinationDnsDomain\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where ThreatLevel_Score >= 80\n ) on DestinationDnsDomain\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "InfobloxCloudDataConnector", + "dataTypes": [ + "CommonSecurityLog (InfobloxCDC)" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "DNS", + "fieldMappings": [ + { + "columnName": "DestinationDnsDomain", + "identifier": "DomainName" + } + ] + }, + { + "entityType": "Malware", + "fieldMappings": [ + { + "columnName": "ThreatProperty", + "identifier": "Name" + }, + { + "columnName": "ThreatClass", + "identifier": "Category" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1FeedName": "InfobloxB1FeedName", + "InfobloxB1PolicyName": "InfobloxB1PolicyName" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 4", + "parentId": "[variables('analyticRuleId4')]", + "contentId": "[variables('_analyticRulecontentId4')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion4')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId4')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - Many High Threat Level Single Query Detected", + "contentProductId": "[variables('_analyticRulecontentProductId4')]", + "id": "[variables('_analyticRulecontentProductId4')]", + "version": "[variables('analyticRuleVersion4')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName5')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-ManyNXDOMAINDNSResponsesDetected_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion5')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId5')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "displayName": "Infoblox - Many NXDOMAIN DNS Responses Detected", + "enabled": false, + "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID == \"DNS Response\"\n| where InfobloxDNSRCode == \"NXDOMAIN\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID == \"DNS Response\"\n | where InfobloxDNSRCode == \"NXDOMAIN\"\n ) on SourceIP\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "InfobloxCloudDataConnector", + "dataTypes": [ + "CommonSecurityLog (InfobloxCDC)" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SourceIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "DeviceName", + "identifier": "HostName" + }, + { + "columnName": "InfobloxB1SrcOSVersion", + "identifier": "OSVersion" + }, + { + "columnName": "SourceUserName", + "identifier": "FullName" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "SourceMACAddress": "SourceMACAddress" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 5", + "parentId": "[variables('analyticRuleId5')]", + "contentId": "[variables('_analyticRulecontentId5')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion5')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId5')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - Many NXDOMAIN DNS Responses Detected", + "contentProductId": "[variables('_analyticRulecontentProductId5')]", + "id": "[variables('_analyticRulecontentProductId5')]", + "version": "[variables('analyticRuleVersion5')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName6')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-TI-CommonSecurityLogMatchFound-MalwareC2_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion6')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId6')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "CommonSecurityLog (CEF) MalwareC2/MalwareC2DGA match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired.", + "displayName": "Infoblox - TI - CommonSecurityLog Match Found - MalwareC2", + "enabled": false, + "query": "let dt_lookBack = 1h;\nlet ioc_lookBack = 14d;\nlet TI = ThreatIntelligenceIndicator\n| where TimeGenerated >= ago(ioc_lookBack)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now() \n| where Description has_cs \"Infoblox\"\n| where Description has_cs \"MalwareC2\"\n| where isnotempty(DomainName)\n;\nlet Data = CommonSecurityLog\n| extend HitTime = TimeGenerated\n| where TimeGenerated >= ago(dt_lookBack)\n| where isnotempty(DestinationDnsDomain)\n//Remove trailing period at end of domain\n| extend DestinationDnsDomain = trim_end(@\"\\.$\", DestinationDnsDomain)\n;\nTI | join kind=innerunique Data on $left.DomainName == $right.DestinationDnsDomain\n| where HitTime >= TimeGenerated and HitTime < ExpirationDateTime\n| project LatestIndicatorTime, HitTime, DeviceEventClassID, DestinationDnsDomain, DeviceAction, SourceIP, DeviceName, SourceMACAddress, SourceUserName, AdditionalExtensions, \nAdditionalInformation, Description, ThreatType, TrafficLightProtocolLevel, Type, ConfidenceScore, ExpirationDateTime, SourceSystem, Action, IndicatorId, ExternalIndicatorId, Tags\n", + "queryFrequency": "PT1H", + "queryPeriod": "P14D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "CEF", + "dataTypes": [ + "CommonSecurityLog" + ] + }, + { + "connectorId": "ThreatIntelligence", + "dataTypes": [ + "ThreatIntelligenceIndicator" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SourceIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "DeviceName", + "identifier": "HostName" + }, + { + "columnName": "SourceUserName", + "identifier": "FullName" + } + ] + }, + { + "entityType": "DNS", + "fieldMappings": [ + { + "columnName": "DestinationDnsDomain", + "identifier": "DomainName" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "SourceMACAddress": "SourceMACAddress" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 6", + "parentId": "[variables('analyticRuleId6')]", + "contentId": "[variables('_analyticRulecontentId6')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion6')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId6')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - TI - CommonSecurityLog Match Found - MalwareC2", + "contentProductId": "[variables('_analyticRulecontentProductId6')]", + "id": "[variables('_analyticRulecontentProductId6')]", + "version": "[variables('analyticRuleVersion6')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName7')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-TI-InfobloxCDCMatchFound-LookalikeDomains_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion7')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId7')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "InfobloxCDC Lookalike Domain match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "displayName": "Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains", + "enabled": false, + "query": "let dt_lookBack = 1h;\nlet ioc_lookBack = 14d;\nlet TI = ThreatIntelligenceIndicator\n| where TimeGenerated >= ago(ioc_lookBack)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now() \n| where Description == \"Infoblox - HOST - Policy\"\n| where Tags has_cs \"Property: Policy_LookalikeDomains\" \n| where isnotempty(DomainName)\n;\nlet Data = InfobloxCDC\n| extend HitTime = TimeGenerated\n| where TimeGenerated >= ago(dt_lookBack)\n| where isnotempty(DestinationDnsDomain)\n//Remove trailing period at end of domain\n| extend DestinationDnsDomain = trim_end(@\"\\.$\", DestinationDnsDomain)\n;\nTI | join kind=innerunique Data on $left.DomainName == $right.DestinationDnsDomain\n| where HitTime >= TimeGenerated and HitTime < ExpirationDateTime\n| project LatestIndicatorTime, HitTime, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested, \nAdditionalInformation, Description, ThreatType, TrafficLightProtocolLevel, Type, ConfidenceScore, ExpirationDateTime, SourceSystem, Action, IndicatorId, ExternalIndicatorId, Tags\n", + "queryFrequency": "PT1H", + "queryPeriod": "P14D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "InfobloxCloudDataConnector", + "dataTypes": [ + "CommonSecurityLog (InfobloxCDC)" + ] + }, + { + "connectorId": "ThreatIntelligence", + "dataTypes": [ + "ThreatIntelligenceIndicator" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SourceIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "DeviceName", + "identifier": "HostName" + }, + { + "columnName": "InfobloxB1SrcOSVersion", + "identifier": "OSVersion" + }, + { + "columnName": "SourceUserName", + "identifier": "FullName" + } + ] + }, + { + "entityType": "DNS", + "fieldMappings": [ + { + "columnName": "DestinationDnsDomain", + "identifier": "DomainName" + } + ] + }, + { + "entityType": "Malware", + "fieldMappings": [ + { + "columnName": "ThreatProperty", + "identifier": "Name" + }, + { + "columnName": "ThreatClass", + "identifier": "Category" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "customDetails": { + "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1FeedName": "InfobloxB1FeedName", + "InfobloxB1Action": "InfobloxB1PolicyAction", + "InfobloxB1PolicyName": "InfobloxB1PolicyName", + "SourceMACAddress": "SourceMACAddress" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 7", + "parentId": "[variables('analyticRuleId7')]", + "contentId": "[variables('_analyticRulecontentId7')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion7')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId7')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - TI - InfobloxCDC Match Found - Lookalike Domains", + "contentProductId": "[variables('_analyticRulecontentProductId7')]", + "id": "[variables('_analyticRulecontentProductId7')]", + "version": "[variables('analyticRuleVersion7')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName8')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-TI-SyslogMatchFound-URL_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion8')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId8')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Syslog URL match found in your Infoblox TIDE Threat Intelligence. Customize query count, scheduling, responses and more. Modify data sources, types and threat properties as desired.", + "displayName": "Infoblox - TI - Syslog Match Found - URL", + "enabled": false, + "query": "let dt_lookBack = 1h;\nlet ioc_lookBack = 14d;\nlet TI = ThreatIntelligenceIndicator\n| where TimeGenerated >= ago(ioc_lookBack)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now() \n| where Description has_cs \"Infoblox - URL\"\n| where isnotempty(DomainName)\n;\nlet Data = Syslog\n| extend HitTime = TimeGenerated\n| where TimeGenerated >= ago(dt_lookBack)\n//Extract URL patterns from syslog message\n| extend Url = extract(\"(http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\\\\(\\\\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+)\", 1,SyslogMessage)\n| where isnotempty(Url)\n;\nTI | join kind=innerunique Data on $left.DomainName == $right.Url\n| where HitTime >= TimeGenerated and HitTime < ExpirationDateTime\n| project LatestIndicatorTime, HitTime, SyslogMessage, Computer, ProcessName, Url, HostIP, \nAdditionalInformation, Description, ThreatType, TrafficLightProtocolLevel, Type, ConfidenceScore, ExpirationDateTime, SourceSystem, Action, IndicatorId, ExternalIndicatorId, Tags\n", + "queryFrequency": "PT1H", + "queryPeriod": "P14D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "Syslog", + "dataTypes": [ + "Syslog" + ] + }, + { + "connectorId": "ThreatIntelligence", + "dataTypes": [ + "ThreatIntelligenceIndicator" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1498", + "T1565" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "HostIP", + "identifier": "Address" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "Computer", + "identifier": "HostName" + } + ] + }, + { + "entityType": "DNS", + "fieldMappings": [ + { + "columnName": "Url", + "identifier": "DomainName" + } + ] + }, + { + "entityType": "URL", + "fieldMappings": [ + { + "columnName": "Url", + "identifier": "Url" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "incidentConfiguration": { + "createIncident": true + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", + "properties": { + "description": "Infoblox Cloud Data Connector Analytics Rule 8", + "parentId": "[variables('analyticRuleId8')]", + "contentId": "[variables('_analyticRulecontentId8')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion8')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId8')]", + "contentKind": "AnalyticsRule", + "displayName": "Infoblox - TI - Syslog Match Found - URL", + "contentProductId": "[variables('_analyticRulecontentProductId8')]", + "id": "[variables('_analyticRulecontentProductId8')]", + "version": "[variables('analyticRuleVersion8')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox Cloud Data Connector data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "Infoblox Cloud Data Connector", + "publisher": "Infoblox", + "descriptionMarkdown": "The Infoblox Cloud Data Connector allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "InfobloxCDC", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"" + } + ], + "sampleQueries": [ + { + "description": "Return all BloxOne Threat Defense (TD) security events logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"" + }, + { + "description": "Return all BloxOne Query/Response logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"DNS\"" + }, + { + "description": "Return all Category Filters security events logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=CAT_\"" + }, + { + "description": "Return all Application Filters security events logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=APP_\"" + }, + { + "description": "Return Top 10 TD Domains Hit Count", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by DestinationDnsDomain \n| top 10 by count_ desc" + }, + { + "description": "Return Top 10 TD Source IPs Hit Count", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by SourceIP \n| top 10 by count_ desc" + }, + { + "description": "Return Recently Created DHCP Leases", + "query": "InfobloxCDC\n| where DeviceEventClassID == \"DHCP-LEASE-CREATE\"" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (InfobloxCDC)", + "lastDataReceivedQuery": "InfobloxCDC\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "InfobloxCDC\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ] + }, + "instructionSteps": [ + { + "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." + }, + { + "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + }, + { + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "innerSteps": [ + { + "title": "1.1 Select or create a Linux machine", + "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + }, + { + "title": "1.2 Install the CEF collector on the Linux machine", + "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run the following command to install and apply the CEF collector:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "1. Linux Syslog agent configuration" + }, + { + "description": "Follow the steps below to configure the Infoblox CDC to send BloxOne data to Microsoft Sentinel via the Linux Syslog agent.\n2. Navigate to **Manage > Data Connector**.\n3. Click the **Destination Configuration** tab at the top.\n4. Click **Create > Syslog**. \n - **Name**: Give the new Destination a meaningful **name**, such as **Azure-Sentinel-Destination**.\n - **Description**: Optionally give it a meaningful **description**.\n - **State**: Set the state to **Enabled**.\n - **Format**: Set the format to **CEF**.\n - **FQDN/IP**: Enter the IP address of the Linux device on which the Linux agent is installed.\n - **Port**: Leave the port number at **514**.\n - **Protocol**: Select desired protocol and CA certificate if applicable.\n - Click **Save & Close**.\n5. Click the **Traffic Flow Configuration** tab at the top.\n6. Click **Create**.\n - **Name**: Give the new Traffic Flow a meaningful **name**, such as **Azure-Sentinel-Flow**.\n - **Description**: Optionally give it a meaningful **description**. \n - **State**: Set the state to **Enabled**. \n - Expand the **CDC Enabled Host** section. \n - **On-Prem Host**: Select your desired on-prem host for which the Data Connector service is enabled. \n - Expand the **Source Configuration** section. \n - **Source**: Select **BloxOne Cloud Source**. \n - Select all desired **log types** you wish to collect. Currently supported log types are:\n - Threat Defense Query/Response Log\n - Threat Defense Threat Feeds Hits Log\n - DDI Query/Response Log\n - DDI DHCP Lease Log\n - Expand the **Destination Configuration** section. \n - Select the **Destination** you just created. \n - Click **Save & Close**. \n7. Allow the configuration some time to activate.", + "title": "2. Configure Infoblox BloxOne to send Syslog data to the Infoblox Cloud Data Connector to forward to the Syslog agent" + }, + { + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "3. Validate connection" + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "4. Secure your machine " + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "Infoblox Cloud Data Connector", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Infoblox Cloud Data Connector", + "publisher": "Infoblox", + "descriptionMarkdown": "The Infoblox Cloud Data Connector allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "InfobloxCDC", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (InfobloxCDC)", + "lastDataReceivedQuery": "InfobloxCDC\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "InfobloxCDC\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Return all BloxOne Threat Defense (TD) security events logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"" + }, + { + "description": "Return all BloxOne Query/Response logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"DNS\"" + }, + { + "description": "Return all Category Filters security events logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=CAT_\"" + }, + { + "description": "Return all Application Filters security events logs", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n | where AdditionalExtensions has_cs \"InfobloxRPZ=APP_\"" + }, + { + "description": "Return Top 10 TD Domains Hit Count", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by DestinationDnsDomain \n| top 10 by count_ desc" + }, + { + "description": "Return Top 10 TD Source IPs Hit Count", + "query": "InfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\" \n| summarize count() by SourceIP \n| top 10 by count_ desc" + }, + { + "description": "Return Recently Created DHCP Leases", + "query": "InfobloxCDC\n| where DeviceEventClassID == \"DHCP-LEASE-CREATE\"" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ] + }, + "instructionSteps": [ + { + "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." + }, + { + "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + }, + { + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "innerSteps": [ + { + "title": "1.1 Select or create a Linux machine", + "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + }, + { + "title": "1.2 Install the CEF collector on the Linux machine", + "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run the following command to install and apply the CEF collector:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "1. Linux Syslog agent configuration" + }, + { + "description": "Follow the steps below to configure the Infoblox CDC to send BloxOne data to Microsoft Sentinel via the Linux Syslog agent.\n2. Navigate to **Manage > Data Connector**.\n3. Click the **Destination Configuration** tab at the top.\n4. Click **Create > Syslog**. \n - **Name**: Give the new Destination a meaningful **name**, such as **Azure-Sentinel-Destination**.\n - **Description**: Optionally give it a meaningful **description**.\n - **State**: Set the state to **Enabled**.\n - **Format**: Set the format to **CEF**.\n - **FQDN/IP**: Enter the IP address of the Linux device on which the Linux agent is installed.\n - **Port**: Leave the port number at **514**.\n - **Protocol**: Select desired protocol and CA certificate if applicable.\n - Click **Save & Close**.\n5. Click the **Traffic Flow Configuration** tab at the top.\n6. Click **Create**.\n - **Name**: Give the new Traffic Flow a meaningful **name**, such as **Azure-Sentinel-Flow**.\n - **Description**: Optionally give it a meaningful **description**. \n - **State**: Set the state to **Enabled**. \n - Expand the **CDC Enabled Host** section. \n - **On-Prem Host**: Select your desired on-prem host for which the Data Connector service is enabled. \n - Expand the **Source Configuration** section. \n - **Source**: Select **BloxOne Cloud Source**. \n - Select all desired **log types** you wish to collect. Currently supported log types are:\n - Threat Defense Query/Response Log\n - Threat Defense Threat Feeds Hits Log\n - DDI Query/Response Log\n - DDI DHCP Lease Log\n - Expand the **Destination Configuration** section. \n - Select the **Destination** you just created. \n - Click **Save & Close**. \n7. Allow the configuration some time to activate.", + "title": "2. Configure Infoblox BloxOne to send Syslog data to the Infoblox Cloud Data Connector to forward to the Syslog agent" + }, + { + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "3. Validate connection" + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "4. Secure your machine " + } + ], + "id": "[variables('_uiConfigId1')]", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "InfobloxCDC Data Parser with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('_parserName1')]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Infoblox Cloud Data Connector Data Parser", + "category": "Samples", + "functionAlias": "InfobloxCDC", + "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\r\n| extend AEcopy = AdditionalExtensions\r\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\r\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\r\n| mv-apply AEcopy on (\r\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\r\n)\r\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\r\n| evaluate bag_unpack(AdditionalExtensionsParsed)\r\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\r\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\r\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\r\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\r\n ThreatLevel_Score == 0,\"Info\",\r\n \"N/A\" )\r\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\r\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\r\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\r\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\r\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\r\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\r\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\r\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\r\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\r\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\r\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\r\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\r\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\r\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\r\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\r\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\r\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n", + "functionParameters": "", + "version": 1, + "tags": [ + { + "name": "description", + "value": "Infoblox Cloud Data Connector Data Parser" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "dependsOn": [ + "[variables('_parserName1')]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", + "source": { + "name": "Infoblox Cloud Data Connector", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "Infoblox Cloud Data Connector Data Parser", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('_parserName1')]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Infoblox Cloud Data Connector Data Parser", + "category": "Samples", + "functionAlias": "InfobloxCDC", + "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\r\n| extend AEcopy = AdditionalExtensions\r\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\r\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\r\n| mv-apply AEcopy on (\r\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\r\n)\r\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\r\n| evaluate bag_unpack(AdditionalExtensionsParsed)\r\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\r\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\r\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\r\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\r\n ThreatLevel_Score == 0,\"Info\",\r\n \"N/A\" )\r\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\r\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\r\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\r\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\r\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\r\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\r\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\r\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\r\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\r\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\r\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\r\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\r\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\r\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\r\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\r\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\r\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n", + "functionParameters": "", + "version": 1, + "tags": [ + { + "name": "description", + "value": "Infoblox Cloud Data Connector Data Parser" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "dependsOn": [ + "[variables('_parserId1')]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-AISCOMM-Weekly Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion1')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-AISCOMM-Weekly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Week", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Week", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "profile": "AISCOMM", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-AISCOMM-Weekly", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId1')]", + "contentId": "[variables('_playbookContentId1')]", + "kind": "Playbook", + "version": "[variables('playbookVersion1')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import AISCOMM Weekly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all indicators from the AISCOMM data provider on a scheduled weekly basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId1')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-AISCOMM-Weekly", + "contentProductId": "[variables('_playbookcontentProductId1')]", + "id": "[variables('_playbookcontentProductId1')]", + "version": "[variables('playbookVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-Emails-Weekly Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion2')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Emails-Weekly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Week", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Week", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/email/" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Emails-Weekly", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId2')]", + "contentId": "[variables('_playbookContentId2')]", + "kind": "Playbook", + "version": "[variables('playbookVersion2')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import Emails Weekly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected emails on a scheduled weekly basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId2')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-Emails-Weekly", + "contentProductId": "[variables('_playbookcontentProductId2')]", + "id": "[variables('_playbookcontentProductId2')]", + "version": "[variables('playbookVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName3')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-Hashes-Weekly Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion3')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hashes-Weekly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Week", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Week", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{toLower(items('For_Each_Indicator_(Threat)')?['hash_type'])}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/hash/weekly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hashes-Weekly", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId3'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId3')]", + "contentId": "[variables('_playbookContentId3')]", + "kind": "Playbook", + "version": "[variables('playbookVersion3')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import Hashes Weekly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected hashes on a scheduled weekly basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId3')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-Hashes-Weekly", + "contentProductId": "[variables('_playbookcontentProductId3')]", + "id": "[variables('_playbookcontentProductId3')]", + "version": "[variables('playbookVersion3')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName4')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-Hosts-Daily-LookalikeDomains Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion4')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Day", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Day", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "property": "Policy_LookalikeDomains", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId4'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId4')]", + "contentId": "[variables('_playbookContentId4')]", + "kind": "Playbook", + "version": "[variables('playbookVersion4')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import Hosts Daily Lookalike Domains", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Lookalike domains on a scheduled daily basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId4')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-Hosts-Daily-LookalikeDomains", + "contentProductId": "[variables('_playbookcontentProductId4')]", + "id": "[variables('_playbookcontentProductId4')]", + "version": "[variables('playbookVersion4')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName5')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-Hosts-Daily-MalwareC2DGA Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion5')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Day", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Day", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "class": "MalwareC2DGA", + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId5'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId5')]", + "contentId": "[variables('_playbookContentId5')]", + "kind": "Playbook", + "version": "[variables('playbookVersion5')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import Hosts Daily MalwareC2DGA", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected MalwareC2DGA domains on a scheduled daily basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId5')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-Hosts-Daily-MalwareC2DGA", + "contentProductId": "[variables('_playbookcontentProductId5')]", + "id": "[variables('_playbookcontentProductId5')]", + "version": "[variables('playbookVersion5')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName6')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-Hosts-Daily-Phishing Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion6')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Daily-Phishing", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Day", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Day", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "class": "Phishing", + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/daily" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Daily-Phishing", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId6'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId6')]", + "contentId": "[variables('_playbookContentId6')]", + "kind": "Playbook", + "version": "[variables('playbookVersion6')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import Hosts Daily Phishing", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports newly detected Phishing domains on a scheduled daily basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId6')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-Hosts-Daily-Phishing", + "contentProductId": "[variables('_playbookcontentProductId6')]", + "id": "[variables('_playbookcontentProductId6')]", + "version": "[variables('playbookVersion6')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName7')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-Hosts-Hourly Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion7')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-Hosts-Hourly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/host/hourly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-Hosts-Hourly", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId7'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId7')]", + "contentId": "[variables('_playbookContentId7')]", + "kind": "Playbook", + "version": "[variables('playbookVersion7')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import Hosts Hourly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected hosts on a scheduled hourly basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId7')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-Hosts-Hourly", + "contentProductId": "[variables('_playbookcontentProductId7')]", + "id": "[variables('_playbookcontentProductId7')]", + "version": "[variables('playbookVersion7')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName8')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-IPs-Hourly Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion8')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-IPs-Hourly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/ip/hourly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-IPs-Hourly", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId8'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId8')]", + "contentId": "[variables('_playbookContentId8')]", + "kind": "Playbook", + "version": "[variables('playbookVersion8')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import IPs Hourly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected IPs on a scheduled hourly basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId8')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-IPs-Hourly", + "contentProductId": "[variables('_playbookcontentProductId8')]", + "id": "[variables('_playbookcontentProductId8')]", + "version": "[variables('playbookVersion8')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName9')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Import-URLs-Hourly Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion9')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Import-URLs-Hourly", + "type": "string" + }, + "AD Application Secret": { + "type": "string", + "metadata": { + "description": "Enter value for AD Application Secret" + } + }, + "Client ID": { + "type": "string", + "metadata": { + "description": "Enter value for Client ID" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + }, + "Tenant ID": { + "type": "string", + "metadata": { + "description": "Enter value for Tenant ID" + } + } + }, + "variables": { + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "AD Application Secret": { + "defaultValue": "[[parameters('AD Application Secret')]", + "type": "string" + }, + "Client ID": { + "defaultValue": "[[parameters('Client ID')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + }, + "Tenant ID": { + "defaultValue": "[[parameters('Tenant ID')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "For_Each_Indicator_(Threat)": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Switch": { + "cases": { + "EMAIL": { + "case": "EMAIL", + "actions": { + "Send_Emails_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "emailSenderAddress": "@{items('For_Each_Indicator_(Threat)')?['email']}", + "emailSourceDomain": "@{items('For_Each_Indicator_(Threat)')?['domain']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HASH": { + "case": "HASH", + "actions": { + "Send_Hashes_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "fileHashType": "@{items('For_Each_Indicator_(Threat)')?['hash_type']}", + "fileHashValue": "@{items('For_Each_Indicator_(Threat)')?['hash']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}", + "Hash Type: @{items('For_Each_Indicator_(Threat)')?['hash_type']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "HOST": { + "case": "HOST", + "actions": { + "Send_Hosts_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "domainName": "@{items('For_Each_Indicator_(Threat)')?['host']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "IP": { + "case": "IP", + "actions": { + "Send_IPs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "networkIPv4": "@{items('For_Each_Indicator_(Threat)')?['ip']}", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + }, + "URL": { + "case": "URL", + "actions": { + "Send_URLs_to_Sentinel": { + "type": "Http", + "inputs": { + "authentication": { + "audience": "https://graph.microsoft.com", + "clientId": "@parameters('Client ID')", + "secret": "@parameters('AD Application Secret')", + "tenant": "@parameters('Tenant ID')", + "type": "ActiveDirectoryOAuth" + }, + "body": { + "action": "alert", + "additionalInformation": "@{items('For_Each_Indicator_(Threat)')?['extended']?['notes']}", + "confidence": "@items('For_Each_Indicator_(Threat)')?['confidence']", + "description": "Infoblox - @{items('For_Each_Indicator_(Threat)')?['type']} - @{items('For_Each_Indicator_(Threat)')?['class']}", + "expirationDateTime": "@items('For_Each_Indicator_(Threat)')?['expiration']", + "externalId": "@{items('For_Each_Indicator_(Threat)')?['id']}", + "indicatorProvider": "Infoblox TIDE", + "lastReportedDateTime": "@items('For_Each_Indicator_(Threat)')?['imported']", + "tags": [ + "@{items('For_Each_Indicator_(Threat)')?['type']}", + "Imported: @{items('For_Each_Indicator_(Threat)')?['imported']}", + "Profile: @{items('For_Each_Indicator_(Threat)')?['profile']}", + "Property: @{items('For_Each_Indicator_(Threat)')?['property']}", + "Threat Level: @{items('For_Each_Indicator_(Threat)')?['threat_level']}" + ], + "targetProduct": "Azure Sentinel", + "threatType": "WatchList", + "tlpLevel": "white", + "url": "@{items('For_Each_Indicator_(Threat)')?['url']}" + }, + "method": "POST", + "uri": "https://graph.microsoft.com/beta/security/tiIndicators" + } + } + } + } + }, + "expression": "@items('For_Each_Indicator_(Threat)')?['type']", + "type": "Switch" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Get_TIDE_Data": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "fields": "notes,confidence,type,class,host,expiration,id,imported,type,profile,property,threat_level,extended,email,domain,hash,hash_type,ip,url", + "rlimit": "90000" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats/url/hourly" + } + }, + "Parse_JSON": { + "runAfter": { + "Get_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('Get_TIDE_Data')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Import-URLs-Hourly", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": "[variables('TemplateEmptyArray')]" + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId9'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId9')]", + "contentId": "[variables('_playbookContentId9')]", + "kind": "Playbook", + "version": "[variables('playbookVersion9')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Import URLs Hourly", + "description": "Leverages the Infoblox TIDE API to automatically import threat indicators into the ThreatIntelligenceIndicator table. This playbook imports all newly detected URLs on a scheduled hourly basis.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId9')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Import-URLs-Hourly", + "contentProductId": "[variables('_playbookcontentProductId9')]", + "id": "[variables('_playbookcontentProductId9')]", + "version": "[variables('playbookVersion9')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName10')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Incident-Enrichment-Domains Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion10')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Incident-Enrichment-Domains", + "type": "string" + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + } + }, + "variables": { + "MicrosoftSentinelConnectionName": "[[concat('MicrosoftSentinel-', parameters('PlaybookName'))]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "_connection-2": "[[variables('connection-2')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Entities_-_Get_DNS": { + "runAfter": { + "Initialize_HTML": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/entities/dnsresolution" + } + }, + "For_each_DNS_Domain_Entity": { + "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']", + "actions": { + "For_each_Threat_IoC": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Enrich_Incident_with_TIDE_Data_if_it_exists": { + "else": { + "actions": { + "Add_comment_to_incident": { + "runAfter": { + "Set_HTML_Table_with_TIDE_Data": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

IoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}
\n@{variables('html')}

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + } + }, + "Set_HTML_Table_with_TIDE_Data": { + "type": "SetVariable", + "inputs": { + "name": "html", + "value": "

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ID@{items('For_each_Threat_IoC')?['id']}
Type@{items('For_each_Threat_IoC')?['type']}
Host@{items('For_each_Threat_IoC')?['host']}
Domain@{items('For_each_Threat_IoC')?['domain']}
URL@{items('For_each_Threat_IoC')?['url']}
IP@{items('For_each_Threat_IoC')?['ip']}
Email@{items('For_each_Threat_IoC')?['email']}
Hash@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']}
Profile@{items('For_each_Threat_IoC')?['profile']}
Property@{items('For_each_Threat_IoC')?['property']}
Threat Level@{items('For_each_Threat_IoC')?['threat_level']}
Confidence@{items('For_each_Threat_IoC')?['confidence']}
Detected@{items('For_each_Threat_IoC')?['detected']}
Received@{items('For_each_Threat_IoC')?['received']}
Imported@{items('For_each_Threat_IoC')?['imported']}
Expiration@{items('For_each_Threat_IoC')?['expiration']}
Description@{items('For_each_Threat_IoC')?['extended']?['notes']}
Open in CSPhttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary

" + } + }, + "Update_incident_Tags": { + "runAfter": { + "Add_comment_to_incident": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "tagsToAdd": { + "TagsToAdd": [ + { + "Tag": "@items('For_each_Threat_IoC')?['type']" + }, + { + "Tag": "Imported: @{items('For_each_Threat_IoC')?['imported']}" + }, + { + "Tag": "Profile: @{items('For_each_Threat_IoC')?['profile']}" + }, + { + "Tag": "Property: @{items('For_each_Threat_IoC')?['property']}" + }, + { + "Tag": "Threat Level: @{items('For_each_Threat_IoC')?['threat_level']}" + } + ] + } + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "put", + "path": "/Incidents" + } + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_JSON')?['record_count']", + 0 + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "HTTP_-_Get_TIDE_Data_(Hosts)": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']", + "rlimit": "1" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats" + } + }, + "Parse_JSON": { + "runAfter": { + "HTTP_-_Get_TIDE_Data_(Hosts)": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "runAfter": { + "Entities_-_Get_DNS": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Initialize_HTML": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html", + "type": "string" + } + ] + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "connectionName": "[[variables('MicrosoftSentinelConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Incident-Enrichment-Domains", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('MicrosoftSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('MicrosoftSentinelConnectionName')]", + "parameterValueType": "Alternative", + "api": { + "id": "[[variables('_connection-2')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId10'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId10')]", + "contentId": "[variables('_playbookContentId10')]", + "kind": "Playbook", + "version": "[variables('playbookVersion10')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Incident Enrichment Domains", + "description": "Leverages the Infoblox TIDE API to enrich Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "prerequisites": [ + "Infoblox TIDE API key." + ], + "postDeployment": [ + "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group.", + "2. Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "entities": [ + "DnsResolution" + ], + "tags": [ + "Enrichment" + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId10')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Incident-Enrichment-Domains", + "contentProductId": "[variables('_playbookcontentProductId10')]", + "id": "[variables('_playbookcontentProductId10')]", + "version": "[variables('playbookVersion10')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName11')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Infoblox-Incident-Send-Email Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion11')]", + "parameters": { + "PlaybookName": { + "defaultValue": "Infoblox-Incident-Send-Email", + "type": "string" + }, + "Email Recipient": { + "type": "string", + "metadata": { + "description": "Enter value for Email Recipient" + } + }, + "TIDE API Key": { + "type": "string", + "metadata": { + "description": "Enter value for TIDE API Key" + } + } + }, + "variables": { + "MicrosoftSentinelConnectionName": "[[concat('MicrosoftSentinel-', parameters('PlaybookName'))]", + "Office365ConnectionName": "[[concat('Office365-', parameters('PlaybookName'))]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "_connection-2": "[[variables('connection-2')]", + "connection-3": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Office365')]", + "_connection-3": "[[variables('connection-3')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "Email Recipient": { + "defaultValue": "[[parameters('Email Recipient')]", + "type": "string" + }, + "TIDE API Key": { + "defaultValue": "[[parameters('TIDE API Key')]", + "type": "string" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Create_HTML_table_with_Entities": { + "runAfter": { + "Select_Entities": [ + "Succeeded" + ] + }, + "type": "Table", + "inputs": { + "format": "HTML", + "from": "@body('Select_Entities')" + } + }, + "Entities_-_Get_DNS": { + "runAfter": { + "Set_Entities_HTML": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/entities/dnsresolution" + } + }, + "For_each_DNS_Domain_Entity": { + "foreach": "@body('Entities_-_Get_DNS')?['Dnsresolutions']", + "actions": { + "For_each_Threat_IoC": { + "foreach": "@body('Parse_JSON')?['threat']", + "actions": { + "Enrich_Email_with_TIDE_Data_if_it_exists": { + "else": { + "actions": { + "Append_HTML_Table_with_TIDE_Data": { + "type": "AppendToStringVariable", + "inputs": { + "name": "html_tide", + "value": "\n
IoC - @{items('For_each_DNS_Domain_Entity')?['DomainName']} - @{items('For_each_Threat_IoC')?['type']} - @{items('For_each_Threat_IoC')?['class']}
\n \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
ID@{items('For_each_Threat_IoC')?['id']}
Type@{items('For_each_Threat_IoC')?['type']}
Host@{items('For_each_Threat_IoC')?['host']}
Domain@{items('For_each_Threat_IoC')?['domain']}
URL@{items('For_each_Threat_IoC')?['url']}
IP@{items('For_each_Threat_IoC')?['ip']}
Email@{items('For_each_Threat_IoC')?['email']}
Hash@{items('For_each_Threat_IoC')?['hash']} @{items('For_each_Threat_IoC')?['hash_type']}
Profile@{items('For_each_Threat_IoC')?['profile']}
Property@{items('For_each_Threat_IoC')?['property']}
Threat Level@{items('For_each_Threat_IoC')?['threat_level']}
Confidence@{items('For_each_Threat_IoC')?['confidence']}
Detected@{items('For_each_Threat_IoC')?['detected']}
Received@{items('For_each_Threat_IoC')?['received']}
Imported@{items('For_each_Threat_IoC')?['imported']}
Expiration@{items('For_each_Threat_IoC')?['expiration']}
Description@{items('For_each_Threat_IoC')?['extended']?['notes']}
Open in CSPhttps://csp.infoblox.com/#/security_research/search/auto/@{items('For_each_Threat_IoC')?['host']}/summary
" + } + } + } + }, + "expression": { + "and": [ + { + "equals": [ + "@body('Parse_JSON')?['record_count']", + 0 + ] + } + ] + }, + "type": "If" + } + }, + "runAfter": { + "Parse_JSON": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "HTTP_-_Get_TIDE_Data_(Hosts)": { + "type": "Http", + "inputs": { + "headers": { + "Authorization": "Token @{parameters('TIDE API Key')}" + }, + "method": "GET", + "queries": { + "host": "@items('For_each_DNS_Domain_Entity')?['DomainName']", + "rlimit": "1" + }, + "uri": "https://csp.infoblox.com/tide/api/data/threats" + } + }, + "Parse_JSON": { + "runAfter": { + "HTTP_-_Get_TIDE_Data_(Hosts)": [ + "Succeeded" + ] + }, + "type": "ParseJson", + "inputs": { + "content": "@body('HTTP_-_Get_TIDE_Data_(Hosts)')", + "schema": { + "properties": { + "record_count": { + "type": "integer" + }, + "threat": { + "items": { + "properties": { + "batch_id": { + "type": "string" + }, + "class": { + "type": "string" + }, + "confidence": { + "type": "integer" + }, + "confidence_score": { + "type": "number" + }, + "confidence_score_rating": { + "type": "string" + }, + "confidence_score_vector": { + "type": "string" + }, + "detected": { + "type": "string" + }, + "domain": { + "type": "string" + }, + "email": { + "type": "string" + }, + "expiration": { + "type": "string" + }, + "extended": { + "properties": { + "ais_consent": { + "type": "string" + }, + "cyberint_guid": { + "type": "string" + }, + "no_whitelist": { + "type": "string" + }, + "notes": { + "type": "string" + }, + "protocol": { + "type": "string" + }, + "url_hash": { + "type": "string" + } + }, + "type": "object" + }, + "hash": { + "type": "string" + }, + "hash_type": { + "type": "string" + }, + "host": { + "type": "string" + }, + "id": { + "type": "string" + }, + "imported": { + "type": "string" + }, + "ip": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "property": { + "type": "string" + }, + "received": { + "type": "string" + }, + "risk_score": { + "type": "number" + }, + "risk_score_rating": { + "type": "string" + }, + "risk_score_vector": { + "type": "string" + }, + "threat_level": { + "type": "integer" + }, + "threat_score": { + "type": "number" + }, + "threat_score_rating": { + "type": "string" + }, + "threat_score_vector": { + "type": "string" + }, + "tld": { + "type": "string" + }, + "type": { + "type": "string" + }, + "url": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + } + } + } + }, + "runAfter": { + "Entities_-_Get_DNS": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Initialize_CSS": { + "runAfter": { + "Initialize_Incident_HTML": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "css", + "type": "string", + "value": ".title {\n color: #1F2A47;\n font-size: 2rem;\n letter-spacing: .04em;\n padding: 8px;\n border-bottom: 1px solid #7B7B7B;\n font-weight: bold;\n}\n\ntable {\n border-collapse: collapse;\n border-spacing: 0;\n padding: 0;\n margin: 0 0 20px;\n}\n\n.tkey {\n text-align: right;\n border-right: 1px solid #7B7B7B;\n}\n.tvalue {\n text-align: left;\n border-top: 1px solid #eee !important;\n padding-left: 10px;\n}\n.value {\n font-size: 1.4rem;\n font-weight: bold;\n}\n\n.tkey, .key{\n color: #263137;\n letter-spacing: .04em;\n font-style: italic;\n padding-right: 10px;\n}\n.tvalue, .value {\n color: #1f4728 !important;\n letter-spacing: .02rem;\n}\n\n" + } + ] + } + }, + "Initialize_Entities_HTML": { + "runAfter": { + "Initialize_CSS": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html_entities", + "type": "string" + } + ] + } + }, + "Initialize_Incident_HTML": { + "runAfter": { + "Initialize_TIDE_HTML": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html_incident", + "type": "string" + } + ] + } + }, + "Initialize_TIDE_HTML": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "html_tide", + "type": "string" + } + ] + } + }, + "Select_Entities": { + "runAfter": { + "Initialize_Entities_HTML": [ + "Succeeded" + ] + }, + "type": "Select", + "inputs": { + "from": "@triggerBody()?['object']?['properties']?['relatedEntities']", + "select": { + "Entity": "@item()?['properties']?['friendlyName']", + "Type": "@item()?['kind']" + } + } + }, + "Send_an_email_with_Incident_details": { + "runAfter": { + "Set_Incident_HTML": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": { + "Body": "

@{variables('html_incident')}
\n@{variables('html_tide')}

", + "Importance": "Normal", + "Subject": "New Sentinel Incident - @{triggerBody()?['object']?['properties']?['title']}", + "To": "@parameters('Email Recipient')" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['office365_1']['connectionId']" + } + }, + "method": "post", + "path": "/v2/Mail" + } + }, + "Set_Entities_HTML": { + "runAfter": { + "Create_HTML_table_with_Entities": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "html_entities", + "value": "\n@{body('Create_HTML_table_with_Entities')}\n" + } + }, + "Set_Incident_HTML": { + "runAfter": { + "For_each_DNS_Domain_Entity": [ + "Succeeded" + ] + }, + "type": "SetVariable", + "inputs": { + "name": "html_incident", + "value": "\n
New incident created in Microsoft Sentinel
\n\n

Triggered - @{triggerBody()?['object']?['properties']?['title']}

\n\n

Incident ID - @{triggerBody()?['object']?['properties']?['incidentNumber']}

\n\n

Triggered on - @{triggerBody()?['object']?['properties']?['createdTimeUtc']}

\n\n

Severity - @{triggerBody()?['object']?['properties']?['severity']}

\n\n

Alert providers - @{join(triggerBody()?['object']?['properties']?['additionalData']?['alertProductNames'], '
')}

\n\n

Tactics - \n@{join(triggerBody()?['object']?['properties']?['additionalData']?['tactics'], '
')}

\n\n

Description - \n@{triggerBody()?['object']?['properties']?['description']}

\n\n

Entities - \n@{variables('html_entities')}

\n\n\n\n
TIDE Data
" + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "connectionName": "[[variables('MicrosoftSentinelConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "office365_1": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]", + "connectionName": "[[variables('Office365ConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Office365')]" + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "Infoblox-Incident-Send-Email", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', variables('MicrosoftSentinelConnectionName'))]", + "[[resourceId('Microsoft.Web/connections', variables('Office365ConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('MicrosoftSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('MicrosoftSentinelConnectionName')]", + "parameterValueType": "Alternative", + "api": { + "id": "[[variables('_connection-2')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('Office365ConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('Office365ConnectionName')]", + "api": { + "id": "[[variables('_connection-3')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId11'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId11')]", + "contentId": "[variables('_playbookContentId11')]", + "kind": "Playbook", + "version": "[variables('playbookVersion11')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + } + } + } + ], + "metadata": { + "title": "Infoblox Incident Send Email", + "description": "Sends a detailed email when an incident occurs. Optionally enriches an applicable entity within the email with Infoblox TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "prerequisites": [ + "Infoblox TIDE API key (optional)." + ], + "postDeployment": [ + "1. Grant playbook's Managed Identity **Microsoft Sentinel Responder** or greater to Resource Group.", + "2. Authorize connections." + ], + "lastUpdateTime": "2023-08-07T00:00:00Z", + "entities": [ + "DnsResolution" + ], + "tags": [ + "Enrichment", + "Notification" + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId11')]", + "contentKind": "Playbook", + "displayName": "Infoblox-Incident-Send-Email", + "contentProductId": "[variables('_playbookcontentProductId11')]", + "id": "[variables('_playbookcontentProductId11')]", + "version": "[variables('playbookVersion11')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "Infoblox Cloud Data Connector", + "publisherDisplayName": "Infoblox", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Infoblox Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Agent based logs collection from Windows and Linux machines
    2. \n
\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 8, Playbooks: 11

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "Infoblox Cloud Data Connector", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Infoblox", + "tier": "Partner", + "link": "https://support.infoblox.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId1')]", + "version": "[variables('analyticRuleVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId2')]", + "version": "[variables('analyticRuleVersion2')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId3')]", + "version": "[variables('analyticRuleVersion3')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId4')]", + "version": "[variables('analyticRuleVersion4')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId5')]", + "version": "[variables('analyticRuleVersion5')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId6')]", + "version": "[variables('analyticRuleVersion6')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId7')]", + "version": "[variables('analyticRuleVersion7')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId8')]", + "version": "[variables('analyticRuleVersion8')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" + }, + { + "kind": "Parser", + "contentId": "[variables('_parserContentId1')]", + "version": "[variables('parserVersion1')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-AISCOMM-Weekly')]", + "version": "[variables('playbookVersion1')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-Emails-Weekly')]", + "version": "[variables('playbookVersion2')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-Hashes-Weekly')]", + "version": "[variables('playbookVersion3')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-Hosts-Daily-LookalikeDomains')]", + "version": "[variables('playbookVersion4')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-Hosts-Daily-MalwareC2DGA')]", + "version": "[variables('playbookVersion5')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-Hosts-Daily-Phishing')]", + "version": "[variables('playbookVersion6')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-Hosts-Hourly')]", + "version": "[variables('playbookVersion7')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-IPs-Hourly')]", + "version": "[variables('playbookVersion8')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Import-URLs-Hourly')]", + "version": "[variables('playbookVersion9')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Incident-Enrichment-Domains')]", + "version": "[variables('playbookVersion10')]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_Infoblox-Incident-Send-Email')]", + "version": "[variables('playbookVersion11')]" + } + ] + }, + "firstPublishDate": "2021-10-20", + "providers": [ + "Infoblox" + ], + "categories": { + "domains": [ + "Networking", + "Security - Threat Protection", + "Security - Network", + "Security - Threat Intelligence" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} +} From 993644d764c6194178a042386e9ab2d11e0a8c3c Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Mon, 21 Aug 2023 22:44:59 -0700 Subject: [PATCH 41/47] branding --- .../Package/3.0.0.zip | Bin 44348 -> 41836 bytes .../Package/mainTemplate.json | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index 8f11835cb8b2322f39285d3b901635af82299f0c..4030eebf0f9a742c67ebb4108f1c67c90650028f 100644 GIT binary patch literal 41836 zcmX__V~i+mu&u|oZQHhO+qP}n#-5oywr$(CZTs%;oRj;jtKUwZth`BAYSmJZ1_nU^ z004jh5U4>_KMjTaT!aPyK;s4gK>v4Y>||=_VybE>Vrph-XX#>TZ%1e4Y;Sk1{b|3+ zf%Nko@QDwxOYCMaDe2Zp8+A$7<%r);YFjJW>Mju!lx7i)E~O$#6}Nf$>&N^zFD+?F za?1ss7HTw!!U=Deo!RGYG5=RY;iSUXq-JY(73**nKqGLdKlNsQ&(JRE2Ri zUGYT*zO~EN-aLWAZD!r4trCOv>Ut+b)^iFrz1}?mYS2Hr>(>hNw|KGDIFtnrM44j+ z@HKVG$*L>yx^qEzL27T54_!(ja|gbIrhIQGvlc^4?VFQ)u^RTp4uo8KtE5^CQx zC2H1lG&yobdu?UxzFA*Wt%p%V;%|Qu=KO@elahw`d^`IgnGAWk8I%}{1z}U{@{lha z+&)=+CPq-bz}S9IjwJ8Vy^35&mk0gc!s2OTGF;|kU&!3=Aow__PFT#Wkh0FN4^sY6 zb~b&nVLUtg_-9c9r5I5M0kT-!tPy8CbPl z45;}qvk?g+;p!2C^%{AkfeLfsS_H(RTDyG93ZeGBf-8r#z)v4Rg&A(FDU$4BQYQ=3XG|czkTrI zwAYFH(W{Eoo4{+D#<$ZazT9>4#ztqD#4H@8^?+T-oTOQb$Kgk}bGb?~3g#$KbHjQ2 z+BgA{2=xZAgMApxXrD248jk!TBM1zrWgxi$AUlywFB zLdG*JfCivv*ALyqPx6MGDH_O9KxqtTG%x5Nw?V`uNU>JATIX|;Ri-A*!ESq-2f8>3 zfs*};m{lG!ar)d1ssg5#Sg1|S{RFZ|iEn5cs>`M_P&Hd}v;0M@`MULXuc`py`@ z2Cx%~3HkOUSRicr{s7gO$!LQX{D z#*A^}fk)7*_~wtEgO;6!?|I2eRRf)0k``AL-Z&#jMwltVQo@ylL-YoM>AcIpf2m+& z!a7{#5uansw_hSqq>91Yz4q_dmIp~F>h&gH*bp6SdYXf1(ZRfqXR9!HeUUOrI=Dwif(9aRmf zctGH4RCcR9FVaJO_Ke#IR3Q>r8oU__R@;w>({&l% zjxuW>mDL#BPlaq}A$Ib@vtB*7dX?sOl=BM=u-OtolBTidp328xjD;MGg}8}e;P1^> zCn19!2>KTdgwd1E(X;FaSJ8MkG&VP~u6ePnZR`L9Zgy!$ES(I$qjNc^iy?$`*C&l* zRHSQJ3zEwiJi4)v0NsQrfz%xEH2nltd5+IXQ$QFD0aR9Uq6a}db;gK-BB6?$p%NCv z1}#jUg~`)8YTRL??m1odMUd%&kJS{3yBEm?#OArjO@ESDuM*4qjc`F!a&NOb;d`m9 zGvE2t%0GBlzg-Fj)3MVue3N8!bYMoY@#S)4=eywLyRdzLWUse=m>m9HDjx58-7x)=Jni61a+9{1Ch(aH2x-kVDh1xTre;LnoKDN1fwS4o=`MDuaqIYT* zSeoHEwR>7CM;3QA71|o%j}h!l91fI@DO{@C$)6QW)W`x})Gy+uLG|)`h`8mp+;(6l z8s@X12^#2Aa=`q7Cge(QmVlO42Mz7z6!`1zDvVJ|y+3c9a{WPpiNJ5df2u;g@bCs) z=z{iHMC|V>XYRxr4t8eF23Xvbx#5rt0Xk3bIpxI6r|afGDw0B_I~AvImcy9$&0Tv~s2G)9&S zyVGzlDa&;SRFf46*VW-+KbnGd6u$tAGPG8cs zALgnFS@kGjoJ?gGJ+7Hf_Iuen*-7k8|JZhLVO&|O0}Qxk*WV{#rhmc46GR5^|;|TbDcZ_sl(Y zZ;yHDZ)bFd?Y1)fY5_g?r5m~Ojl$PT&?{&t62RuWZKNK{7+wPQ!& zXY8YqaXNLXtsmrxyU{`z*opD|ol28oKn$7~h1X1g;wGLb<+URRbv$psrjT}Ojs5HR zTb?1HnKoi)4Ax_8M641#7KuC?o&ew<$Ik9d=|0+-oqfzVG|i?How{qd zbG_@!UO+Ws2 zOlZe%E~ksFkGF-b@05BGBG4>Na|onLa~Qat+L|qrCapT6la}3M{&$zK(N7D$G45rr zsGZwaAQnH#eD9%eL4K;-sB@Zg)0XpPvD>k#+}Zv0yiu?GvhIz|kB=ykb!-WXWVe|< z9qVO8e)2i&A>}Go(uDw+Pj~4B^K%`|@mRpF@b0KgkO zFCn6M<|bOKMpV=D*@rVp${(%8>I9j&Tp4BG4z$6I*|Gy~`1eP;6F`smq~eb0R69-9 zb5INvUA0ocjeA-O>ro1n%(TdSn4|!CO&00Bi$uA=>&NaqP2d;l^roNt=^Des%G;!% zI{_+k4dZ{O1mU3unURN618Jn|x|tkPm_U1XA#u^qaDc@rx`ne)$p5z5W*YT&(jh0H zpC7@wDM+(??Yk@JfU5Nwb^0ONu3FM_0e`b8Chgau ze*=YY@Anr_;s5)9*k)99*Q@}8>@)xXi@%Tni2rKUV^G3`~s_EVDh)Vr*ZG5O%?x49VxiVUZnE+B#NBOUil3N$&?rslkz->Ck zu$zzS_|g#4yoC#U54;5e!^5@y@4unUKRTCFb1ygD!aR>;^6j`E(7&O#53q*_8j0ld z4ZkwtihG}kHX7bUu>nL8Rph*nRGPo5$O+w~{>f43))=GUZ#Ya19!G zBd&>l;dkKyRI)A_*{YxY0|0Mdl?k4h>SM>bkO9sd5=o&;i*AtOy;k%k25Ts_&J1lS zBx5Bj z-^F17R|3C(@W@WmBG?hhvtQK=+I0e2PSPQDsz8MbuhS$<-S2_>MZIe0G-7C<%4y7A zu}$md=GwekC(V@=DCHt5cTBs4?b-(dxhX1=TkM5O5Rj10Q4y(-G|o7rC^Ug&6(OEO z&_Ayv79!cR?Lil?0;)Fh4o-5e~m zh+;KM9o29h6jEkir1WH$%BA0npo5P1m`RqEXLZA|sO0(=O+-27f*e~PJ4xJ|h{J)D zDSdogyq+}rXnsRa*{am=W8%ZmHtsRPHb11%tySI-c%}yrR#DRQbPFcwWvmJEs);1d z2CR~21O+np>6L{&4;RH%27)=N=eVxjtVLH%i-R?E(LL2&PZb3DsNMJ-zZNb1<_?kK zZ9N;V>S-qHsiy^YB3;6_qa+bqi6Or`6TYIw5;u-*BZn;HOyQg^XZyZoACiwORU*Zq zT~#EDOVRz=3SK>Ygt)^1amK}2)l7w%#v#-SXm0BQ(lX3_vtR$YhgZ*oBs=AVl3X#c z>}s0raKMt3B8*_Oje4ERC{j))FLUHc7L;3bg4-n}aDlGXlA$aAF_r@VlVr-A7iP2- z&XrYH(KG&lD9*EE{bDdwhxXqd=zWe2to`>KIa|wtuE~6`rOmo7yqgDsHfGLM#=EH$ z+J06NT?JTxp5qHzU0TSe7l*N?FxE8RxDZ*B&T^n^goVzK*R;oFa zyD4%T^(_9)1Vh{EwjH7(_(1NsW|~b#7zI?=v4LRoaHc^e!^|f0G(nu5Ccr1FgZe)S z*I}I>XaA}}UEdN1^?wpRzV>V2{#SzSe-dbCQB)II`jK2^6=ahkO3num=rNP1Hw&X> z8^CTh2->W-9aiyhZ#E3ttY=YfHpm=S^Z2)#4IOGbw}}ejL%5R{ZRVF$VLW5Z`jk{z zVEbFlG#ny@NKmua8dgY|KM2|`{{irEZ$1p#F8={O{sHp&x1RqOUTMkSr^N zBHjXORLMr8s!L=bOa!Fpx~`In*+0V7mL0rj=QgdE*@umxE?H@0^Nc>I~*^ie@d9}QCh0c$TGdn8HK(43r&A>BH8U_TE@qR zv{66L%f>!!8S+Iq*0$w0bBxETxz^Mr*lWdLoj6lSmP2z^j=q0q;`DU??Y)moxcZ~Z zS%Zt@nXzI`CElgqf%6N~ZI3p2bi)wEuqrA~d=tl~ueNt{*qLTb9sA(6SLIyS?FK3a z8_9P00iL{gH{rZ?$M`t7x#6<8A|MUTA9m+QzrRUS8)s8K6pS#vn`cpuNvmS*SRmPg z1!AqY!3S4!*z_s5LfA=+&2rZ(#yjLA9G@}F+f@bSvd~aa8lQ@~k5^(E4&0GRW^dr+ zeXLhFel2pz4P1vge}eNWqs=av#t*BTLF~& zWO;U8Brn<)&Nrd;L4lpIrPrR$C&lgiF@s_whHr}Cn|HL;7xrYCgLzgs%XSKy7sh8h z3UUFVBc9J7XS9zIcFDbuQen8;Nj6Ftvn#j-HO=>K=TvQ3oNmqQ>Rnb^Q=He)?SI|j zm08xpTz}g(XeOfq&Uh~w$6_-!G~yUWM`q`ovTvEO<`z@{HwK&WhWFXZK_vcgZy$cC zpp}R_)YtJ+a7Dd(X_(iN=DFd<*L-T`z|{)IrXvSx6HaLVO!;uO55w!)QSshNwHc5ba%Vt*sv8K)O^ehqWUeO8Y- z_#_D9oivDp%~a)>P!w&riF4qA71o@)T?XukFt`H<$F*X9{J zZe4-(!J#bi!Z4yUiQ!yUe9h|pZq)Kvd^(ukIPR!2JM9MGt*LF|B#XaH3Ns2B&Be8oyteP(m zUo?fesB}FmxMkYt2BL^3Hx5J0MC|yjG?7K>LaMFe>1L$TAp@265ZhB{YQ&I(i)ts) zbQ(j2NPaL;k+nyBe-o}?0=Jrb)o*q*DuFfX8l+Adp5Pt8L8MwAVbu$#S9dAHv_(RUPh)troKV2jd zWG=eVXNAvBEnRJ3%aD>rZi3nev{LEI^}B$P-5#Yi`#tLh=+sVttI_8)iQDZf5eTr1 zz0)c490FDvQGCDzp&;HV z28~jN>|^tkVwgAoJ`P928PPMv>8JrQ&!=UdBzvw$oOMc{9Wvc*MC=6{)@ zk`sD$LaiN#Jh=&9pbRh)=^I+e3e5EP!1MF2hp$y;Ns&G!T)i|4SXeEndf?j#zt@6ed@`gT=XM@Erk2VG%o5oEa@_J@;MQc-ui z+4ep#XN;+h51q@z>)(D|H=RWq6=gaJ#8u1%@G^{gts^wD#L&A08~&&ddqm!37ZB5q zC%kEGmkKEJ3p5}DGAC!)T35*x{Ibvp8l<}YST46JTH{4J9A=gO^; z`G_wjIev$EclGDH`|I2rlM~nInB_;Nk2Btm+t3e3j z^Ihg4jl(>|6MFrx#;Mo|31t)c#fdebZ(Agy$N8SGOREW>!^N!7Qr;nSnZiC`a8Jd*h+g=Ndt0M(nQ+PxiRW>Qtu^ZZX0QC77t zBl9fh#+vD`3JZmWkLOdhQRne13WcW{toGPvB-KQ2DVgrdIFm75w6Uz^VtMrC8m%N6 zE!~pIiluTU`|4tuWSQp5DFzr`+RhNYU=X%0-onfqqU#&)mo9<{BqvlkytG>#hrbbb zyxKj*@c}sR3p6xnA9~IOv!$-#%^%~=$()tdO9)yBKp2!Iz>^<5DJ6->X<`k<@*<2g zD||flVJ>lS^gQQU!vSh(_3d?QhM1Tsi?@7$^mCFxEtkJJv)g?RV3R2G+fMX&pr66SM zY!X4(^-#cUp5tdCJDuK^A9U)|v7BVbkfxjr;EL%NU$_@4rR34A!@O28nrkGH8IAWS zD4WTQoOT&9X}{Krf8NhrMSG7Oh-*g0(AApe2M`DrGV&@5&NX8DDhOn5J>)%JCLKTk z;fdjOMpz)$CxWUe4UYTM;yvx~O9fms8=rPj2`t9-^2{`JLL7rm669|OFPMYK>qN%X zVXAnu_3CFE-jkU_bkQ>~)K{5r?^*ZEM6Y4ahaX{@n!k7lc|-#HC;+VWPqU)rOBZv6 zcT4%pY5}7RK`-W*BMCCLkUWIwyGy?jZd*&w%u;LMxrwD33@PJ4I9m)61XW3->#8#0 zJn=}jqt3KuVr&?RgXEV;$%c_*c-qIdXlGL&vf7i_jI_8rmATNt3U$MuUrq(1C1F=Zt< zDreIjs<#Ut@k$;12%@&Xm_a*pQTRkPjqX*UUG*9t1RBKk27YA)6&*#-J}lnVciA2`;14*x2XsS}xOK+#p8nMPE(67Z|OXduu6n-3%uLC&Sk=-YRc zvWwUq2}9wn@_`^m3ox=DNa{b>Pe+Zpli7|qcZj^D?W$59-MUDT%3qA9*B_u@+iu6P zpDHf_%FDq^OUHGYGDhBbO}-uMC;YCD6MN#FM`&NXbBkE>&OlU;CQP~oSd+2iAe278 zb`Wcbqy33RQq#GKoG_YSwpAu)7HrlT6m&Nk<1*1kvjGpFvYeSB%;F-h z=mh0?H}E<-lFHZ2#Gj*Rc=2oObXUOJlS}I3|sUo%tPY@AJp^_wo05C;)IwWN56d z{hn*bW3tZg<>ce^cXpXCKgU4|h!ArRXlNW9KRVcc-{nfJm(9e_CyI&IMVodI9qtP< z<47P_3!~M5GJ!miNhh67#hFa>Mgz2aBb1p@?5d_plS9Cs_h;dfNN1$13{t;f1&DlIGjMxG zC(7z47Np5PLfh)BhfFQYpbOyIuX48k)te!=K=JThdL-c!F*j|(Ub5ms+lik3jo*T7 zR;2w$2JWL?)j-7uf5pLaUG1e(V^sB$1*-? z*Ma=nZ^*ZBKOZouvoX3uYkCpipe?BCA=nN2TNVVP|Fk!j6!W~u^uNyhxm;xH-cBzy`Bu`W8vIA) z5-HtaXR@|Y-2<^q+2B*uXIuI^E=J3?UelDggl*u@z8G2EJ!aI6mRVh9_ncJnuLv>A zL>}?T;r6dM$sC5>ml~M3f(-TfVf5xUX-9VK6I&k_b zNw^1EwAM(xCWqR$sP4|l#{(AXstf{qy`q)l0ntsZH}Y5lMbN1D21 zdcyfp&{#5-F}Pgj2=LF@U^Zh4r>%_fHkF+~6>`n6OAjA9dVsyLuZ-~eA)KaXiJbD3 zTNYr6%uG8hfrm0#*&^5C$SN1s-i%E!9b^=k@JPhJI4!?(ntJ>fE~bY@%7r$(*Lj|Q z?#>eIqvND+WQk4>NqFsZ%V&1Ai_fun#kYBjx*m}<_yY~DbykaH@Q$c?N8eY7d$Q@# z9?NSH##E1lc9{I#@53T>LhO6Eu3V=FYu!g}AC>Cq{ZT#bTm`0218tbC_i_qiR^>3& z5efS}xe69dT`;^MJ!6Y1Kw*mCIlCSb!->tHxZe`g42deaw^%jEUt`kiI} z7G&3(^gz%m>si&_-3?WDs&|PPbJw0bHeq;OvEuTrtKH3Net()h7dm&wW4X?IZO^0m z)fGE79iQsFJJYyZFL^v&}$Xi-i#HBr6ha2j=T3#@JJ+pKm;I}O43ca zAW3?l1PB#CfiA_{x-GlqGnKT%qnGA-V3hb_0C=5;eak^~I%>`|v1}zj?vKHff6dSP zPBJVwHKylBwX2Z!)nMJ(^FdyLCs+LO^B>c9oU=EqRPp!3k2BD=Neo_kztiH22{BEZ z(_2g|$WC6d0xifR`Znp5Eb)qfwsuHHENSO#2Bvt&(3?l>@N{Lz8lGT$@3KOH+D&7x z{!VjS#Mg?1_y6rOkbmbJ+pT)YK+tS zx6ad(p`!4w`u#FKEM*wQ!4AMC4g5Du~6Kx}Z*T-ZC31MiUmkXXqT{ zlcT;8iYbVF3K`oGxS(2Eb+N=tq}K^9+tZY;<5ls;^`t(7-e znqI!esC+fXafZg0rDryV?^<2Mm|AyYFXanHDuUAaNaT*^w6~TmT5_S4y12?wlgnt3 zSx^#NB%_}32A`}l$~Co;vCPC&Tc>RVH5e=sgZN$rYlKt{Hg{mhc@oMf-RF6T=2EO*1)mqV6QtQCOrx}TI}m- zOgY4!7pB!ab=5NITM(*jm3lWS*C?HmqObpIv30C~Rzf&)%Sz52{_5Y&_~MU30NW?So? zG2RyRbd?|s{iz3xk#DC@8ZQ1SDR^JV03sYzciSdX{BMW;QtRJ|uk#zSsw2oMuGM*6 zSsHbU#>P{kOVn9WmZrTyL>;HLqXts-ezv%H&8f>r!u)27G9xQ^{#TGtYVN%doFkaR z!4Dj#k32gzU%5>0oQwcEt}SdWnjIOtJ;1XO}x+9lqn=T=^p)s*8{| z!Rc?XVkY752%;MAM73{aE2ovur4_~f!RIH5)#N-WKV=kTw8Ds+!+4cbx}7tb*4G|u9n&DLY04M^Y7c!TLh$v+q%*Ap;+RK-ZJ7X z3AQvz5n*@hIenpRRPUVc^_4iO=r0)HrhJn*tHs<0{db2Ik)SMf%79h`3*v-8qsaBu z1G^@TY3OUQ&Y-AQ&0~(8Yo3MPpNwSEa^GpzLsN&h&Yz+o-D$U)9abA|v_AUT>P2ed092jnRU2`;;OLCn_;||^UM(}I*gD0Rz*P+ zAHo0!wJ0Gj<1 zg0VW@bK!8Px)I9y)Yih;r4wLnZnqK_7rbo`qC%S&-i2jQGHHX;N2azlF&brYW6dR? z=0=ocCgqwW{l>NVh|NO8u=5V0x{&sAwoJd{saU+7A10;Ujph^{kX;QGyNqq3p&O@S zB7v|U1Lnx^2Cj{$R3kKA1|zSdocXfrzpkhEmWue+NMP$|JyN}HXiZ01aZ%Hps!e7T zh*JWuSo!)lOHd*d_Rw6q_5B!;^1+!Aun~_GQHluuAS*${HP|ZE zvR`5~(fx_u`mQF3)fi@Txi2puu>I}DWzhf!8D{Eu3kK|DLUPgafgbFnq4nP<1_pGn zlYu^+Wmp3Px>i*#{=oL967V9K*p_C-Op294tlGi-d%D<`8Q%eG%XoXqY#nAnrcH7( z)D_l|a=G5DRE}kfyPrTXdaN$v)}a3$%~}G%=&*V$9`k$Eb^x$?|Df7nx3lG#nLH8B z)<$AxXnX6s3N?<=6NgaBut9s>g|h}wQYavH+s~m}vjlk9?Pta9HLA~fDP=>&m7!(q z-226(pWxoUAKDy5fagy}Rwqe##W5n^iZa!Y1|nr2ZkPkrSN@IEcDnCIk1%U2N=vA#(@@nt*#d6HyB zmvMa{B$c7#V2%>#gLZyN`Kr_RyT9Ag(}!F4(i53ZLhEFnJx^7g?Y)hgzAHUjTNh2O zuP=Gc`LZ4fQz2 zkw71^1rqS2d{E51$;8)-Xc45(;Ye;knmJDK6y*$-{ZE)>Ek1&$G40=R{CG~Q7kjn7 zjKFWBzpDEnN)1op+|UN}68oDLN2sX5-^Z!wS7rUBZascN=YC);KZv{p(BW5`$UHQX4qsw~15by^5`L|fu|NGApo!Mjx3{6_-8Zo>wJ)!) zr(^4IuWG=rxA!jAm)#tiU7xQsV?hhnz&b<;GbkEyX`m0&n4DcE^g8mXM>Xmdkn`%e zIt<~TfEin>x8xo*zaHP6siw*j7a#Prj-lQry{WF5wh=|}S-1mPDTJst)R2|`;6C&d zCJVC_FmNB4Owb=W>!)XP&sya=MYUqCGgLD7r-d1uoKtc-Y>7byp4E`Iuf(uLiU_jNNwiGjJ@5mVStPprqq<4+!cbk0U635Use3@wO{EMQf zM?r5?ab{p2u5qjpm>`zlJta5I@b&8*R8C*I`CwyAD=1+Tj}j*mTKRurAYkuji;D7O4 zI~_(g0;pF$t4eMFHM}MVM$^WBQ(G;p^s4$Gklz5z4DtI603da++E|*Tfe(ex4uoTn z(F$h*Ev*YDpeZmg-UL~g8w2rC*bBq%ood?C)*W9;`6JgVTyR0Fvb;5V5V}$nDRiV< zo^?`vG!r80w<|QTuVyPENO*NmY{4z;}yhuyLC%2%prZaO_zoID7NV;I3O9KBjt_tn)y z%T%sriZWhKmI!>(hpBM4Sv+EKcTG9jgKrz|bkj_i?se0Yv8kL()@Q%*?Di_DeOyCp zYwng+t5vz8Yipp)!Mrbn%=i=9Yc{qgUS&284!6w=-QBl#oQp>WVQ>sRzyK_FwuS=; zPQhwvvC1s|s9AiwE@`nSd}|2;qrxs}(f$dH0;9qzb3+UOqw)#-uS8~1@a#hL2Uh)D z0s>qpg-p1aVLbMZ@@97IBVbeQBEILik|HKe+A>vx8^rHCL;BJlB&RGA}O!{sTtwJn{GJVOP&nR& zStDHTdVo!8=4OT<|ZmEF5f$(~|`8;i&u0zA!oV4vXi4tLhYG&^+6k!4tc7}Z?2us5s0@QNi zjiS(pou1omaCo8F+3C7&`!DZQzn;t`u(5aN{!H)ptE=zsRQ=b*I$8d&i(QFDMF!%= zp&>$f6v8ZLondOm@tzB~v9rHya(m}Kzr3imEyJ~}xNr9FjNGjJd>ntsMR@eWN4#=t zXAk={cHu))yT3qfP5Ng7?9%;>3oz(4Zs<;!+F!XbHLq-3@7dZdxER>+EB&@{|83}Y zN7cFJy|l4&Y01yc?)M|_@W3H-E43ArT_v<~b7L~&d8dD?R45>Ny0>a^erEP!2*S&-_&mYI|;Jtd)f7HFSeduk&|iLz|4Gi z*xP{~jfQr&JNSh}gLfeu2!EhC0>)2-)f%_bev&Eqj$8EmC^7?rex9ssvH2ji zmr)T;SsZ|-?P)qZW(M!>4>EjAjGjI$IJ=vWC^pB?Rh-o)T8a*+ohPrh(X&BN`>Bfu z5|>KF4Xf=;A8sz);W#UW4cF@2GgJ2K+CW6d-%4?+FvFXWLk&rl%f3k0G?cmK*o*Dj z*BZ@LnC-_7&sC_c0K*^Yg{>2u?@uJ8I_OQIp!jDdN`N*uihE2k4I9>09FPNENM%3B z(UiQ?%MAsFyeJ8c6HfH>AZn($xg9YNSDOVBEr+&K2}IChoT)nQ?j)p2bl(!$hnbd# zTXtl!9#R4vPS~)$ZJ=SRHs=YMJYe7v3KqkpVyx`L!8*DV*h5pWeZMxO#as5bKT~NX zmT6X2k2YzlQVEHi@b`))TcYpaLt!B zq&`0cgvALPs%Mn$ZAse4ZM}2{vWoW8Bsm4u)R*FID`e#m!6zBP(~C^llO6b>M$oy5 zMnTlxddT#66*(#ij&vJF zxc(`?O=wZlHy+BU^-%myXtdoMzNt@_>a9} zfczDnR?WTQ4+my#sG*i(U4cQiW&cY2feF*Y)%Sh4a*8oL!6+TMNer49k|=sqO(vS| zc4fZ_$?AMIGKvm7LEFOJV=}U?4V7rfkk*E84l>) zgofw{4fm&PS0U_K<^@z#dMI{Yd9i+nr{ox;=gGR=Z^JTS%IQcb24eVpNx zZ_Pz$GCbf3;aqGkvr}m<$$ISslo3I}`M|=%KoN1tO~d^+*Lfz9Kt&z`?#qN|`yCt< zIYf|bPCI{ zn(f@e6O{v4GznIHUenpj2>F4JJ@EAa{vrPuC6rtWE^~30ya@-}sJ5*tq;%0}rvy+9 zZoW+8Ku=7VP%D;_rL_gg*e!%(BRq6dfvEFBfu^IH#k|hF$|V$9fRh0risWPAjGxo) zHvesjdXxwXgjs8dAp{1;PE)xVVum|K&qV*!c_Qw1(z^rEz`*gA6Zi3Z z6X{3e4gm;VLTs$DWMN5dvhGwV7V0E*!-{jz?)DC7)aRXW0Noq}l51h&OFB5D`w)Tb(LS%QbCa%mQ{9t& zSzh?`TXkOrJK{N}@6OFhhqtiQBhfQI_}`5+Yr)l&4kmJa zZaQMpf?)4-h=TSdCA^?pN}CIl`Q8SG|b7&U6no@ z*?Dfvi1QO?!yX11lsJ5)rwSjgHGO=iXCxXhL-Dz8ExSv7{Mgn$1<4E_nSpKb2Uay7 zhcOjU?j4UBRAJu6P{iktm5YP>p37%!)9=dXJL)|rWf*U!*4>bOp_APohRnt75zyk6 zsZ$CdGaM{n3K(7V1~HU;oy>*nqDzias56j#7MCy)FO>F49$5L~SAY|gJhwoympAXS zT$K*`?$vifPE2biWtLDMCSb`XE3T+RyOh?YqJpXDK(t_O z8433Fe=!su?`ZtKiw6G)Dfi8Wx#y!0D<0ycwd8MUN0}9xl@*XJo9WnF#`@EBz-#)- z1VpE4HgjM85^fj8{p{2FQWr<$;1AQd9c&8bCi)_!}vgWX=Wn zSRM;)TrniGoc7yC!lAeT$*noIa)i*-n!Jc$F=+;5)5pX{i)U>RBYbk6%4{Q9c;=d@ zX7~s7Rl&=bBc!APr~|zMlVW;x8pe0`Lp^< zM9Sxh{M?yh=Y$4t(3?!!5Bw2?g>h9D1663_Ez}MEoQJvO-IWT{##&#nla;_P(dI6z ze9-`C2?q`Sb?Z|J{+UTjy!V-`$73WN?2w&^I>Z`cZBeqSFnpDCY&x+;ZK>8S<5X2y zse?9_tJWVJMv13}iDFRA3&@!>Tj4_+Q8Ep(nOasqQ?>#;lqokVrzXVjuhq3t_!>}I99hkV(*5cF~CRyGXc{9LZ~L(g;AAjPy* zinUX^Bssl3iKJi7jr>JPk5>U&xy(gsd|ZI|N&8y5$(W?!Mw|WSZ*nT(QL*?{4wrW* z^NvHVed&=9oZTrs*w!xZ?c9pDQkHs12}_qCs!8C*=g1W~Pg4}m6QnrKNVVS;9e;8+ ze4bOlK{k!U;=t$5W!XmzhSC5}X7WsL)ZB!X3cmVDQhT##%IMx;fuKo8-GTQ}VqxQ% z%o^%)2-ZER+mEuy^l#x77L{2mCfYi`lv2oaYz?GR>cfkAIv?7Q|DpeR|LRxpb!PW= z+sPp%bXZ=u-lWn7eoQ(s37(V=?$d@;{*fIHKb()y2P5 zU~K{HcR?3-9M|YyC?Je5Q}mf;*hP}~pv;I~`=$aipV+=^zl)25=km{YNgT1~mrWgT zHf+d+=fao%9!;uz|1h8fs(l~(as=`I6}7lV+||(=%tTxQh$b!QE+IyCdnYOTJTi;E z#RG4e`lh%bSqD?<7LVI6_`=ZZUz}2RFG55XaT?50J}n-|tcn7U-!F}5*v0K+WzhQyvzj?(a?Sd}COu-Mu(+w3cE#Pl zWLNJst=frqoT9a1>7I(=z0))P&&35kYn{%#GVujd6+|h2+(TC;I@i4X2v^*qAJ_Gp zQKm5Mm{I8Bemyi=p_*DrSR!JsD1`O;U@II7h-4_-a=_e#1?xdH-eI#l^Nb)>!P2%b zg>e-dgY^59wr^SA?YVAPW%pA1 z$wkAIbr)Us{_i3`d?SNxvt_tE7?V({UJ)-D-K}9 z&a1DF$^D?GiQos5bl!ByxN(SHAF`S+H^p9&!Wdv{L7&*u50SL?R~Ge(xu(xonv*k@ z@F#GFk3NTcMWGk0fOtldO&e7l^WSzB9+fPP6B_mb!$f((-UuLZa?fLL(8m+*?=;(cphmI?)tA{#!yzwMc35#yVz; z$6Y4fBhdH+Q60SyVM#d_pxG=Kr@bGaHgPE73 z>xdr-%g6+!!(t9idZeYbUnMMKcj?6WV&4%DiQW{?Xf#X7;*@ddS z^vvcd9gwnRxZD@1D`JNT2toLsqLOEIs5#% zILo`te6Sr=rp>R>eG_et9=14P%_B80xS+z1LC#uwUS!#arpG<;XB~PQ(hk+@E8{Y? z&5-sE$&RF2?{*{UyYrW=wbr**_=9*Z?a?O*uT+`msVD7~vMZxy<`tZJVmF-`HJ5F% z@ANU5dOFBEBS*=(e%b>e8>Ee4ix+lmEh`OQtg(fL9!hVud+8?x4 zNN;hYk-@)eYE)?FfY)@YxI?rqWdTfn`84E&xG8isilfi0i`FSjv!aorBRXYPG4YIO zmAT(OJZjANq(yCg=KapYVLyWcsEDAWsYK$kag|G78S0kvDW_8WZk*|=iTus=Mtz_! zUV#V0Yc~Nv;a0U%@`*tV@5+qP{R zJGO1xw(Vraw!LGUo%j7NdUT(2di2GA)f!cG@vJd^HRoKjo|@Hl#Acjnv}`O}sAHTe z

YIWMkM}yhW;QxOcv7gJs?L_HMW(9quu^bs2i$zQan$~v$oOcDO0plUNpe5?`=jgrK4QihDy?VVE2$zPfDe{Lb z?^5IQsl}{x*(+)@_t6VaeWD3C>v+fMjzz;Gv8mOgd=nai{AXuR!l^+-HsqF~ga{J! zdRfQD2v-En+oaw5nve+7a98J_DZ>pN#CCHOC&cz&OHj~j!`&^9jpTSp#v8hihHIKZ zhMTJ_@a<$t9%9LE!{$>rnF&pQjuYFj6o@K^S}r_$jiK*^(5D(eqhTaCGcyahCoTX?JgT_x85lPS?6`OKW>)efKccPeR<43qmx* z#E8#?oX?tpSG+Tjo^-o;3hjhrS1)?iGC9jZD%Hpt>j|Sq#q@9}VCsLe$}duB3be9K z2++C1e7St^yNJ8!bH+a25alc{3ae6>kycdV7(9^Ox@4X}s%8>53REIP+3jd%(S<-) ziachSY|M0Pxj`j-X?xR@yrDD?u|h7^z~2Q&)J}K`mYa@ur35tOGovaYmiK>sUAb8F zhCiFDHqJ)tny0)@`q$}azs#Kg~QO`6=TFxQN|fLj8S@dj3pzC+r1I%gTUmE z`@_J`93J@)BEy1Fq%U7Aru;D@WC@}R81!@`bp&7JhZRSP5%&@i&Mq2sf?^JWx%My+ z6lLqD7#7~ghGrqH6?7SEK;QX0hRdCVHM|Ic>%Ru|#AFvj5?BYC8V{sHiSzW6A}&|C zi{N=Ku4b4lhO<^#8A!7-IeIZE4kB^Q#zrDJ1agL9$j}20;&{b-^f+W9DcrSM4ILL{ z%O?m_rQ1-1+}CF~5y9Q&yHuC1TL2Wx<|^DN|6b)ZXl-5vDCt+qil@NC$*J{4eT%l* zN$Q1WgeTnQPZ3lS5vDp4SnL$$XAOE{6dhhE`e>8pB2j%W7Bqa*rh#bI%!Clcr|E@3z}W%oiu}bd2@2$HchnfmCdhR0?MwEHIF?GD@GBc(F;AYSf8& zi2%3?qP@ zUxn%b8S0_bmEasiF@bFD@(;r$cG@k{*W9$ZwQt5U1dHh7Nwp6ZCUEf6bn5va5nZH_ zJq>}0$XX^$k+-(^xek{?J{>gdy$C+-&Bcv~>hTqUwb7TCoRE6a_y#OEwzKykHi7<` zQui+mWjMZLa2`-RJioou1Y@5wkKn{lrndLXZ{!q=4Bm z`Iyo!waqg;QbT7fB_piD&Xbxpe}sM56PQ&)PeOna#*}rc(2XHq;WEe`Ld}XsQ_0gy6D5z%v7x(MQj(COcU8E) z5@lI@TlBG>iquzEg=w8!d2CvNR4Cb6SGhp~$2h7m0hI)z!niCUU$VuXN+Y@Epd|U| zeDcaroqE>%Z*{=UGViT>@)fp6>XpmaiEYE#T4QB)c4c&B<sl!P!77dW0x!GQTeQBs#>xcXZzT zIQk3MiFN|>*3rfmQH}ha;7V2kHVIXvpdDzzBNz54{TcXFGigY#J23%@4=+P`a25_~ z7QwV{#b07~kgq}I%8nwqW_iG(9a6)f|D4-IhemL(jItjLzkWsB00~y@62W=& z#81`)qMJ=Pv#Y8`9AunZ2Rqh`beQeE;S(%->o)%h=}9QbcEbWNnc>Ypm^vaq4S*fl zN|~W7{_=0GU*Kd5>YXV!Dpqh(iv1Es<|yjiQA>O0w{%48H3W#0I9EpX4kqbs!LD`p zU&UQ1Z@qBM3{_(~a3C*MEBhPK3V&9r*V@|9?#l#(j{@`UQN!9j?uuy`oVTN<;5i9E zF>XxJmc?Q2O!7+ExttFJ&!jIWAE&f9o*PuZI^a2AP4+>;5O>(X5mP0fv#qsN3a>y> zbYy~~Ol5mDO_L+=p%90}_zLPrPFN&ivVfiy7SWq~$$jlY2SP&E{eBY+71%XH1llC} z#h!gpfru-&i`xGQd_aI1!0$tK9H8K_+m`q>_j@(GfKts~C+? z0Sryp;eBJ%z3x(uUXr}-J3rB)MJ;}*oDm5bY-Z($PtQ<#$Tlp4^e>gCQlcV}bqXM_V+wNU}MYvMA#hrcE z7yH{mw_{4(tM2Yhmnfg3{Rp}h?R5`i$!w-M<{?|KIdj+0@oNu>5ACr5WIIKHlYj)B?ZN)(-Wu-(A^6R$HkCAa74| z<4vvo?I|h~-V-*lEzz*t>r{MkBtuKFRb81yz@XC-0fCO|&f_G@GuiGFbN+8Lo80>3 zRQGJXUrGnsxty9l$yyX%_q^ef@UANfTG>a}a$WFl>oB!_+^o{Aa^h1J{kt*m)?@1u z>3(?=E!wq{>~B$|YbV;hZR%HB-H11pNICAmHhF41`}h0pFUvM3=!C9;`sKDwTTPII zB})8Sl((g-cl@^{tkq0SI8j?I@jwt2#rTI0}iPtBE@RvjC6xTCC`}Kx_+f8u+sHBD|-KNVjp%c3;mb{0V*Y*Y$TKN`mryYEB|) zMW$8b=$t=yZtt9iALya+t3=1M3FwRQQDjR*Od4>RAl#H9A%upD#DQ!xNF;p>T7b*6#uV7|6d5i+P?i3AVQYtmlPD+3*?&Wizg3?1B9w%ebfc}tBTUB?!7fM}7W=}S z=FYKIoW|Np6A!2C&`r>4}8iUfOJ? z&Sz2uzd>jSjJ1jh4p_XwO02kw$DkB9K(>8~Cnv-dnY_Y2oc4Sbqz~?^4dd#3mL;jZ z%N6VVqfTD;tyRBcn&EpCB-d%!e-4<9FW#Au(NaV4`IFQ*{;N4EtxTyTnexH5KcsL% zLri(1!M8SUQ3?ct?eedJm_G>iWlzaY!Be8aX7{-=qWYwI0W(%%6#$M{3d$$(BAKq# z0YyxpRQWkEYNTPmZAo`$nJOlIpzMJJ;aQb;`%zHi^OWGCFX~9l2+BUSctkZrT+~s^ zbPW9vgynU1CbGYHCcn!v@$_zD@FG`ETP(t|3gXDMSR_Z;yw~yT6)Vs~8d^GimtJE= zI>J_=KY5@5HsJaZo*jI5ivuItd;|UNNq+Wyv~GA|Ll}(LN!_X(Sn@GGNsT$nZB&Bh zN_+ll!Y1(|b4hC)Y=tmSs}|zhi4A7WcFb35nRSIN$00_u@P0M&+74CJIO90?4n(g; zJ1|QbbGj^#a<3>K|FznZvRdXo(>S-N>!>5mkra;OWbRc3T`ZwAX~{@S9XAmM_2}f;MD*9Pv2$1jsDz4xm%{gc-S9s*jcP76gIUG+G5j%;WG%9dK#t@6w5bwcP*04@|uTR?- z8aR97!tqg*EZbfD@pN-RJ_!{>;Ye(hny9jZ!UQkminEl0+$qz6E;2vI{!I{>)nBlt z<;IjITSt7C@K>g^_@QZh@y~=x1CkSWmmx#bAJ*jMx3>aZdpD9<#)M{PFRADB_!1Lu z8-sr#w7gEiX4o4uPmc$}z8h;>4mQxn4<}zb3>bY5o!3cs^Jaqn?7WQAo2XsM4b329 z=B~^T2|08v|DYZ8EfZ1mLqJJyC2?}YChj5N7%(=-mS<~H;d`s)>G|WjNNzA_ z2xAc#ViW4ATqbKHc|Dppc}&y`B>?Y|DfoZnGgxRPCE=0 z`h?zMErrw+oJ(gf#(p&GLzZrW{o$~jcq$(kx$HNZLzIM|3c0Fq7v*TXOt6pk-i6B)CSGxP+vHUIwgH#t9n<@Wa+b9zHCiox41*dSve>TJu-7Rc_{hH9M1q3@rHluxWYELpD<_ zQ&o;XcmD6}(Mj`OWG2^PEY_Xf;u+X-^zjbVBl$T=tKo3}1(a6L^S3TJX%T+xD5)OB%^yn)mqJ1sbbf1r4tTE{~GZIN1!K%`gr^Rsg-Kvn|K}17%d~I)TL3BVR***nQW=h zTV3!+$0GFqgxomT@MkC5%bU$MyRzQynfEVm8I~76}udnL|-p;A!#F`7ead>%hwT*J1OGH zCuo7$;FJa*r5gxF2R>cOQcG%(6Y^0Qz%9Jr8zk8b58oDjU`2XhHPx8i2-_BY&KI;R zWNrT`vbZg}!ot%SgXa8)n@((S8I%*NrKut+vrxdU2ql^uD?wcd1ahT8?a}qPtu>nG{{jf&q3moRU4~jY|KfjEtUNn3Enz>oR9 zfOe!Nd!EJ<)mh|z7q%bz#vV#y@OY<6$vz<4w4dFCCtCT6tR;9t!L z_ND@jYUgqp-oJt_As@)Ctsc?Xd;_+TNVm-*M?5la$T6^md;?hV-;f{hf2O7I<+s6L zKai`>5RcpwCVA|i3Q_#50F(c$00fuW(AgmPz0YsYhrO--TTe?HpCmxm36H*p%WtbV znyTl#|Ng2j$b{VcE8y|l@iAWhv!??et`9^~28w~kyf=7hc+8vEfxuVHq6fpo^zmAa zTlzY6Ln;%_Gzx^SPzNl+r@y`vXP)A?IW&^HWq*b}2T4bypm-wXy0~qN*on)!dq3My+-j?x}o=9^XhWQwva|fCoZ$cLal*c z#2vUJj$A0IdqbOWcmU*sc5F$W8)vqpanErE4M&Gf*v=E%w5HCzi#8pmhaF&sz08-I z9h*oit89=PI81y|2POlbSC-jqXo4zZub8d+T_&|g^SX>i~-OmgumZpI&kl6nTej3GF z?rbLJ6#uASUn;k*dFDxq5oLYcd*-6E5E_WyTf_vruV(YZaXYlOur2Z3r<2+zkE91- zurlV#p;xLHK_wx%6?o3(MeFRB$7=xC%58(@wdB|C7cEVKf+iwLsSNnwdE~|}z_F$U z&3zp1WnmJqRizUa`4OGn6o@%_eDWA8FvJE?F&A2OoLYqMtEWpS{3ulC(b9C;Td1a7@@p0HCGj}gB4OFcv*eF>F^C4+17 z&%gC`zzu6jAsd#Wls_F5lYS1^4I~K5ZSu_%CCXU^5yQ*eCHSZJtDQ6dwA!~<&*Hr4 zQK7(E#bIc>(Z3G3RX7gy@P@1xiGdUqQai{d`SGbfrsUkDC7|C*I!%xms_o_KC9 ze~J=JQNU~&+mM2V$$3m(3KlH)?95K;S_eiuu9%m!~PIxJA`={JAKTFf} zXKAv-KhL_a`rXU7BUQD*?u^{7dy*uod2u77MVoTI@Msa!UW(G^iLlobYZ#s1ZZVqkI(4(5_nRgvMl`poNwhgHIq` z0-H~dZ{p`A3|5MW;TO_j@G?V-BgSmbX3$o`>C-!HHl_ysK9<|@ZGv> zV4Yj+SA^6vc2(q0g{rYU;NMn^sH?F=OxPQ$u~@#@j&xQjoJIdLiT*L>?mxzS+9cY$ zt7@*#Bzob!DAjZO^Ymat%!kFOx9(wdKzEAbIVo8$sS-1*73%1Oqa!STNtl)^>%`p0 zsc>s~Iam#m%n>#JK{OM-{rlbO=Y^9Vp}Ll*H-I^YvuM;iWdEEQUTvn{{-gn4Tz?U za$UO7M;M&t)<7=KH(J5JTvWf1uKY`tn=u%e*stg0zHmMdXYhyQrrTBQSdrCM>dS<` z-@!JaPu`B9basLduR`_;mKTYr{bKCQ<*wB5giKsLSFSan(O zys~kgM4-xFj;38XCxMyX_?us#Z@W#I&4uu?zGXsPGY8R+KZSsqSwnc)ZFnF0Px%Vq zZE5he9WZ4lA^$lFa^wtF3wM+bRx58Sxs4^ljxo;}}Bb%G9(zu{U*|3Jyc8*wIA9H6E`6 z_Eu~^vZF88WI~2ZQ-K6((S7CmXrZpl2MNMGo)w8uvXX00@bTXW(XphJi>d?;15Z`% zsA%D81vOxuzh&~C9G}pv+K?Z{C|08VqQ~e&xw&0@xgfa6$jL_mNi8fy~=5_ zWe;rzUfq+9$Z`kDPlAn@*tTcUW5R_s0fah)@Fi`LW@Tt`jI5!xJ^=R4Y!`!)vZ-Zl ziuNeF3bf=T6J}!6&OEn-gcqxn29*tl@=9`DOpwF*lL7%Hwx_Y=-zIqELV*X)DKeky zVh-2^?LN3a2Qejk520c1$jA=RaPuhCv(ZWv62fixu0j_=8t;c1{48zU<;(CDP=9gv%qIew)Oy|BkwcNJFlq zZLD9GKpnmA`UZ(}hj>@xyo$ISe1(^~gpf9;4_Y+bh2 z!prKl!t?d;vU~ExS1g#)U-PLod%8GvczO{ z;TO+}+@neL8m}z1bd(UXwB3JY~vo zbUw2hqDMu22`AthWc?cKwoHlQ7D&sdo#4tvOXDDu`$FW~;(_+{YxGONxxseY@sAEq zhzE1N9F3HOs1#MDKj9hA#rc*(Qqy2R9RmG1np%LIiYYMxrvK?z+gxCo5f2-nG;O;I zy-;OxEcOe+}42OlB?vpQa|&v#7pM2CCX`n&Li>n<+IIWpX~4 z#?68Nn~%8;2Hs-ZD`A16JLrs81YgWbziu*a@W_0^nC4guC;x7gY0V7NOti9ZfpVo= z0kOP^S>GYHO!txdLeYyUt5}?#9w@NQyz|Oz$&V#Wg^kE*tPbP=FM&HmKJLIN`|dvo z8AnD%q#p~sIy}7;E{am{*l^ff~M?V!awa!-Nio+88Z6w7a z-66c^Amk#e!M@iOo`^_swCDvkW-muKSSQCR_%FD-i1=zC=puNe%*)gR3r?U?W>kVZ zD6r~ia3L{S#WAjKa=Zy;U9~hUJSYpG!A`d_!~wzAh$zNtC1$N!@b#!?f$SS>`JJKq zuEv2)&EN~%UT{S5Xm4J@2V@za2a4Y3-+m$v4$6*I%1N*#081`9wq^3P3pC(VG9M2u z_J(@N`dM?|ETfXX7pA?V&|m2C^8S4N`sIV)6g**i8RJ5CLS}XM>~ef((HODLFmvgg zqXxNEiAvU%eiLlCU&5K$hnJ1hk@!$cnk}y|k5N0XV+Cf0$gyoub;EkL^GP6`F{tip z*kOCb!O6z_i#d7}TeR2DlY5FMa+m(EIb<)S5c?jS-J{vR%735tUs89xcyrqeUQL`W z7Qm1VD`@=t3|*#LyU$@hZAJHzkjzH+Bo_|A_gi#NsjCN&k()uv-LOS?@zG1L>!_^U z&YG`|MO~9(H>@X{v%IP{f=3qhOCtbrVx`sHO@$ixmw=MW1IV!OIoCK8>$`bkveR^v z#G>*@TG%xLcGim&jIuXq-4Fc{$3FRq)eN+|nSXG33)F)ZI zGz@NuHibLtuT$zSZ7Z_Hjz&fgKr^0t38Z!KsKeNdqPt4*y%GMjRpRGp51BGiXHDhPNSuL7pK6qh{?%o`?~JwNnl>zah`*kun-Knt@b zi^;Q{HN4W_t)s&l>{^tK%0;aEjChm3LKTNh;^4I%v|Rq3z1`crWnTt%+9=|vO9#K@ z6l;dY7&?lp1pn?u43j2qx6PE2S{{d9P;CM_dwl5p--%3G^SJD;d%6yDI-Lo5Bs2mj z$#!Z75q}aG**9l`e-P)r?{cEhPdUGb%%T(8Rjv2veGR~V(a|=41K#BB03&ke1Zrc9 zIr9f4gKqZlKF_VzeU*`zu)oAZ?s3IO98Fc_!7C694XOWO@sqm(ItWb;VGlTZvImc) z*>IjX=zh&f7xQo$qcL`MPPRWZYeKxDfsec7J;jcbQYCIf?i5(9+F0C{%I(xs^B$T= zAeN-Js+M!gpo*$)EtE!h`t@Qa5sNf`E7(f}@iIq1HeIyPygyL#RhP)vYnm?|X8o3W zgHG#|%jG5S?Z?*Y;qy}KMo=bfgAL@>$yIaZ$>^QAYb{$XNkQ0p&*hz}4R29QdGu>8 z=!yy&;e~lofY4c4nYH~x#k!yZJ*p`y)`Tqo^#><>ObSwg`}ZW1la0dE)T3Tbc8vn* zIbY0nEp9IV_KNfHePYZ3GSZEhh(57#F#sxVU7Cd|z1?GTJ6da7O^KcO9Cx2+b z3Mu9;3f32NnyJL-`q~(Cid(+qb{}V*fN+sr6dHv2fKM zA>M%f@Qca8Hw#S)x*u`hNtdrlzODqC4P~_$MM(7)kqDIO+c;sy+u2!L1N$SV{dUMM zxW5{y>j)7oP=$&r8q_(5^jErs+CKz^DL!-#tpC=1>&V*f7v*I zBlE1=0f}3}rE}Vlv3WW)Ldw?h5mVNQA;w(H%05$j<*l?jrIL*!o_D6V7#uvMnsYYq z2?sF{3fvso=bp}U0({jCb*e3_ebVUZ_EDwfHpIkSbODB%>XLrzz+I3s)ZJDDknLex z8Kd2z6is@(F0(%$qr7y2C}0Y^8?s4&V<+ZhZp&N#DWd-AmZZ2$Bor;1{Z}If!YTrG z_ueASuqxUCrhfb$RSmmpef+t;yX&GR>*s;iOnEsnWKn7C8q=JY6aJ)%4!*$I-fj=w zmN7<_&x)^^Qz-(6C>_!UvdJbsSFqQ39aM>u9v^HPj| zx|zGv3RdV|V_H@CG-PHH*~ku7wrYEhxN;Z3c{Nr}h1$71;@?iyoM-B^s_1z&S!q9v zh;_CkoBEb#7B;1I3fCPQr0Rk9C`zH(?AP16$3CrQnt8~v@*P&!NWMF_TpbAAXKoBD zfsLSpFGufqo|c(BVt1Pa);89^+nuy$3-|hOu-ZPua;>Bp1h!aDE@3x3i)Pu@i9)dv z3LFe2wm+VK{qn$}%+m9b%x*rC9X2v+ls*$jl8()^;*oW6Pl}3-_r@pI(%ndbeZ{J^ z($QPuJ+xZya@5tY=zCc#<>qb9ec~QX%&D-IdTQq0V$6M9%{^1*nR9M-v>VE zz4x`-es|+B#cphc;4#GRxVDClPyO9__jlZ)d*=~;x~@9_J*=oMep4xZWiflCp8oJt z>0NjBs4jn0TyzUk!+Yd*NA^nAIAz_*i`mA;?lB!&iGuAleK;Nyd$gQ;(^Q}j zA;00gjqjFR+(M~~xir?r->)1btL^7&vjq>ZhEe= z!`{i#vrT>4qLGUJ?=dHkwy-rs#~OqDeRxkLXAH;TkBDX0fL7j$s|V=N+RF_SMV9W8 zyHxR-56{1M%bIbibEt)YRs1#c)!NG#2hx@Wj0g;TpdffFEMAx>s1nI+`xHHrB8F)p zW>CZuSrYQ<$$1M(*n!ItPF&3FtVf+*sHK>W(u@7ZCp_6LlVnwWZ++|>aC;l?)AHrs ztNRdX6I~kel6Ru( zZ020!AeXJDiUH(zHY=+UhHEl}0RJox$~f6KDr|_8|LN zYzh|)#3xb5Z(rdt3I#G{N>F0CbW@9Ab?WL`q2$aXMIm~<~J2*r7n zElo2Rowp-3-G7~R*jrm3%WswC^QrW#dGoEet}|E$;nl4#eJbcYdLF$l{A%U47;Csg z)+)2%`jICfBRNPZ4Oun=vTZ+C9UM!qWK1U8-Q0ioyxcv^P$$|d9{V%{|I;7{@z;q; zHeH+l-Mr+@{aQQjv0A-U@mtp>i(%r>?|gUZPr1fc#orV2l===ypW+t=43*{7dt z2Z9SKi_*$Fv@YzQ2J;$}h+>P0H0@C|+GI=}^G+AY+hA-8e>-ZdK7F172HUh`QYVe8 z&+rw6RhNgI)~FjDdnT22k`cD;oo7wpU$xnmtHh74IQuiGmllziTr}oQr*aI=^TJX@ z`c9YBhRaemXv6}cP@iTNHjpYS z!pcXQZ-_BS=^~~cE#gW5$V*HkVi`B^Q1!`6Gz*eypt&)MD!O~i9qLcuQG_pOOdcZ< zj@1`6x+R#9{qtbJ(c#2NeajxCTjBv_!SA!0;U*tKS~AO;Hp_G?2{+65?+0Oy#ZM`q z91FCHVP+Zbg(2ptTg&B&;^Ri?LClh;iw6C;&McJ}PtkIW`EpDi4lMxvSLJP$LwO4& zvsP%LZN6bL=f{=U)Moqv207v}v8d~Y4sDQt221pmg#0q&kZfuDMt1k^7gJ2{{^xYb zwQEbPoxlG&B%m}Df4kf2n;NF~>1r%I&2PBlnv(O#<3Q;%{EGr0oHcw}v!e&@+C9e? zDH-S!6*(T#fYvT!)&AA%Y@ZZ~Dz0IHVaWqO>@fjb`a5WQOLaGUcu-fkGzJHsM;N_f#CwdFi`PR2PBsQg7{U!`-09L28UHB|68pZ&0ekHXP+_$i zyq)ao@3MH^??fkJ;hjL`)C+si*?%`)F)A%`o%n?wjjmG8w$%wU&{JUD(qH%6k?P3i zi0+>LZ>qwOR!-F>1h7RG*O^NwHw8F>GG$?1=)`RKLZ>V_OlL>lVo<28@mfp)m`C1> zh>7K5EEx2ucSTO8R7tP##?8hH=ULhNw5_K%`V%h3LZ$8p53x||bx~2$b1v*E<-KQd zLa$}71T)9PYm=}8@mtn`oQ-$L21vocc(eqW(ol@$Sk7?;8E18&grH3W_msL!rKU{b zp{m67pVVMg4FJinC2t!KQI4pZ+RE22;*${}cH)YQomookDK~J1C3D{6J}}(LO+Aon z&r_hesR+|;1{3Bf7+N|W1D#e~=}c~p+~0o>W-Q`*LRe)^Gu_;7IZrmVah^K~d{4yo zVzkP$j4J4W0zl+HS|{2(>ER;jzH%4fuXC$D{{15-Rvk;ELTgb3IA$vbhO#KfLxFk6 zr9BO3_pDsQ#q6x#hhydYb_owJMt;a{NjT*yIz8{RWT}&&7rqGg{Q65>eKT?G9N3Hu zh!Fnl-x`hQ6~AzXIFYpR00dN-vmr^*ECFLQiSlMtVIRe%a9a27jj!#%V8@I74c~0K zPsVI9jExYJ_DQ8u9qN!XF-++Xe4*uz2)X!m^)(2bjTz`gLDo1qR!XWq;^VX#9|9(% zcYC7xw2n>Vi0F_AyM{kU(N#RCLYSK7ws#d%_kIZd2^5DnmPpUXLvd1c1-D#fRH;!; z)vqdDl884?HvI`Mn#c1%IS-tgvQt)vtQ;r3C;vk9NfwOTw`?B2#bGi0-q(6Imq)k}LqVOMAasj1XEo8cR^@4E+D&Z7D z-MVYg1yy+*5y;&XQ>r3#wKP8h6d=!Rt>`S<^_HAu>4g|fst&bM z>OvYk=Wu5nj30==M+hX=(5C3or6HL#?fs>woot{@8D5ilWQfhcs5dh#{Ziv^UTRg? zZ^Vu90A&@F|9Xez$8JOYyS-kH+4`L zmnE<}8u@JH6TRJd@nqL_vAzjG>)E}pQ!L$k_*iL=oGs8JpChnW7rt6V`18wjkl@Aw zX&K93{m2=YS0KI7QVUH3re|x z*Ug~!>-2g%sh{YLm3e$M&L1EgjJ0g60Ej+o44@j?0@)gwvP89_;sa##CE}$~3zzek zr8z*XoIJLxL|JqpYs`9^Ts+n~JJnc=rJDx^Y5RcB6!r9MDV%1@4pV~YDb(sA|jOCc@(}d{8ONCh#D*Kpq9JTRZ5n?NY zonQS+6n_j+!>rd9Of#j`h^*5Zy~_p4aYESkx0-ni85#QR_D(>arXq=r>@ngOrqmsn zp5^LJa z)F*GNSc?Rrjn18cldcPIv?6Y3yyY4~@HYCERIx*gfI!`VK2sA<5 zMlQSkL&jBykPA7o)dp^7u{QM;3zyfHgQrGO-}%ZVVHM9R^Kf?ErI zo?|t!aQFwb*l|x@(9A9ucZh{v%{B@|MaACS6pg-gGV@DRC`|q0(3ZI;81bd{YeEr* z+CqJoIBB6bEtkC}Y>x&iDxT&^)>CfL)!uo%P>U@n^8S()RmgCLP#h>X^?>K-BwU+cM1>wXgIXvy(oH3WX#@FL=YuBYV=g zgGJgWM$04-%Hp4dU<^zrAm+kPhtgctn3YBllDTDgVdSS?;~jnYfGr6DolDMwmO|(8{S~`xJiWI}1pm^VN8(khTvYN{Y0t5o|FB z%__~NHUu8+`wlOWhI2V-MDx!FVmC0))Z3V=$}G+-+kkzyaj)N(_S;4=$kT~8nPfT6 z|E(=qa)XT2F31Li*)g050s~Gm_0gYxLBVvIbNVNHo4oMmi9n*@yl14pxV$Y)xVe5s zcV~jow^Tz#xeUiX4yS6RHE`||n5NaSHbN%VBj13&A)ulrB|JeB-6Ht_vCr{XTRf?(ztSiYH1F4FL$zQ^gzQl5uJ z3)ZfOg@#=mPr5U9IIuJQ=Nd>)>ai2VUZR9l6mSy#XE#^-S&-fWXGvx4N@PtxN9y(-(a!}%DjB4bVcLQP<3Y1;OTTMF zZfPs!pMHr3h%-v=^Fsa7#y;789H4uh&cC7yB#~5=>Mq$&w1|}WGjBi=KY(hm{8+p9 zX=%V4*|9fIAS)_HnUURM=q^A>l8v&$S+5FH@Vt;$xyf-{7y0ho%cZ5~JN@;oSL_2f zhzCU4%jOQE>`=0Vz|^Ctc5Fg_;w$su5&OVtu58a)Hb?Q>1IePUiSswQnxmA!YaX3X zhXn(}aIc!UY&yUXCry&~))Ns(B`M`By`@YPGWn>gK$VvGsb0zDQzXANYK(m(hJ50y z+i+0pOcYA_ur_IYeOP4wH%KI=l(VQ&(&K8G31z=wLihX6UXdvnWVW>8!IatE2LqmY+suIXrF)lRym zPV;R<(0ZGdkyBxGVS;sKNNK1-0wUK^JEro;!jE&35;XCuqB)>C2+KZ;`;SNJBFg8z zTE{p$K!tjASP@l_doqW5JQUQ#;92XYF)URjt4z6!8!q`DhZL5bVQPa#b_;7*O5}2; zzFH3dJ9xZIj9)o5*(boS%mSE$%(e})oTp(} zhNIIsr1&c=L+WSJ%t7UUZBdwC*3`3)`^2oeE2siVBZTVuRGnTDGfI`t`YpkAL3PNj5@~R{k7?c|??zhIyRTw;QiR z7vzYJ3tdH|3fNA=F8Fg5jjdD%rS?(PJoq8&xQib%y4W zN0l4e{oOOFAUG?pj>KRa`CGOd&!3J?KqVFa0P190Gm$FTCR;~pNb_v`BS@9Ee z)kIIl{wLsa#C&u{>5c9U9W((zpoR@4bHWmTlnV(40>Oer3+yhC4CJbkHSvy&GqpVW z-;~0wLH#F!QYQVwtBswBeE_;AN3MUA2fW)i`k#0V$aE0M-Ujinqm5v87ZKq{IZOUe zpyVbZXtUW|-##~@Akm^SxG+dD_RIHd6Nc)*LeONBG@prAHN_#>A&Bppv>_kwt~n28=-^0Yn8WAw&fs zAp{l45I-#m{XPQdQXs<+{}S2%Xo~!&`$sH4!z@2-@S%9JhvEOuQ&JA`PmvDsH~+g` z>bcyKuo8w*zFTFKr;TGg{*4IAG7*7M7HyPg%M#pJ{t*ziR_({ZHjk^Emk8p zRG1FM^owoZ9EOvK?xkS(j)0f47CJ+H%$59sJ|-U-1AR;wnm}NT&&JjL9(9k%moi&g zgeJ&YydTR3|6|$sp87z}$4$JH0U?g7;a``8G!;UETtJsV(YXHsvOtyW59fb?ob#_M z`vGzt$J|Mow29+CKxTp(D3I%K{-1!PsrWwv8Tr2fQsn;!kOm6>FCayJfQ(LjfiO@& zMEgsluB^eA=*Y;DdqsaSSL?{aO;bmOEA}Q6)K(#Tw-4r^vH;>Jy}8R~EeX0`VTrt7 zk%6>dQBqE4!yL2{&{nbjGcV*vaR_S7ab00T+A8n^2x=;s|09;%pYALKwWXiorJoix zfmr1%-V8PXt8NWkq;XJ|N}zE_o}B-I6J&?PC! zmQ)vXPO{o}i_K4vu z|FDXq8o*w~QkK{l&R!L)9X41&OaBU9*rlJ8I&R!c+lMUbUf|d{ug1;-s*Ug4_s}B2-Q8Ualoo06LLq2?Kyi1cXz^0q zU0O6DP~2&8Ee?U=#i6*iMN03`-(B~fR&_&2N)C6nLU#)QRHAbeK^w@AfA8CUK&{Z1n2{+ z5kSk$s)Rs39HvGSHLb&mwvNox3AK(YaQ7S~ehE1815Q#2RX?1L!3HeMRmAefUJ6-4 zU*q6F2+A8d(Rz8o+>kTEvnfCbMt-;tK_n1@?^=Nngx`mtsHG!v1`%i(kD}*6`1)N- zbY}Uxmc6<)HENF;R>GPY^FxONtRMM|0D4(BQBkanr?VA+&)Q8lT}P zx^;2#rwzS%9Ly2BexIR>ni}7Soi-?6|PtOm#VPt zzA98W#api!;~hgh@zLRbW?sSEZ!b5sh9;!@SMWZFJ90lTudpXEugE4gulPssmP0Aa zfh1l27O+G@i@$;wdoOqvfZ+W#K=3R8!LtAa&jJuUi@$;wV)ZWt&jJuUi~kfnAzdu< ziq;RqnfnR>GrTSQcW1zYTZA1@Kk$1 zXIV~lMo|b71fz?HyC5cYkMnI@({0+6WBOuhw z;mmKj&Eb9rd|5}Kl!&A=!B6WYNjV!mo|Flc2q4rb5ykv(xpz&s?~-fGR0hyAow9+G zvF{2E1|v8T3unnDf{Hl(wq>f`$IsL$i~3gfx(94!NFjz4Lilm}8fLWA9i@W!c>M)k zK5=(YM>BKY&kCfFCUVgIc{m`8Vggx|!QV8*%Sv9e0n$UVfGSczCrIKQteyhwBWq%p zl4p2M5wj5f)RM#2FRd#L5zl@OT7|g<+++WrTnEr4Q|g^b;w}FcnD0 zUjv0>;8KGSa)5_;Z=*7y&Y%i-PPsttm)H@g>U8 zMv3LNcC*>i0moN>gFn5=;o?eOy<)fm8z{yAoz$X|U`?a00u;F*PP=Ek;R?5U$F5nw z5l?JWVG-&I?-wJ)hvWb*mkj5K0ZLc+^=FH8GYz}n3YN1 zo_d;T|Li3q-zuy9%*TZm0vLUmY_l%o%2G8T8XoTN74JZw2JIM}eYs(H! zi_DZbz5Sp=c&3v>c!o?QJR>ER%_mQ$a0B`7$xzDX+mrlb+d!KR7&Wju8)#+Si&dnm zDr7VsinV>P^`28^vrVVuR{F|YLn@oU4LB{F|FZw~rbI%@dSAac0J^*{5ssrqCq64sp5AuOziNt_;XP&GQ;Q?tE7;pWw zCM=J()uTp%kYuo}bP3Y4In0Er! z{sq)bEvd8yoQ68{ed9G|= zHrb9JU@{s3-SzmnJ%>PsHg0|Ah-qGTagXE{p^7 z1yldRMM~4D=gS?|nVdpsBDnoMh+DWv!H&}&vrRbZP%^~J-^{9X;^2&q4Swg!#^ru{AxW9ZJ?d$ui_VBiX? z_Tt4@;o8S~kk7nYCi7g{yK{QI^buC4cGxmA+0qFnFw`J8R|HRw!)mcwLHD{AyOqjrJ2 zIh_|Sk(97q4%la^hZFGC@N`Fx;RNiyCkyM%RU=AeK#WDG*$nGG$+gbq_bxqh2xNH0 z$TiKS{%yxZ-rU85+JL)Jcv7uoHEwNAnbf1z>-bF7AM4=fON4<@vHI%j-9o{yAJf%M zum04;3^!0(sn=MsW!dNY3s#+-rlgIlhvr`VIfEwc44lL_BI2-rDq8_lvA+w^s2qa2 zyk7mpGDZ1W*!N21BGwL%1yw~EZT+$^5LKN&e&xMxZPCUfGPAEre@KjP-~2dof=*GK zJ^ro1*5t=t@0fnap8lK1r}_Z_MvGx=AJO0sz8`Lsq1(%8VMf0ZCqjHN2Q4(YsgQV; z)=*iYXouxD559zpe>*i&EIkC}M|9ID>f=x>%{KcOt)&w8RjNF%+bZeHPopo>(W?y& zysCZ0)pZNHTo;$Fujyqqb%RQQNo#YLg4+@?meJ=1=5eZGcK4X6jl!SpuB>a&d=xlf zQ#^jbRQ@Q5`Hu_*{hQ^`YYbGcS3kZ7xRa(_)qARBp%riSQQ4M6pw>oB1h^B!uPjNc zt}Hv^I#a54M>#lTa@D~Ls?vNzSyGfM(TPlC%u;9AHC>j5$r?N;d%wL-k}JQM50ZUO zU6W*YBrq}n~=13SNjXAC66|m-NQHf)76cE zziEkfeBVmx8D-6v#25+mAAvd6rJjjFB{qpiYm~sB-S(p()la|<-Zw18VvIY`uS{hu z8mxah3tgQeJKb^x)r05~Ej_>CnB)p9hr5QJ1q7aK1bpAB8p%`s^C0RnIrnD}9o~1? z(eOr*$=6+zi}!Y2n!hZNrO_8&e|!Z#QBO|IZjBaFokq_pR(D%n+IaqApA04xZDmI( zv?5jmC88OTyb=Z%CXuE>zmC8XTsS5%5*`*gtp2hjzN|wjyV`3LFzIo6r;Oxxt8LJx zV||=rD;L}!HM5cWyD;>jf)7ktBfT$BSfn@qg({ql>Zfv>YuX7o#kP|0r}EcLvuklb zVm$9u)7PI`&fmB}W7=p^Y{4rJg)R<@eAI=bN;eltrAX7TLSdOd1MO`BFEXisw|2)be2OX<<3z_Q0hIfscX&7gAzcU61TvEPN3zjV-z z?xSx=Us_(l=((Z&=n&un3p)R}V)Q=0c%|of@znP^qWiiX-D~g6iZDG`O=&NewYR!@Vszsr60ZFrNV$c`@J&cp?wQh(O z?FpPzIIXvJt6QLfqcuOW{hF#87>b)k<@0`lW^ioaZ`d zIcm-j9w4b1S!RNLJ?38^=arb=9rO)d3b^JXP}s*0`Qo)ScXz9yA}qowk2KPcc3X|x zYe0{@w7eMB%0$pG&*I86e1ss=!%vIwdm`_`{jfzAaj}2*#@n0uHa{!DC5uVCY7T?F zqznJWT7_*}zn_&a2kkLga@>>UjrQ85_!<+aaZN*-sAb#EkRqmLPlI!;1X_b^qnJBS z7oRoH@LtUVpM!bhY=@k!Uivp*RBsg~@UBnKw7q;5Y=N1z$>BXVMjQz-Vg zet%cY3T1(8rTEk2Cpk0C&~d02N*1jEV_V%}9*mM~@r1%;l3!cCdNIv7!lJ@o%$2xF zCqyyjxqB9yk7I`&ex)=OA%fR!FFyku)`mwcs4cPdsZX7~E8@*&cCV<<9TPl9?T2<$ z4g_OlQoNjZm!ynhO2jr>L1C09RG@f4q{YgUZCRpFfVBzUp4i@;tl4wsx^He!_cGPw z#Vl%L)Be{S`>K{Jr44oK2Xw!kuXhg94%RlUXmNHR34WFi*J_>6z+kRr)RCUi`^vwLHfFb5_DZiddU32C&jx6Pf!?JdhWmRv9Aid2`*HlIub5hC8Sq{k*XK^POmvUh48JV|X_J58ir z8X34w#J6&n5~TYQ5vW53RTa#!toK}wEn4?3P1vgrf#b&&Je?RVTeKERrN_+fQ8Y73 z+McAXWtw$Tg}{C*H26fRBL}KU@Cr48ZkqHhT82)8X`@+59jY@IXHj<5raOY4lQL9R z7J{1_+O%g>vxnOJE=Sl*b^@Nz^!K)Cy!n>BW%hz&K@80hB3B)u!2r5kYxH74Mz&K$ zjy@eVjQgPpw<8W_U@vr9^vEVURYt>Ml8)l?*hmUO(4Ikz@*n}pa^B2?JxX<^(UJid z`v<&ZBRTP}d%->QbgvpzMzJ!oJJxW_c~yQiJ4EhXHu2hb61VZ`ieBpV{7OG%B^cJA zjOXB4!8J|2YaR9>$!w3+m(P)@&x)>Wjht4hr;^JSsHZAr8xui}pp2PtM8|iQOU9^Y z{rIJB)&@y%OwSG1lHNKxGk%`R{P7n1U^kpnwt4G=hK3Q95ZEfubFL7 z>zXN!?tk}LR7f`dutbo^O9HkoH)Rh|lx1mI}+(G5TabtZ`1rylD70 zbmwyTnW0D*f6L(N>S+zM2EhqIBaxU`#}J#YJ9O$1%SqmYtO_V%L^@y4_7N-YLWNqq zjT$cxhSMy0x`^q7wYD?vLaa>As2%Y>LztMw#CCMJOimO7gtERRv7gaZH;f`}H+K?6 zk+MF^Cn-WEhsifdtoy@gE8sL$zj^w>?76%L3qn2^cLIUd}9+6E4|4fhMmA) z?Ib_f*F4T(agTE_7yUa<1gh5W;CU0Meqgc4wU56VDdKl4n$|Q$olc%WjlO|{XwZPa z-@6B$$OU*&5wwZiSV>a%HH{DTuVN~%8zb3*7W~owXfIyVcUv6o)T>s#?D*rm^6dD0 ze>WMdNyFAeflI8Cd8^mnklK97Y<3p2XzD|E`Q7HaW7JEL&%v4OsA*_caV?7`zhF1RH;n_Z&*lI?fPY@b2ob;RA*gc820?s9vzct%QoH)TAFrBJxYAtIg z3onVB#~YwJ{-#0h-*ugMIc?I$_Kj9Z0NeK6^*_df@BTy=+b3rxXTY0)>^ ztk9_CsIK30VFgp156_1+_KI_|>{i(Ox0t?FsHt3W{b8l}>G)ZACy*}V_0+(hqPO`O z9J#8)-+Q&Lx3f%qjf}aP{6%BC-!#2Gb|3Znt{SVQOCz6O8KCFfX#2UP`rBvFwPfp~ zpoyHLCz6gQ^5P^97)H|Z=Hyqy>>GXA3R!NS`dsnMnBRokjS7rq=rjcS|5MO9Bz9%< z{k#=#l9Pg7eb*nT%DA10)!udwWAv4xCYhhb5a4rI*SGz1AiXi=|BleS%eauXXFQQH z=$BN?BJWkaRFpRb-N=hKXIn6*(|*VAy8ZqLgF(pIU>|Jxd2@{Z+YfDXnQNvL-^9MI zbTzaLDR;X&rq^ucOR-M$sK_jQSGMzBDa~+@L>F`B>sAj_T)r@QoPJKW7!o>u6?1xm z`bLCq%rb=W?gwU2lBpTy>~fUwMepIj7fQjHp<#aA_dEgwtm9{LgBOmejt3g}BQ<$a z$)FG?u$GcOZhbY5fQRTRx^O?{M->D^?bAC%M($}|((D9#zT#UAMOybaqWOEQ8 z6Ge)Z5MIMAV3g#izeEyz92z(wD>o9F`(QY+&0^q}EyXSQmyJUwM-W-y-Xb1k%u|> zX5MsR2h6MGEbYby5)azP#8=Cq9y%lIb|*Eccn5(ov*gE2p_Mh=UA$G^auL=n(fTflly}qG5|2w}D7=OXgSE-Y>t#_Zfsq zY`AsJUNm-;{<|-*$`nbK(WU*9hB?>~mspWK`Q9Um+Zf>OM74*(AlCj zuD|QFz(sy1&XR^tmvl>0C-AaostW738uw48vXwkwd{Q)t>DemgTCW@kiG+>3g6!pD zCQ$1SA};yxj`;mG-AV8hE<`sChde{RDK)9mSb!TQ1&>TR(B^;A@{?4nZ+<=bu|@S! z{Ps^y+d_V$8RM;9#hW>fDUJR`v2dN|3yELgbA%>|r4w&O?1_uS3(D&mI(81k1)Q`N zo@((FMAtWZjBmOB{52K@-5ueQr|^2D_Aa+<8ZYAGOVq1U$?13F%qH)UWaD`+eS48i zY3-C{^QU&xFQW~yCQ(1OKa`h0>%ryFGQ$gJ?wz;mp+gHw3dZ|j@w5A_55f-vlvtu-Tjf1<^;FWo-R&)n5mS2fy>{U$@`${=|61sO9w&%qIJ^Onh?#T1Honcgb&^zI?L zPD1A+zn7@U%}EKAM+=HfTF!B*!|pGlohu~+e=|hsqInQEBpx+MWXsbYmgVPQzka3v zLiwgSw1r&RuTPLm35#gEci@)Zy4?#+8ouZl&0i>-=y9}fRz{z zCu+Er<)jV3ym-@d=mSf*8dFID_bvP5jBjx}{*K}obUTcx`B&YD=^tmiAsiorYIJEM)c&vC(-RKz`Vbf_L*+e3&*QS1;_}1VCZgac~Q5dV7V8>*6uYpjw2l5`{V(b-4?VA+xsZ?Hn4^_n zaGll)G8yLM>_i;WJE2~&B+1TuL$M6j`?|I_jy`|{QIP`I{S_)s) zt4~og9lyN-gI?Q6wH%3Ly1cbyN^ADu6{g}b2sS6(F$|Gyi*9v#E`)u4_`KjC$}8;U zqb3Z>5v<#?a(V^_ctJ(v2& zlLRAOqepBk*b~^vi)J+9vE4yD;`9s{PAFHka*VCG`lRI_$#V^kT?rV;($rWuy}~~P z=ySi;JCmw()*m7^1p$#H`Xhuhzn8ZS{FkfM;HprC+Io>!9T?L=VROyi)SkV~MTPykEs zAE+pde_Iq33wJ9sPb-L>yp^?`vz@1%i!;Byhl}(7IY?XsnVwg6uxU;@3W{wp77Ee7 oZ~D(5AY2p_Co?-|9V;hSM_{Ob-y9v|-s=JI3QA@8FSrmd4d%kwi!Gbr+?9~ksZe%deWQf|I3TOAr1mUKDT#@e$X0LOqq%4WA-m$A|*3dmz%bf_+z6!)wMNW4t9QhAt_|MH4gcYlfA!S zdW1WKLBQC4PX-lp(z!^qk;@O+$ZTJhTrBsMjF@Zav)%5*%)JxYk+bRKEE}3a3ZxBZ zQnFmS%G6Ae0r>k6-=txGw7#ZH@Jp;{AS^kQ*W{8q-l#jHyYNr|k?RwOSryU2)fElJ zn#;m@{kHlvv1;64-Cr(d>->`@P`0G|K*5}H2-;{%)v5{K;n7Cry1!a*0qdC5*I}p$ zaBH>4mqW=~fR1cU9~VzOn;b`!jb9=Rc-aq213T#%48(14W>>fBa#n~=^eAwP#mV=y z(F8~h>Jo!c5JprB3JmdL4f}qaPe5H$nB&)2S9D&Rqmp)D3W=9MY&{ z(gqkX)I>IFx3~$uQsaojp$=%_GWzu_+6-7BL}U@c7fG60b4u3A2W^8qXD!~TY$ynn zEZLdKGVAkB@GTjNoM~jF*4fNyX6XyA7?G5*VVr#6ELhyV{fB_o_$6ybb(oRc_2B93 zG?RV&b8ForpS0S{k-Wl^kd)E0OCxX}cTll}&X9<*Wl*~+o2c z$uh(Z^oBlqC67*Z=rehqgH$y{s2QXsIE6n>aTM;%#bI@kOBsaeyM28%LIz;_Tk6R$ z=C?WE=Xe^YHLU{0uom{6@FD!CSUCkB-%{s^^?%5h#~`%ns$kY5J!rP>a9<6l(3gj7 zHjd5lThbeXkM^XI}eryEf}vdwz^ z=m1ZW3hI|1KZJ%?zohH!QRAc+%fwGm_H*9AVm}MjNU2>au85qJsG5^Zaig4>CP?Ni znj*61EUTj3kG8R^ zeOX*2V{S%>vNtqZ35RUy3E;fGt9LF(kTk#00XJJP$7K{X7d_m6>nzeGVy>pH|9%_b zZF6zd$47l&v$A;8`1|gs;~ZJ6cV|~;SNE@E_piKwLD(+Z{xZ?#_!I%TsQ{7VTv;Sv z6M9)p#k{Kzv2<@^HDC}kqXvm*IPX0Lm3j29NUI_kh!4f0oQvT!rajgCA)z?lWQ}A{ zV}Uec{X=iH5kOq9>kgC54NAsy=^1q8>F&&)0kC!kTFTNr`{2RrdTTZjMA6BtQ~6R~ zFq13z*v&^hqIq2#2B~8qdaxpxVk5%dS`h6vs(Uh;-8q^a&8HnLv8CnH;;?m&?}kHq zEx&80e;#Ub+Cs|;(sV$4fmEse$LEi&c`fv901NkL-XlRRRtjRrc1Fs8yU_y2Njyi= zilWoGOj*vsid2!7>)CaZ4Y31PEA{<}kT;GYTf)(u@iFSLK(C>tFXu)f!`pxg8YEwP z7tbNxxubII9fIJuZC}FVwinwV*K_-7hj_7~ngVSvax#JC#MwjL8sXA~-DHYgvNrgiVmxQ59#WN#?gY zFFa1)6Z%Svxgy)E`sz+~zhE)ggj^Tu+Z0Z^YfautL_~4gtkFB#ux+zL_dsBn@K zWDE1%&RpgAb@cIgcjcL>(*d9!2^0~DI?9oJIYzo?!`RbY+GM9s+K{tm zY{;umW3%lO!OSM!vd)p@hJ01K)#v)IdM(gDwYf|>>Yk|0BMf@p3iO>R#+@YFCI)K! zx_;i84G9K_2nA7$#5g7S6bj4!;Zql_PWgU4nXT}t6nYY*FO*u`yy&NRX zO76@0%70#t2jevEWk4BqvNQotnGwxyu1q69!c5y)mbpn2DqN;CyD8*A_S`lcKJqaF z4Qw1Rlz1p1G>n|fKyLTmR0MxK1#C`_oE(^vI(GqwJ;CoQ1wW+@wtn0tiEtgtw0!eX z#)>(oC#=v3YeOzvC$tdX!bk21gUs{p1prjw6p&6sMN%h!wj2WED`VV6^{9bs`DfWv z!7;CU+Bt+f@piX5*3CXnT%l?&GNmVaz;?HIoaiKsu*9wGhajcwsi(pcUEJvY%r0S5 zr?YZxNoDxChhgVyg<4Or(?vX9>gnQwNxq4Rz2+Q};5SOi?Y4=nWO^FieBe40{xox( z1-Q+;&Ys^5=33Rqi<svz)D8j1c&Trq<`DYu*2 z;|66LnRn!xB*gwroI5i^Yzgy- zG*u@itUGOKy)vl5JE;K)%6{(KLrl^s^VQ2LQ2tF_Wb2q%(u9>K`0d`(uEE9PW(SLo zH(45OvCf>90P>h*b49v)iRr=1cK1qBD1cAQAskW~>eq6HIi3;Lzo86foe2ryfhbMk zXeSBx5uaBJEx=z1A~Gh3gw7M;eFAspaoLkSLrkCBKzJUUCbl%Qx&)Gmr{IgK$V1U8 z!fE&uunqy==DX)8T=#{mriWSM`&H03k$*(IyixabIK8~eNvEoSQXVYV!jnc+EVjk-{kqdgUN|bhzOx8y$$wh@v2o{kc>J+-l6v z$-}E?{zHf5Gvd2LRHHLC+)UQ7AyZB&hiRXkd6VjG(Ad>2)>uVoJ5KOAPuDljLdSgT zQR{Xc>hU=O(>U|Yl)D>;>C4Zdg?w;Rh3EhdE&OVpsqgh}_`9+1a(ZHkI7^iF5!&~3 z%pIrUfZy8V`ucOR-8AU9tIVL#w2jO4pw#f;T<7Iwx3NwGY25_>4zG zrBw!cd1+P9(q2~VHQN@NI-Th@Ub*=kw6UA!97Fa8d-HpU`j~;S1LCKAb>g$_BATCq za>xF4Ao5z;@jS-;@Ta{~SodzOjbHcoGJQtzzHl?`&-PO(Cv7LHU)!E>1pL=0zrz2g z{taALD_rsb0F;X$0TBPGe;We}TV)d)d+UE5;J>>6s@p?vQ!0hw>-X_<+HFplUSI?4 zmhF7znoPhpEi+`K=(a2Sj-i1x2+QbQ$`K-a-23G=tGl`z5<~vuydb zqFJ?Bb+`HIe64%X)$C>3*&6I+rq|o;p)(pPUH?oD=F#&!mEBce z)6}2(Ee5|&{Dh{>k=OcT2h+3WHU_BB@~!cF={c}>`)<}=&>4Yg8kVkqRM*Fi2U?$r zSRa~6ti}vSUhGEy%9j~#fvm-5Jq59CWa-Ig@X5A9&>r@5AAH2G z*CQ|-puS|#7=xmm}@%5!Bd#P+w_2%~o+l=&Wbv&mkWxUC`jx5uU1%Fhz+no94) z54%-u=5E5?d$57`lv;-KVGDcVYr6;0m7p||pZ|>hDbE1;oG>!m?twrWf7J{?I?dkd zajAzS?f?rV1~wNMz88D94Crnh0u@5CjlW0z%^hYBxYtINsBC@XXxGlxF8B17x8*o0 zyF9;oF2(Qo5ffRRLNMIzrnsJ;anvn<`DvfdW|oa8=@OWa6WJ?j^>VY{I-@-~;8J(B zlH036W;8N!O0sB$iloulQBJ1n|m(61b>+90`A5?D|%(VHH>){@@C-KTJ^zG%?^BddcykPi>;B; z(HauEH?BroyR%62VZ_*Ih+SUQ2@B8WqKJ6xhod>*ryn-+&_0n+v|mZhTDiq=1S!kC zh7~&$+6){mZPoRPM5L{<$;#b1GkJQmpX_}&k9@6^d~8I)m0X9jY98NSTtr!$S9k-T-#m5TK%RV^>z%8pg68H-sQt$;uFdt*4XFyF1y@ z=AwS>=3JDrNqtWIEo{*K?54(09j7I$E0t>7ZY3KRz`NI~8Hl{y4d&^ax_MSD&b=K9 zkQ-RmHg;9Go9KbP9d#vpyClHZk&hs+LX0-@R$7Y%8i<=BoyJvjm=3S%i?OR~6|HKq zYRe4OQq9Io(?X5Q7|rKy9D6%7pw|+ttxRh0S5pIfyBf+i_DO#)r||i%UUzQ@LIP^RU?JQ zshn)!n`@!H9n~N&uj9QPI+&YlR?t^hOnbXp{ zo4_*7OP9)^?s$#ns}dc%bY3Sr`q=by6rk4_tS#<;P;v(Lw^fvFZWI1qX8)j+{s-zD z?H^Rl_PI-DbAS#m%PWn)N2dmBrWdTj?9#Pn_3D-8wHRER8+3q|8tlz>a*$UmLz~+w z%2uaIUw7xv-VQC;&A5$p#uHQ^x5et&x~tO~hVr$b6+l6SiQ2U7cFjh$T;Zx^jCErs z_)YgeB&8rPyMIX3FgM-*kaRKaZ>#y+UL*d4#0=i_LVU_(p(jL)wJ}FR)+B1Mi9Qfk*DEN^lQ~wEL z;YQkpMZ@fYz!ape%v8Vj17L{wZ}T7QxPwC4!5w|rQ?W;kw$gd+_Is2ZY4%(W0uJBZ zmjUi+mefUld5PGwGbG|8VNq*tp<9frh1tevvvv2@%gjBY#a3DPt}3QF23O;X<2oHF zdx|e15xkH6ApL2U$LT_7r2^=0&1mxR8_3FT-gUUid$UZLS^Xni-vGWcRNmDAwDsqSGN1D39`7U zI|c~;84>sOiNmDmW_757=u>f)78uA1$(A^=77z$BS5Az~M5|mK{wCZFt<1eg!#O_@ zb4j6N#E!IgOm|GXJdw#I4h?lotE>QvXl)s*B=v?aC$a+8qrWTaSOu(5gqlXMh}DWH z^H^4q=1h&gNI*_I&8;QyTWVk*L)aAau#|64pKi}h{6GKBOILKPkgF~u>GS=0EWGxYfhE_I=iYNVXAY({rZ#y`< z896?49A6&%@KQ!L&<6UBPX%k_FOz*;u5>5Or<;l1Su#~tll3*-ELB$M1063|hB}=T zE6uBDm&P$DlKM0OF63%4ejx_(oO75h)WJ3fWulDHuj73Ua&##!6Su;AVq~E%M;I#_ zSfMUZ2I^+8j8#e~gIrdT228urBm`&!b*%v4Q13EdeBgxziVuw8Ez^B@wsc@Fk+o_& z?8r_Xj#KA!uudHz45gi+X^XTGoZHRAIO*6DNB~X@r*9d5$n&}IcGm>7$b z!)dzn$rE0t2h#E}^xeh#(zOUZPb&y|o}%}~tu1dvkHnIJdT>47Tt2BG3qv1)4Ga9>snex>yzRcM|8vjnJ~D} zV&!{gWYN}}~_Q@Qh2gajI1Z(Z&X)N)QgG%mvz#NCg$HgkjY|xlc?aRy1_38_p z*pSM-sZ!3A73V4qX}75&K2@sfjYJV=BbLP8lg6WG>Sg_YY#vxl&TUFIMsO^U)BV;? zf{R2APN>#q%{oq&;DGj zwF)Vv5J_c}lZ9{qfeEV-O0JEVQ4$4v3?1OodO?W{|8j)O1$+P8(JkVDOz$^)q(`a$ z1q_Uny5iZu+=8Q_u^)m_X_!)r@Rt7S6?>bkM%ES$f9zS1W;HA?9(x-*zPpT&_kq^{ z9SmQ)hpZz9t{fYd0)X=LuGjYCKhO&$mh4H~!}txy4FNh`2(LVVo*YIgKg^qR(^ZB9 zZ*wIJ#`{pyXKy5d{X?NwyW(l@l2Gz+WKE@Ty%`{n)C4*c9aj}I+ z#MK|M>QKEGG|>7gxcZ8v(CcVTgG8=E_9Z1n-jSge&KXPoqM)G+B!v^5ak5cJ(Qt6RDZg1~K-`3&wj>3%4Zw;f0P&&2&&W;p3R!KjChX zO#XV9#Fmbzjpib%!=?gNMYxFvK=}jR&@*fywwF!0N8ldLIgJ=ic4yC3&m-#3&!ZTp z*Om7PLsZAvO+!iyGvwI8)J{QmIfX)(2_blkZ%O5vDhC%ohAgN&K~@hFGu^R$r#8Ju z9%+!up{IF>3cs9UZ-S9{UIO$ZZX66(iVxV0hjcf}-eZ5*HEWvqNfEZSBY>0&s28!{ zW{p2H#-+vWh+v?m0q1(NgtBFUaH752E@5m$$Fr8LSkX3aSh_HZN*gI$1K4%1R%JGK z&;NbG-8f_%UyXI0E=vOkkl&xXZ?D}=Byh%;tu}hUugVu~)WhsfuC6SW0Pvoar~Q5u7J80`B%K zRkFKnu9$w&?cTsz&#qWM*IX7fn{C>(abmb|PHhSx4$K|dgNxg*WNsq8Ol1R<`+@OK zV*vn`3E;-e$kudHXqK&14Z&`x@Zw$jvt7~J85FvH%`$y#7jC}W&`QEGuI@Xy1I%*f zT-kh67lKLmQgKqpTNa}!`zBw_XT2IGt@(p(7L^rdyj*XW5Xl>hh!MCUU~rKwDlw&t z7V>`FdJnlP7PTO_Kx7cm4`W@trM>v7vjvB!eyvtb_ z_a~^g{cVH~=mdL)bpd!5{x1kr~l z*n#L%VFYW9lY~C$JmVdpI@qXDV2uz5(>vBL)@Cil0SDlb7Y`eFlc996UU*%QqcKi} zIP-~em)t&%8%&Ds4)adj8EFxNSkmyao$*${y|3!dy^O#x-ov2#hDP5J(p9J)810Z) z8bS%dc0R}3g~v^($nS6otQcFCRvz4SO{m7k3u+Q;06Su$2^Z9>I1V#GZBbSm)@Y~$ zwA@%{;xB8%7zz59#Gl_dPn`oj!nXAk;WBBDegpxMXP(hmF~Vqn<-G=+Tfk#qNSywF z&KzJZFnj+&Hjs265_lrM(5~)TfO(=tLmj|P07dMZ_`w6%HzrKAKKWb!r}KVt0-|6f z;BB{{eTL{3(Q6GRgvNt!lM|&tX1;99;u+_D%$y9pm z&qKx^@K-KI?>K?5vqT8kAT4aZ{-RfR_@9_8(c9s9mv(x??)hyixXV5xw@%mQWe}g$ zot-jZZ#;(W>5OJ}oOP$JzjfqWNEV`)QE}~io2a`JVl!IrCWlW)xdvezzJ1A@NnDP} z=i&wJgxI7XYm_ zUdTH}3GwZleM}Lp<5ii0cn!HYT&@5i?bcfbu<5TPa z>m)l5ASmlvhZz&Jt(6OdrQ8N&hk`{bna^CV6q{M=JOQSNAC3pcD{ItB$B7j0iR zoB)_BN{tnwa_Ip*?@^KgWX|B;wdUX#iGT4jIHLI;eYwYsJ+xoTjSFE+cX`8xq~ zpwms)~V@8p6BtbQ-j}XLfQlu3@nITv))OFZ3b& zHNn5v=4^vH%1x$at>8yWZq4R2AHIWxtYCmbL`wza-(vc3KJnDI{Q3)E95qI$>otZ6 zK11Nc@?dt5z}=rC5NiLf>IXLyz3i^o^TKPV1}*v!jf@E-`8Hbac@K5<`QiF{_xgPa zjxZ$h_scMM(LGq^;^E@`TUnIiKrR4T99gyj{ci%PG(w z*c&JKF}E;Tj1p>3eL|`~L4R&Q?BL9g?M*@s@xQ?;f|%!~i-so~4j?||wJ9u4AV?V_ z5W10!6sX?-(|E%Ru9NS1yOvXr4)Og;@`A1f@{?^r@gLYaJ4dkXQv`4a)1fme%gDbV zyKVbCLf)aQDLp80-p#xMUx70^%nR_tO$UGvWumHY$JyUT*?7!GOfMc&L4)_p#ZqAY`(!-I2({)=GdzvF3b~!)WvM@l#Bxp zV+VM%Jm*H~0C*3fGdz0%UYGUj27Nd5XJAWq90nac^`3IsSs0bIVeRWlY z>2QjgAOGY-BD3FM%C^rKK+2ctBL8}jz&K?voPO=2KMD+=2+6nmu~U`gGsRPTWZoE=RiR;%~%hh9QiQ#g=sAyO|yk1ruu$OoD_< z)H=0+2oC`GQ`TqEBKMfJ2r!}sDbpsvAbD+jTv zWaO#_z(l3fyXCK+;Gau0nuzN2J?vj=WuJ6*b^#>rV-r#MF zm3x`wjycoXXfL31K#s+vDHT}M5I{tT}*B)__kNixa^>pYCiR9-G3|Np{gIX zwaSd7Cz?fjlQnDWJ-flqqLKb=pSYPxfx{ek-hqN<45ZIVU=YXZv}}=|MHu>NKZVtR z-_kC|8|0(UmBH;Jr#~sgn-3eZ;rxt3!g6&~Qm{yT)t~y2YK6-P@L37)zYkgRm#Kr^ zJE08&<{l_f`aS|`7w&0PVK8tle&gNuNhsrg)LC(0x@Q&rq2^mLD9$}&4OfRhsSC}C za-Xg=;k@yeN^X!0<>K$FqfZE%k#s(aN+F@X_&%;FSeYm3Z21m!XL0Q6aYr-~D=vnpkt{n_XBrn+mIb$qH+nW)~ z-5o9^n4yl~9C5F#m7EkUHISo?2-iM%>3E|VA{1j3FC(1DC163F5XUN$Kgx1Mz>Jfo zyzv>JZ>vpUA{Z7-?sNH2_x+RORofD*qz1oRLkn)d#Jr>yZQ5MCzXsH&A(RDV<({=S zkh|nAW1vNa6;fc8@JHNJ)7JnfBe**WYO;)b8@E6MEJxH@25K5b-Bs8)01H(J0XtlV zVxnj?}X7l_7@=kRinU(STAk1%`+8k0;cTmd6++5s8*Qqm5iqq@cXO zoWrl-DC(xeeK6D9+$k}02TKA~c1Wn=(DB%oY#-fdNoK`U5G6nIT`Z)I?AST|rbb8@ zTUK1;K3KT|Y$B4wia>b+p+COw*=`U(48lF?oD8Wte_7Qee_-JocjDo2?7{b5;v(>B zpuE5YytaT1Esd3d2K1z+`pQ59T1sO)n1r5?zdV7yEpiNMLloM)BV@GIVm|@_y#*EEthSQ55(j7CRNs!U|MAQ^C zJeM>^Pe1g8@-1C@Px`Urge&99Qv-kE`v9j(;WNI8B7&~>OL(Ga_s-?$G<{9`lS+R{Gn7H`Ir=q+{5?pKAmWLLw0%E> zf}TEBq(_^5Y(<*{bop&Lu2fNu&rss*@gct|G^>!d&LlU=m}`>7*0_d(NeZuIGcpQ+ zY>noJJn)ozA8)=eyQFo$F-V*g`-GlQdQ&zmeu2 zy-1xRV}ZueBmzF({koC)uKsKoW@0!n<(*$<^SaFrgbupc+9ib+xu|N2uj?95F zA)%hg&4xC9rR;%XQO3muyId$sM`_fLWr=3(0biX|v1MmiY4U-pk8RB`5EP*LOr0&L zZHAyH?@O3$sQnUUGdrzwRDzc(SDFpoo2tpt=e;mq z>YX2TVj>D|EyY4~?%fFd_4b1+=3=@OHtUvSY~l6VzhHVe02K)nc?LlegpL@q(uWeX z3n^ybQ9&W^ZMTCX;*kE9LUSh`vzbg6_2>HK;*+Gpc9(yTO3Jpd z%z{@S0R~whi~9Ljt?2LWaFF>nE9nAhM~YPViEKr3Nd(v8GZd2!`m{rJqxvPy3Rh$^ zkzeVI;lC<%T)whVot_Y}=D+3t9L^ZZE@McK8%~F|?_QjdE?7w}x9%1Fg_FLlVVw7< zz*ow#q`k8YP=oH$+*>xubY3UZX^~8|5js&%wORO2T|#PH@Z(@7L?(OC#Y4y}b*HVX zkTV!r5e&VE13lnA%oH}RN~FA((oR3rqnlosI;2BQos*PnxYfFdz{}0Jknkl`An(@# zJjfDigwCT7%~%D~719^-ga#~vi!nMPpsds762XRrK|+b_{$ zFkp9wx`h~8-IMNdHe#lp!;GhOb3Ify)i(xq~PUAU1 zh-o^7g(MA7wsq-QAoBLU$esgdu6- zB@l*N01VtdNauJyZ<{a_JeanLQ3mTqNAPRg1K>bnKBm1r-jG9AlOrA;OH%Lx#J2$( zqNM!sPc}5*;2KiHJk~_*iBL_0D3YKV^~MsQnh8zfYc(9YY#Uxq?Vb&5QDemL1DmJcG)0UO1)@rhioMmkOXRDgio;K?EGk{ZRH5y>UZ|_KXsc*Lx0B!!b zf`3^j$LjDn?@U*yAPQGW%U5L4#(n_O8n^0FWc)RI?CJx-!s9k^TswkR>Xfcw#R1v} zZ96wEH%yyZF*3SKOg5vtXSR&fF!-6q?2~Gr@&P!(vJ$dt2$dt|p-eXp6SHdXrL0vM z$9&Nxj4B0v+X?jGfcR4Gd|PB@7~}fPzBO zJCuVAW@=dVX{ZPtZrH56qH9ztGrIG2Y+NqT{>C;7x)|TW(l+kkws>a4Kn^$xqB?M8 zenCClX^l28e6K+v)ot~riehSz{p1#NsGh+fe`(O8p_0+&Job*PyvFq|D?V5uN0cH< zoKY-8kh*{hWaAT&^A8bO5S}Qe(do&ogyXBGM_OZs;}?x%9C2bW!IJUbrNacWJ9%1?%t{JILGEv8p+hobnic~Lfxmk#D&5g!)CXs5=DvSHljNi+- zxm%OAqMrkVFQ;=>oGmF#&Z=(6m>V@pPJEkUER)tahgTxWGnCOPNs66G3-7vEZ1jgD z#z4d%)brDQ2(LB@ODA$;a^_*+4Ujjuj8&+ORw;kQBHv9mbnnSs5rm%J(@=cX8dGyI z%(f3`MdtSG@~^ehAUu2jjFaC9719>Wf9%{D{o+?jGW?;tpo&k9c;jjK7s0^}uHNRY{%J}xcD=D<%Ehncp@I} ziPopj-C0&Q_Eaidw2D9j5GfC@OE*h%pt40eH~T-jZw}yRE9pPFFLd6_wER|#(!bJP zKaq-BkgI6ZMJ@8&T|E>;Hn4K$moc zFEW@wQ(zgW0!^XWzXDX5Hjj=1CrK5^0x;QXL5ZjC|F-#<0FzI!De3d1glU}vo<3>f zba4z9d?U7-6&TJg6v9QoW;?i)9lqnIYU|5x#A`0oCxH{>j+Ep{WrUpgOMXYqcUO0U zBv+fAZD`@N(nGqTlB;`bu?(#CdD}kNnXzYG_MN7IC3XaLQf-QP1gK(?dwPgn|DE&Q`uDq(gU%GOm`_A{@Q!!v za$VidF9EK;n>zPkX4{FKX3qb2i#t;~EdGD$m8OYSDR1qff>&)gG14s0o7NKc&8UhJ zx3}kwr6*rlqPh37RUTL~Bt+JsTA8CbGD+Cp6ZpmW{hDRzQ zFUomxPWE7U5*60MSr@`>)+tS-5J)YSJVq!IRWWPt3=RPI5k?A{PzYt3uL^(T1xvOS zZg=ABO=0_X|K`JZ|IYVIZn|w?wjaY$MFx#2U~X^Ybh-;=(WWzu1%^cDm#7CxMhXP& zV8YVJA=TE2`L6Ij$cGsI+wsO_4-$LZxHlAo=-52fXMwd z!8&cGW*;5)7_yZm(C>eVKXK$sP##;ZF5RVQt`n8Z@eQn*BhPjcI^Wie8POv$odQ_( z(qGUWN@c7I5Zp>*Xp@<`caca9aQN>tl+GXpeBrj#MFK(z;T} z3bL|GBD2z_1JE-Hi)zqoauE?w3iTw{gg<6sC9OCqERYTv&U`ux?VX(`<;hCzFv}o` zBxaG?5p}`c^`L|C2O9oDoAQEOzBif^!--|I0tCpy&DcNd1ZM<&pVh--rfUVG_u}nPhKQ{CBDqaAc8{SJJ}Bre&M# z0ctEth!aOqw#?rzE1F$ql^v_A6I`f)+%hVv0ad(aREkK#e*8kl;a+Cx#?H=CsqnmQ ziHH3^$;sb=AHWXC0EIQ|wu|FtmvAjL%Po#O=A|%EWq1@5 z$eb3Nftl;*b#7FB|JHuE{|8%sXc-35}vJNkz+}49{qN<7qBArzlT_ALZxhmxcMCseA$F#_MR%g^% z479BL8{oJ7IG(MC9me`pTX+F*jaa$SLx>!MeIQ-;8v%RQ6nRw#W;> zek3FnB<7(^2+z|bkl|h;RZA`0Pd1p;!3A)$Zm?R5;@fF<@+jWR7{`~$^A$>U)ffn_ zHjz*((+H0bie(W+3p=9kZX$H2U&R7;eUYS6?D!|0UNj|UDM7JG5G}vm0pz3x-+neI zX8JN;yup9sYn02?mbTYC6J{H9umxzdHH?}3DaaCoT#1p#W9-LC!!wFTE5ee+T>guz zNOM}>P!g$7KzbslRn{|+mCjwC1}&LqZ5@BmK|gwPlt7+N-UvK<%^5yR7izF+bI7b6 z6PMSc%XkJ3ae9;p_Irejp>`ic_Pf_@!`X=apb_aevb{%r?F3f9tgzj%>J#}Reu}+Z z)AxuV(uae9wit&~+eZ*RQHF7i0oCQ144_{~`ko`)HJ{{-N%R*G~l1*TIU>Oct zIzf;GLjqhr);a2zY<<_A0z>E}X!y$2)YKcZVk9pzfk4A?m=7nTSJf@3IZBDZ-RV(I z;yw{$Pb>MUSJ1Fk6;RPImRK?igg$jeY61ZJl^8t)N5V$z?KA$>FeL}zAnY(ofvHKn z2ErhUlD%7wXeohvMVe7mpKvw_dNvro!Y~bhr<*7_gjK^>SOFW$xxy(w6r>$UHToU( zH-$SffgW=w=GqSSLZWNHE1qAa+rE|>4mFjb!MgD2NKqQgqs>4rAe$p60$(>{FDH9r zCOcl80YyDm>d}04e5_ zzYDxPDGbP=%>`mS%<(EzAvq)y(sBe~i?^?*P@D3ZrPt%uQHSotQ1g`$HP^fO`w<0y zpetwK6IrL|{vz}1L&BLv0roI`D8Bv{Uw1Co_=_lo^_Qvr4e%F72A>Bo5OEKL&I~Cq zHGz&aS=*!^=|oi8XI*kh`qfr={q@AV<>zhtNGUBk1hVBbjH!fGSd*a-thJ*V-h}9@ zagy|3WJ^LKG$omoH}_)jf3Gbakoc8uFQn@vwZP(br?@+Xa~Sx@AF}GN97P`S=S)N{ z;VoYQ;Tcf3QU$c+FN&KO(eh1b<{lftRF?>R@`_IPDqN|5R&5u$1%XJ9QEkt_@)VjR zrBlzPI5z?gepuCzT2V_n5`2hP5Ks?N3-}90WXw=Z7|^W29blC^YAcW{GD9Qy?py#k z{H(mRI3pF)7?mgA@HsT&x|yypF(as?KvbWH2txQj*g)^^rg%TtNQ#9919Pc;eFm_? zkq#MBzuz_!P>@N*vy(8b9QSh*Zh)Ea2=}Z_nXEfsz-{qp&GBtdDlsI)l|Cg|BfGDvYDN@5U^6k5Y2up0LYQ^W?4=R$C`#)+dQ78)>` zL;|rrYOu=)po25)T#nwjiT69JL|${`ymcpCF&3A?%}I z|C&jO)#LJToU4wlHvV_$0^UVTmI{`}bKiZ)I}h{$1p-q*1uTTZE8iiMC%4lW>Md_U z2HZ_{QLrk~u+?cyg=iC(L41(+oz3@5!H>)`5G+V;gkA>`A3G7XaZ!z|U)^~XcYb7I zZ3Ad;XGcCyQlgOnOSi0QATY>FRfz&qr<~J=7UH53J56dyh^s=|A2so$z>?h~qNFVE z3^u$}BjPng1VRe@^ry<+AzFibo?UBJMaC-GKT*4N0pwFnrhJ&nz{H~Y;CG&j4ws|} zZ$|^f`OsJ6ium3H2^W4iX5Bhlos3S}g2X(3t#^1yLJ^RwT6{q>+iUs4oOg!z(t${O zH3BE#I_B*RUnH*>Ga$AHs8>kt>P^90P@qo1gt|mTZ%kE&FV2`chA)@pHzU@o zra=rx+sc9^kO%cfO-=&Z!jQ!LDUK@5*u;zyS+4cXI*C5y31*yGBf219z=KdWNR`o? z&Ul*0u-Jtfo2*qf!G6aV)~!* zxD_C^B@2lEdN$GEf1WLc7juA|30*1uQbH!Y|Ci%Fjsx5cb=c!x^r1JQ`mB#99L|o` z_rv#Bf45=JV>>@~67eF+9z@yu z^FN~ldqatJs(B+cy;z?!Cv*;Beop~a(|n$0ag2<2Pc)F=gM0AHc&`3hou5$BVrX}` zbkrMi3qa7wgi>SlW~uZw@sn4AXiI0HnJL zUeLl4lOql-vtTC-?B1+wI;3Za1%{7l%7<+dP+OpT28cj;tgQ!4@mNAY=|dJ}Ft$Uen*>qTU7vogBG`=;#JB<6eXRXwlhYIxg)hySB$md#HU3r~ zUfT_;BqfSi^S>-azCC~hI^&!BUmOM}R>nMkz~klCSmaHP|Kyuu499NDujK*dtPf*H z_BVr&53^xQ-1#?9;_E?h;ZCkVr03I6)ySD3ztB-~+z5t@Wd*hh2Ph>(=H#}{n*=^) zmveWyNO}B~lC+*_DzZ)vJj6_rP(uoDisT8lg<(s`F{5 z?R<--?Yif*8GK~X>ppQn>Reh5NE0k9NQtD347xK4QtJJ_F*KOo!|lbtg7m5JGl0xTn6y!ZIkS_cxd1y+x|0WVi-&oGLT}br zTON6SZEa3S4WQIkqYEt(3#NY3olQeV)|`JYS$bC5y-4N{43OpxJ1wZ>;d`K-J(=)P z>gzR`*SYg_*xm^vy_*1kB2(dJ^+knIF;kO429jpuwWUinfZyT21-tqa963gLbou z@eLEdjXCjMmb+%OqwrY^c68y9%$5lJ*^OANx&Uw9VFI zRIG)iPBF@Ue|Dr6IJ`pZ_J=kz_H+8`+dUvXc3`~SQ!<7wTzCy4<`J_$1V{CM=-QW^Ovw?IP#h^Z3 zLnZLaXvVcrs`nBpzRURNurz4d_;l7XP)>lB@OUfXX9c&WrKDsNBXaYG6&k+@?HBrh5-oc`z%+9-^ikm=|DKrAx zCdJ`>`#sd565k7oAvW%pX#_KgN9@J$Bt)7r{L1w4bR>lw2r#>zWRL5QnW7K)0T8cB zjF1YmoA`7YJF2i?OI)()V7E^NJn><3tZ6B zx0B~Ob=LRv-*h8<&qX9)3!qbGYWb!%aS$&G~$NkjSR+~@$j|b8RBCpi zR&fOo2}Lk-8Y?0mLN!>R3u^7e?>B&9eyKICrt*Hbu*e`vi?>&Oc4A=Iix>+kQy&Aj zCWg0@kTp{TRpG*ggaS!8>qFxXmowCcA^v~;p&8Bm49F)Yov;RTH-sKfhR!8h*!1(eb z;lOkVtT5@>bEUY$zRsLrzKe}~7aG;}OJWr>c>|BasR-NzadgIWy+Nq##MU?XPHhV@ zewG2-@!$ZRh;eT1Wtp&mK2=@?2DWk8C43g`#J{cjel{6+-}2y*JMX_#Z=v#bf^ht2 zEdylgLm2I+_L2QGfV-{4A2jXeNu>zUfxPwg?%C9-+C%L=>|Exi_)!6+!7dy`2QcOm zo`Q*4b~UE!{jrMfqNtI`vUl0gv|Q{^QBOFzOFS9K>G$9QJ>G41TB5Ph>6~|G0&X)f z-P(xRZNbUjrkYVl^0~6M>@vgbfj}m4a&5Ii`g#l5 zk>B)w&mr6c@5mgDY5^TaPFcfAa@e-?aF^a^>9=;@No-`d4hGFCRv{XX`9tEw<}vK$ zFbE3(Y4l_!u;_9mRD6=y9T7nhGLcw?HrkOC(k`X71xJPcO@eZcae7dEX;#R z^>U3|-XXC)vx?)>degBEB?acWK%H(f z&Mfs@g@PGbX9O9Mug*A~V4iY0UT>t{CCgAl&1-TP$q=jFEFU&|A)l0*>4a=9mNJ=h z6}@q#;LThS)3L=_XL_a3yh{I4Vf|{lWWl`gv}XtR9AzVpI!b)519dt{`j z6ifQJf40j~%u+9$`8eVWX*u4;FU~n-GOf z*XNczGyi4kk-s*Rqjsi})|A=2z6B}|;LBpyEYM*t%oG3G&FE+I56>+ZV795*gnRe+ z1w`SszFZHKlqT}%OZwg?ZLf^hgk3U(zSzSi@+8W#FR{gsTV7m@jmY8pG}f8X#T+3? z02v}aM(%FzAW^u&C5ruDz`@$~3?!_gPF&hWPSJ&L809pBbuQx*>S{~lTw4$wtb46W z@qqRqirSNlNb)!DNKCP8HHPOS*DK(S2)Gyh-nGokILFd(3^n2><2(yOjTiGn*iPP2 zzm#!%YZIa}J=2M_QL7+W%#e4LNv|F}uoIMkXDey@7AANl&_M5dmnrEatF~nAJ2}ytoV15ReAW-Hm z!%;Eh7$SC|?PLr!fj#N}*_;^e`hbtJsdKCSFx>r}E`@SC`!L@FuoYfC7W~M7KBvB@;$-vbe!i-GHvw?h9knh5ND= z2Eq6SBi5#zY^BX0niURzUHvFT5R}unFnxt2dL-@*P<@@LygC9s!UYz)q}c7xS3R>N_pU~9m3%dQ6JuX zTvQ;Elh$ToFAm&ayV?Aw9W?2H+@y>gW^e8l@sgLByOorgr^-%#rRhhozQzIXq=L6w z`Y5{da*$5tLk>@r(63I-Qdv4_AwZJbEBeu&!^iPQd*GuqTH5mI+9dgRPu4F{uePF& zU4qs_QKOm~REpAKWW04Dgw?ooF=2Ay=8O}MH!Q6c8#x@Q-oPALs?I&V&*P0&>$X)Q zIiGN~wG!wM)~>`cJK+DLT6$ca7S4rP2UHVUg|xw~6RGb^)lP`pW_6WY{MCpeSw`JT zy)D4hEm^|WREcV$o!ELCcWKdRC@B#jQ4p&xVQD3K$@$ot*S<=ot?xQgs> z9)V1HwbD#I%t~6Oq+8)3Xf&f`zE$yjPIQTL>AfCjeBTB%CN9UF_CqzG|-yY zH&~N@vAVYzbHl9=cyp6C6|Nup-yXuJ8Ee9o&k)~hJjSVK1CPCBAL3x(#v4X@LF{75 zskTbd?1L-dl(e*Pvd&cqhqD?0Ma)(i3)Zp*?vL;JIz(&&Erj`@6F{4OrKSQD>s}IT zD^=!v_VuIsS;D@Zg(ujO7~x1RMkcK$yH4;_n zb2qbU8}V?_RD}fM9(oc3_+0y_V{zblkn*B2zJv%Aw=wUe#UDDiGt{FJBN(eQK~5*0 z6U4*~q>Mp-X9UhdafE|OAJwxZ)-iyvOmy-JY9q$9Z#Pns+KNBO#!)a~vjA)KD3^U+ z1%)i~)KKIdOtUl)-5Zr~{GsPqTJ~=+Gr4sV z8c!!^0LPOjPeKHhrKLSMVHuH^R@Ax~9JoLH|K{kNg0)VCw>__>uyfcwil1q7hMl z_6|6`-F_vZ=-f|@@M&ijyd0#hkZWVq@0RhhGom>mT<*G|!%XrBOzwwu%|2A96Y7p= z;%9gdKhbE^Uja&lRlIOQJJs9|-s{HbvcH9zH%A*nuHh9fcZDA>@CMJ{^T`|Il& zd21L&YCzlCsy$SVh5AYy+ z&mLh0J*Utho?b7ng}S0%p|Ab@J{cuL0aw>xStBSPkCZWl-;A=$BBTC96ZtnvHGc0$>V-7S5XBs&UmRe}Vx1~+ zikG(m2B`}wi;k6UNPTo2_LZTKJA*AZ_BR)10yZZ{Wv?PfYVBo~EiLpA>4TOg^1+rDWRTdSFaN z7T6!U0yV?M;-e30gpp}|MDCi5BII6(=Ckf1rP1=5#VI7P;Yk>Qd)C2ur19lN3#vme z5Q;zo0=y#4RndlXdGLYJ1%>N_Q~_S+fV1b--8q7ryp^q7R|SrQ(Qwz>nTvla{!Qxq zxsn;O?3zbDnvSMdp|nkjN*^Oo5Tu~Y{_Bv3))c-JC>69`9uZI?tjzBxxTfMSYWyAO zaq-^oji;Q1-!i1XM+o6h}V7_KbptB)p0+X#P`!++h)(F3ae z>@BGMK2K+F_X6SWSQVqmlImD3BEfR6G2{{5B5y*VTwyXjDK*u*4QL@qbM+uw|4A;ZoQXH4Gb;Lq(gWfE{a1TQoX`pFZbNC? zb?ICc;v_MJk92~rENiM2P%=ex0#2>MSEA$T@zNjG8eXe~2ca=VQJMbkVA!pc%Ps*F zy?T$u3^#rKF#R9+f!#~eRp41R@1KudAH67Ry@u!xd(cs_D0)2*OyX0f!X4wZ8jwpi zUc`UVRCA;H_l&2YuHfBuHs!X`n|&Da!u@$Ha|?kbc=IBeNU7G6!i>XL%|Y_rDH$^GHW8X4%ISf2Cv0b6UYXUer?Onea@$QBjATob9VL3KUA6fqg}Qq+G%v9m8< zK1^-p_-J;p+Htsw&H;>4CP;DoS+y(%NsIq%*o~iN{zn)8ml*309_@vGe`QQ8zQs#o zfSHG$Slks~E<+}VUayRANU4fq2wNX7n{1Do951WPgw{E*;>}I0tMyI%S zoG8zd*5qhTR@CHBMfj%%agwTkl%;Chk#^KrpLfKx+)F~^>5(#9(&9z?@BVE&Yg3{s zmmYv@q8KjoG_2Y>52WY-;Wf!R?|1ZMu+0ip6x9S64$OOSoyezREZT?AI00StqbzXN zNbaKHHRn_2j5P)0t^VXVcR>|t>yZ$z1}|AUt0(~EqOOa;T3~qNuu3b_Tw6I!O7PheRvRNJ!#+ELIgq)ztE_?9{2{{4^1!{@Y)H+#hm*xv_q_Z-c2?eq; zZ>Hwww*v_cGA3Nd!5bduI0Dj!fm@Xx`eC-Zz69(t0NyH zoxkrGUh&>QPD(WQ3}_)Y^BnMAN7i^Tl^a_Yqc#yTqcIZ_f1;C^%*lbxueOG$tRwV# ztsRWLd5PuoYjU5ES}?l+1l(gE;xWDu@F0$&?RUe8cH6Y5GLH?v7=Fu4!1qkPpp+d&zY$$ z(dmFQoYRLv@pZ-kF8sq8B@oJRN)LuRk~fIq)KkR5%GHEFcR8oicS(S*KUqoe@5S6j zUbbW!ZsRg<8t%o|#jJMXQeKd!KCL~!JFlJacizBydK`zuu(DDA+q84hl1X;-yvY(?1uwv^Aio_ zV&({fpIE=!LuAv#AH0hmg-atw3)6MG(U>`%;s3&c4!)%V69ljx3ZO2a!7j1w`>qS{ zQkVH!XZTFyg$Z~E>-WCbX(&{SnAwJ+t#doGbaab0R;}STkHzP@rhj&yG|=rs(yc#0 zm3whB07M0n5D9~|v$@O_5}K2%g?U)mLK@wQp}O87OaR&AU&Ae7?4FFoe)y+i)f90T zK=C>_GOEH%mqPv~$$X`Tle{@U-&!t|E00iV#dt5LH`oEnOR0bl5Gq!w#qC3%u0Yhfl0Wj>zSoWr$|utl5Jl;RW2Z zxy93LtHs{k2h1kN4+-qIVIR(epn4FK)-0!%Z$+VIv&+GTe*3kuv&-Le`T0F5DzcH3 z1LmhZ0mqcd4p8wJw_D`P*Wy1XIvU3I=?PzcCF`OF$tTF3`KnK7c1!m|1c-zKbo;K` z7ci06IKZV!l0x`q;x45jSc;@k_IlDr_idhJoasBD7_9{JI*^aEho}S812A_!N%D@f zw*o9EQGy82G7yKZ-M8mDixZu-$Hgt8XAkUp8WX+>?5gQhJx>ZE?D1S(_!giLQ!zP%{=09$X}$mjch z{&EkMu^cT<7Mh3|(xj>uqp5`L1d0ajdW_8VI&7D6{-xM%0U+YV0+iR{} zE-~MM(VB6IOvswCi|+RkDB0lKQ&A))JQp+;yyBPC-^Nl??n{eH3Z|K|_IFsLCPN*{2ev5WoBfkI*L5uEp`(Ba6`KH^~ zT0jA_U`!a<{!jw_-om24&;qgNA>lmRpjkmun^%0|0Lbpw! z5&(&6SJ#F=FyBHC`794-FrU2PrIBWk6ER1J8)r(x5orD9=E= zKMTi*${FiRkimkz?J2*(!6oW}L1k_FqyAYKn+F}Y?ur&Zb?d9u3VvqIE4(IU7$~YI z9h&F~I#t8lF`knDh81m)eDag+#c>mRB4E3(r|hfsUAMGgTXxz*B5&MV&Z9CWQtwTcR8jWK$UG& z9c8Ut{t?*HJHKggIG?*=+ENK_YmXIzYxeB-o31~r?bp+hY2*9N*E!$p&xvDo2l&r- zkH=kWHs3d-&qps^Pv0!sccV7P55Cz4xRs%b*vB&4$w2MDf4&)FN;lU1K2wINkqqo{j(B;SXHAO`WMAG z@&aNccK2Bze4f`ZuA8lae%4wx;mmY&^}HMnAzBO)Qc8&9TIeoboUCozz#F?B&}+Mg zlG*p~uiM@myT2jqeX zsF~Rd6^L^J5{|Wn>BE^5DhCJnlPFYhL7Uu=8dNZ=hVO9v7Y=E54sy47LP$vD_<&4XanKhvnd1PYsc6Kye zCLD|qmCy`>ThC+E4cBFqxx)y=&DR@;XRAw)3@-zjn7$u~X+{Li|1COt$Izs0uj6oet9TzLw%XAkTA zf{@(YU82!F-oVndB|++U&FoBh1srAN0;pABI%Es13Uy$D97axpBY^*7KQ?!Pwlj5V z4oCOE#wv<8N(V+UnF%lgR*gTCv8jz-%o&5n^Bfph*T7)lkYmgt}r(JNYrv$RQ_ZtY;b^h1zy4*Z}~drJ%vVe_J2dj zz82t2@Bp^la0*H7C^#F$*f=0j)s2JJedHb_U6lzadqR* zNHO6|hr0T{;B^wa+*9o_QIkQVyoTYgIm@Px%Q&-_)RsB%_F6Z)etUwiZY7gE?w9)iak8M*yMW0|F+fu~cZvDyQ;edv(ftE z^{qYC?vhpOUUmlS2?xQ%^_}I7utZ5V0a2iaI*tg8zHYW!FZ4NtGA)70+aQZ#21*(T za#zDT?#=+|L*Q^A?c|sCIwD_VJY@+VNc>a}I3DN~urFB~v}b6`yGsY0(@-??V?J=X zA^=n>MLX&LhIysc4&dD5IJn1Ud#1erEU8rm*5N-0>S2Pza43VsV33htoPs|)VK%(T z<@LM!-rqf1{S2;8qSHl{*3xPq%2D!+*}V^i1L;DBg%iTYyD;Xjb^*=O8x0GX347R? z!dQ74z+jd}(v8KH*#hE9Xo<$HBt2WhyQ}Z8+w&;tTH`*-wYWxk=Q5+w5;L^AF$5v7 zSK;OZPieJJHlZsi4x+Ghh91)LcfXOR?aQ%W<__rp4BhBq+fFl!&cUn1R{U+>09Ps! za{3UB3rGYSrIZf?J^{Ze5tKWe1ye`^Bs+pJCn62MMYO`^#nw^v_rC)=Z~!|L-MqcJ zvi9n2U8H1Mx}4E-EIGQlzp0GRFO>wV*yk~H>^R6SXW1Y-%!tz>r@RuOMR)|Da12aI zuSN#HR|U(zRRKhaI;a!k-^*r7_XgfZQl7C}*$rTYYd%qGqYvW;IX2beqq<*<1r?fm z#aY{}KFinn*As6!<=P|NBkjY;+olIGvaZj5uS5uvfB~&V^co%?db8sH>mN~Tmxh@3 z(FcvtfW%9WdC3LoK9--7K8n#Axa4|Xhw8v>SB-)Tm~sZW?N@>Koc8o6E?Dg#T4+i_ zXntsC0`SC7a;pZw)kByLVH5v1ZW0<*idTroK_a0Z!r~TkJ_|7PxEb5U#Qf0SX6tGl<>AN%ZDVZJ=3) z9DPu()Mv_q8tOLwt#%ANNDv)j81Oy}g?K4{nxPvq5wa6e;@EYz5RVC-Y!1-JG&%k+ znB|aBg-f?_7H$?jPSuT{Dx_MqSBHTgBeRKix~}!XA#GcLtXHKM6_a4K9XxT`D5%d3 zk_m{ut3fw&Nt0Z1`qny0H15Gqpn|QRM4k|En=h$t+Ss1W8`I>L>`dx7)yP{u&gD!n zV>k^@Eyvv}Zmch84Y9Ao3Zao)zewrdveEDpKiWMw_Fb663A8h0;s86_*l;Xs*7zM# z!Cc}lwA=fD6q;ZMx=1U+rCh6BRP5GN7d<6DEFn*){*t=A>@Fs>Nn2d_%k^O6YckW< z1N?CyjHHs|ADs_>nhVWQMmdw}tQ3>%ClW2p|9zwlTnIl%V5{HcCq z-t@hkyOFYG50U6M;fC<1s|iu`%r@5mT(B_2nAgM5{S^F>RriTNIehfsYIf+@0lYZx zEp9vLbY(GEC3%+q`2x0ZIbL)+d2t{6!%_#PQB}n^gVko903o|0tmJ;Vh3gm_g&Qx! zkx+5galX4(zIQ}1$jbS2>wxJZ5Pierya_u1?>A9WS?Dm3;pRcmk)mgTwEomB@Mh9< zzk68~5f%&Sc9D9PBVTjJK85_V9eBP=yj;D1#C>iRI{=FT5{_mCQ3zWlB1(_1YVw%$ z;{!lcg9`ulk@Fye3Im<}vKieG$Qv^Or@$;d?tt({%>=s2XtjCv=G4+S?$r;e1hL?s z{geEJMj@;{?4pPTsrTU7p*YdN{di?R#Zacb*aco|aKWin7FOK?-Qu9tvq_9Zq*4bI ztsWZyg0oY=Bt-wn7gWdg$dtFj;Gz5lTJZ}49J~X_l?w8-g5_iX9F;&_nq{jJaSIRX z-enu-&?K@fOhfBe6vPTG4eP`4L!(-v)x>O^BBi6#%C6(yP*PiqM9->V*vn=Kdmh5t zFPvh#-3LuzNx%a<7P!7b!>IwmgnOX(dqAvD(C;_&b3a9M5ggu=;^du)iz`9)fgC~= znNRu(e**|tUWjew<>sEjf$fcra=q*v+A~4ieuQislyo*8eWWuIOJ@w;Dgu(*o1{IJ z9$2M(<_ypRJ+1?=HYh9PheqY}v_Wz6+=JckM9|@Y1O6;Fgh%&1CHW0w%o8k>2P?fA zZoR?Naf~M)B?b66>ASa%a4#T)2e_F8aXLfpvL%cH&wrT+=>#x{AV#|3s@OAesS}5h z$mC70q($V70gfZNPP4?DcV)8}f$c)sg|P8U-pFsj(?!`f1)#SdWX{t9iv*#?d19}p zq<0CSs>H|%DvfEGk_(g;fxA8O4l^){5do=}{*qL{q}H6EBlb*A=rmwdbvfX^E6+Pk z0=#!eN|e^v-~YSYzAGQue7L1&jHGCg&@`8%1qvmbKAJ&8pNy7*hUDg#`UBpZ1#zJ& zf(jZX8^Hoo%L=+fH|N}$BNCS}kGt9lLVLcm6scv#QOx2Aq2cR;p8n_~xvmJI-=v_a zc_;y79_$jPnDO@;`wU+33JISi_U%LHs8u=Sr;4(L)n@hY$jS&YX;|mC;Cyqvnp#3H z1Uw)H)A_8iwS6npe`byJ!E@BodTj<)rWj&83&6oCT;c@G#!{R=T=HzKpW&1%)oPD$ z*g|6GlG9s#qZ|iIG6{0Sb^Te)XVRAnAtQE0Gm!FtK}0qLe8|< zvSFx_3;B)u)WNLCL`O-+&&Ad>Z*aEgPq3?T08T2_sDzo9>792BKCaoz?CR$><(1tJ zkQ|w=?@R!hn!$D`i)r%qi0a!fB6!);J?vNIepG-`gB(ujk_R=QUzctNQN2q@V~Ts} zTH<^Y9MF`O)_CoYktuP@bHqEo1aE&7`Xo*r;8B8b3ZFYs4&t7bb7d6FT4w&kR^(n2 zcSw{!#tG7H1>qnYWvvmHOI*@oMtvnTGB=X`03u%w?6sthCJFw?Elwb}(gF>3S?0|1 z2FR)I&jF7g=cw~pn7K+` z<-Yxu3Z<*FSa&r1qC?H?9zBq7vgOczdypKAYsy2jUY~W2F>|>#ElgBCr8X_dknxvl zIN^8pp+s`1!kF~aH#6>;x7Vk5X!l7 zYd?a8_Gqj80fP2qNprcV!5vbkcBz-Lc)>Fa#hZ*F&|GQxhi$c;hiXx^UA#*7OiXk1 z@hpuOcd^v)-AOt(=FAg}!TSPrvUSX|+VD9?WJ(86U6d9UJzgJboDS6BPHBJa+~6ih zekz;DR!?ECFo|D*BBh2|S>qwj|-^_Z#KO9{mHKoQURe8EaConO7e!b!K0@&5)Nn)7PlN7YmVbJ1= z2|0V2O-H=?+?eRsYdkr$oe^Hhpn-6^&>`|CY`ywrbm@b&7DwT*@X-}G9baije=g~&b$JxV==hMjppLOp*FQn@jpZ^`q1zg__rj7S^1EBR@B3)A8 zXM=qY>Z1-vOT(E9o>h(aCl3CnuU_?0F;|Cq7t#Om{KU)N^94`2aoZ7UGE zoBOU;%jsOM<@{mp#mPS-z;GF=QiZI}HZWEs8SsXoZ(3IXUly9e?=K*8+Ge zY>!;<8ekjGro*>jriNY)pIvBl%E$gh@Vxakl^Cc4Sb@d5Hyk9?)1Y)9yWy;6hhEAXL*Sb!4HA*hg zeRm9fP%RJvqT9G?zsNkq0IludY0tv=eLILhK7 zh+0X3qSFI_#e@EI7RT&Esw|d%t53*8>6eP&g_kVhGLf*FdW8yumxSfS4D79@G3YH5 zn)sfOdgK^*iH##}2VMCeztQBm_E;RikunbKel91mmLX|A;2mV;84n>RCB}1;h%Nr*XnrDC0lb zJhi(NuH}7CNEjWdHzqNB~byrDavc^kt!Wt$;Wm{0y z*Yl(Mx|BH0%N|p-QV@g3wPf_|zqKn$qzF9;uq8t&2IM35*UqEY8}s*B1pwEhy?`uH=!R+ z6vw6{NM>v0nP&ypWXZ+08^e3jrFT8f646FEfkaWzr-xHx;s;6<& z>^$blYop1hrYsKD5Cq04owSq0jjh%uv8s9lqiXuF`$Ws7($R&}9 z?K`nk>+G*$3FdLR_93NYPmAOBKRauDQN|EKsmqPU#h3{PCFF3J5bfpLwOntyr+^oK5!~c*U`e(Q^xNX-N zaySQJx#~Nae>9xQZUaWrR;J_9Kh_;h7pt#uS1`nHjt{jAL{LXycW6QBQs>zyVfn$r z>XX>gZS65$lEp9abyY6?<8ZY8;6HfRIMwp1hVrxv-#l-b3$(0FV+JL;u0hR*o2 zni?BMEp3JhzhIW(H7Ta_7LDSb{>b=ptmG0D9XFtAjm9P26`^4$Yu0+kLc;R&NVL>uv|E#(6a9 z*U4l3=T+bFqc)cfm~qSm4dSFGrs+JePl#-yrY@o%Q6!=guX~5jCv_(#TD*;9ftU$h z`R*#H`XdjslYL;H;ag-^=T`6Bpc~Z99U9*1dtV&glrb9=bQPV`VXs5b+NeLKsPc#& z1==0pue>3-LGkVtU5f+beq0w@630j8J|QJT)-3+jt6oHD+fW~1{!Y0+XoHRky~`v9 z>fJK0lV1~1#J2ZlXy*8z7tJccYI^hn`*yD5H+!}zhT8(t7UK{FJ$UNFJ=>fg3SgQ1_CRS(yOlCkG<_+VlDS6=<-%JZLd-Lc^-S zfr=ve*4@-GuJb*UGN7)k4kIq%=_O60ILPs40}f2_w8o_d#UA3+rr~E44{i)2Htfdp zm=BVh&{WXUHw(wKjfdf+?k+;SRYT%N^%!Hqhakvp%dUC`bW8(olClsVJ39ITfuwv_ zeL-67OMS2PzA8?}*m~$Qdpj=Rd3Kve?q)8)b_|FDuV2P_k~I*>n_g z?L4zX`QNR#X!fEs2#0ueXb?GF{PHG}LoC4cT|-_#HkM~XcZJ2V#p3uBamfk1P!e{I z68N<2A(nfEeX(e~O}F{Mv8d4aO6{`;RgrvK{KHL2gYXKPAWb5>f1m(1hzP#sx!)Mw z?hg|G;&3qQLh|`|6|~Mf?3|W1)7d^qto=QFNHlLxT)5`g;1Odw z*x)(A+j8X1PH|iveWubM)z_PjMSq+BY&#xh;j4MOGo6aH$r;L2&m~^H}VD9F5w^?Q!sPX zF-wTk7uve?ib=jVbQ|2Sks>4eMX9E}-RkNa3QPCj8s3k99!9d&S|=-c8jIc7tCHUdgX;LBBB(nY!BkCvJ1t7V z3J>XCa8~QU>1KE`LP+@6ljSx2Wf!?$SjZP^HXgk%{VGGz6#W7HYGL}r;J9l@i+xzI;rYyIL`<;NprQ zsR4oS`Vk6n0>`T3p5fI3hYCyj7K}<~8MIf>F5b!o(E3KtLV(Ie9V@h3EMeE&MLk9i z{@z~dfRtl(zocM{g-nXjdJ|IQpC6Pso05aUO7^=mNA0#9uTDB*VPeT0z%QT;4|@)( z2c50ObFynt$Oe4FxbJrwxJB05e-!|t|Jff`ZS)DQwemh4<)AeiI>PA&aX+DR(v27L z9ZVYp12CXUFY2)n238FSEeA#%VTU}ZO*+sf!ybt(>(L6JH6n-oC~N|aJ$d|w9X~Hv zkm?GKsuImet1O~}C>3hk@ff)@=imJj+wz=&%GNqoAd5yW1d>-m=JSu2lxv8472=Br z3h)0--HjFAw^N)X?bL|lwKZ(Ie!C1H%FHq?7ULrg(&*XHbU8H3G)dc>J%*OYE23%UR(I78RZXpDU2%d*-jb(tEa_CEAq*TaweOok8jkz%r| zhgWP@uXNN;?C2}j`)O6#A@EfdW}4fz#-65ZD?3;?b0im|yeeMHX`j+vHe7ai!;CK_ zf4J?DDxdWrIg1WadR1T+$>OOW-K&`z_jft%ajyt%oL*!tm#Vo&uvfe=YYFBi11Tz@ zNvNbJqSYupMx&M}B;!jNHh&Tlnr|&fX|~NFETKg1i~7Arn8BUyM=GEkDdJ@sFrXfFH0+&#eyX)rJ!K@+74 z0ImK;R$m~R+~ddoLY+VRuaKbdJ+?gUshULw%Cl7)_VwJYwF@6;oemmt~Z!Y|G1zvRh%wDST_d>Fn2jA*u z7JC%+xLAGOlHKP`?AjYaNeT$nXW=^Q+Y}gQ4M9<4a3OKkBk9g9N!fLjo}_)=?dGan z)=BvJF}29e;c1cC`Oa$q2|JXYAQZMEH8|F@lCAOP*cq&bLqfxWTZY7OoT7p)sXO4V zWKJtUBIh<;1*q#al9$~URp6j6^7_4F5Kw6)v(a>+1_>|eWs7i8!I+f5nb4i}&9e($c)hGFk+L!pJf*I8k(k=^%7%VddZab6!Nr`1H4W zLRJJ_!Fw|}-{~1Mn~?`!(rLnJpRPEv>=-bDwg8I@PFon&3v#ZJw&^xG>@7{ZN9Gb$bSl-2LABafFcWw@?1FrTWQUEvPjzq^xLUqgcMC7yR^^X z?ak?GiKw)=QU07dsl&wr%m*Q0$b7XnP45hsESMtx#F?8kxvGv&f-;}!@3x_Zn>JUo zo?mVXM<4!tW8fu-OSlklELY;uK;%(A2|o5{=n~aV|c1VxX z``5y|I|^DeK;GhP0k=b31w53kBTOMQ7O_}=aizKxaZ{QMmZ>rdNI2ZR=24pshZJrl-Q`) z>@dOk4w4v!NiUU7f0>#jRSV-)a-y&3>>!ocsw~ZI;hX(*tZ6{#@hJ3{S!~wS;{5gn zXur5;wOMiVaia6p(&$i_sdu$y>G?+aer!$lyP0Jvuh}1^1`llnWpv?XPz6Y|vw*U{ z`vuSiDV#-5R1Lqxc|h5NP%Ld&1#|%#I64qx2Z6;I@gk_gSvV>ey*2_%0M0LSgnS1< z#i6v5fD+`^Z!^UZMbHJuy+Xg0|6?qf7ep7<9`Hx0WBjieA!aDS z?DuY+*A=y&l~Q?Vp6h4|FUu32vU<(34oa1un#wD4YRb<49E&&SDladx zQ*Q|^FRme8RFrm{o5Q(M3H>7mu$z62ATWvYONDV?`n7{abK`N1gN24e7Vl=so6~w9 z?Hw8m2fpI53SOq{R{pgYIR#36H@a&V+VG!3-vO%_wwW&iFv zDr8V?42-Wbr&3>4>l<2>+!vcy<#y7q($)Z!az`j2xv3`>#J`oV7j8nBy| z|1l0U?D@ksatP*k^f*u2XWVoA@i|8g`U4k~(`8HU@LwJ7^7s?C?9aA!Q18@v02e12P-hc^?BocaLyy1Rc#UUIJfoIB#Dm1vUMC|X zojg!tdp6xAIOh0)YsAfMUwsByBcI0k5|h1yKKzt>wF@M0wI5faFcBq;f^=S%nN1f58*q8W z=iL_p`m1y36WdZt#%gB%Dsx=P)6HejW|G# z^$aBBI96FOc4Ah!D0F~X)H@!mXRQ{fQ9n6pMHa`wAY9ZZ)G2*tP=~JM($%Li&gRce zJAFd)Tk5Xz)7bMJ9y-A;Er^v^<}Dy=HV}m`61v{fxtXL$gvtkKKnIjr=1Initnw#k zh1d9Ja3g60D~qW9a{LW-xDp?$;&1u}er^`G>p@qb^l%sWns`jsA*dB4)bGOwl!%);@AMSgKPV`7!x zdRqwgKj{Hhaaj&!4RBXUoEvd;(SY9!>&q(QQEs3zfaRFgGXXn?4Umu57zB>|s=N&a z@#9>Tf|<>Ioj{=Z#mM<}rC(-OIDzoRSzxbc@str<^3Xe`B9V9Oi5ZuV|;YO+>8!~I^kUHr9 zQwg9!OX7C9E1OgwL&FYkSz&4c>D_r|d!(cYY{WMxpnkMptKdI))nyZ(j-}I@sC>## z$=yAMIHMQNi@f&_iK^JN|JwV9T4S=vCs&<(vdCvbFY(Jf(cIziRb!RWXahSdv&j3m zeJl&<@myEj>>f`4caay8FXWGUl5lk3ig%LmG`qbvA&bwNzE6B;*$SqNPRCf8TK*&9 zdDJ;nd52&{O`OJO_1n)su9xGIco~j<6UXk;ENhh+7-E)I`cwd*L zi{+SQ$}7;zkD|;Je_paOy5&5OA<7AgB%wuVb~Mfky{LDy7U@wQJjg6{7lyIkh^GAp z(q%6uzce7r#af)Y^U3{|SW4l%l!Ep9#HwlNb_)eT>YoEnBdXr{K@?0-Zx#B*WT1hA zjNP37s8lk?iA;gePP6kiUH47VLeLBPA$HJl{1lf%`NvLFgO30s=r5gH(&NQB_h7(p zvLcR9{!TEidF~#kg;ff{#MMid z=z?|^4;tJPAh=8L#e)-^#ogWAHMm=FXJK)IJHdl{g1fsrci->cKi{3H>N9fYnK@H) zs(ZS+`&lsr^gP?KL>OirZ0GwTu;^*WA$QM*5>$r@Evr`#n z&N@T>tLkf5B-M3&-4oqXSVSgU$GuSZ$xoMfbG}v~;B)xM%HNZc=vtkrvsKiWhX%Ku z>pIzui1>}WPR54HHO%;2$OaA0Yh#}bVl(G!q8iQj^xKTXZoqXPYFRqg6z;^`gy2EII%m^Jpt+EC=d}?@o)2>#qn6^3@ zkFXkUIW$F^;s>#UaO$%^)~I7cCC$;MQ?VB=ACVkEJn~*8PG+p6sE#0NZWxV5bK?D> zbS>>;cgyK^GWc(fpxBr>uqa*&q>biiRr8ZBhd^13AFctLp%B5D^kvg-SL&Tg7o-rL%!? zWLLlJGq&7xhA!oaby~V5ST3xG!95Vrg94~H(6Z+WynW*bRAvfU`+Por#q+F8wLpJ5 z%^EQA1AIP4^sMau_se0YQ%IQC+sl(tvvR<=(FosWZE2$x9~~Wok+%}%&hE{`Nz6Gx z-Bo5Dq!1EG^Cg4s;Q%vMb&s_BDzV zZzvh4liv7xeQx#sT_$DX$*CSC=SRPzjBnB}-+;!SFh){ASsIzs!pKEyhK}{5@t-Wj zY``-_VLMHfJR79L=YIfY5In?Le?-y+%40{-WFzI&T1$*^kKZh8*-`t)I_~oNmI`Oq ze#myl);6VFWMkUNs2Da4qD2A4s*ak}lI47yS~|-UR>A;5nhAqkFDU2aO7m+E(X02> zoxFnRud|MlTsjoqO6OmJ?eOyh_V)l6F7AJwq>Bc1aj>F$-Di5q2`&mWCovdJ2;Yj zaX(f{TqpARVW^S0v6Kmk-C}LS*tD!&0(dJoYQ?6LtYO){`zbZRhjX#hneNp*=7%5% z$0B~xMk&~+-LtF9Zb8-no1@u?O~5}Q%U)}SXdeHBBUNXDH$^g}u&SZwoHXt#W#Pbw zt;Ng-DcKK+L2-#$+&p{R0Oi9$z4ln1+Y;KgZ6Md+K8u>+WpSZf{Gl0`h z(Mc>MWo+I}`Gi7LMP~I;Wi{{V&n%U`nmW$q%ZTL(vqXL7{dXE}quvC1bV~K?s3_}n z^|9Zv(*l=f#vu<_2^uBlFkYadlfVw`HW7Wj5f<_q2pZfK0}l^*O;Z`D5D-}>dJX`S z*GS?Yd!8Zh%xnJ&>}a$1p;ATd%pVBq&}K&-u7Lc8y@E)_!g|e<(k&IzXS1?S5?f?0 z;V6je+chm#lIal+SNz~EdR!Gwt7a9ztlIV;JG1IiwBY)*0~&{k+kyJX<~?%i!ceqN zniD&g8l*oQS$~Ht1#qqu<@t?d!MH(x!sd}|z}4znihCd0kVx{Y8MXm#pas#uwl<<8 zYdvA-*uV;e{!c$Ee0&u9Cxsbn=8#-c#~nvADn2fZ>4F*=PQ5BVs&7=O=W-p?Ip90o zQg~L7Y*cj>eLfC053)zFY1Ay{9@Ca*LZ7gn9^R-7{zYu?pUiBm+^CdoDPuGg>D5B8 z0MYa`@?)yES%1l6C~_=SEpJX;yV6I^N13pGzUJUVt$C9qQ5N2)!* zFu0K6bxd_-vCRGk!h%E{t2=GpMd;8B31@%zrRA5d{MfxawA_Ed{95Nig#k|@L0B~v z_z6maDa!@LS>zk8xYsX76yrEVn1GDjt@Sc$&rCCVE4hu4P)e6xL~TV!Me>#LGa&WY ziup*|eqR&oet7+A z^RGw|#w5IJBJ7{jSe%JFX*TG)woQ51U@VP$72#QbZ?W4sZB?%ply`p1Eui{-#wypm z*P?$5nmHBQw9ZBTIr;R2c3qbtk!w(;lq`Fm0Y$~n7}_pmgBm^6HvQSut#%zrncP=A z>vcF23V=@Tr(x}*TSe{47Pu!IR%u;M78-vt-&d8S#2uxjx^p}HRBLqWvdMC1@naDQ z=?N>aivsIV29E~o@C_@8iOK_3(qxyq_)V^ed=i_)3EIdaWp1$ieN}oiK}3i#pz0aJ z%Kw=mL3P%q)g{6tmzTrn%2q%j3WUL^!Y#yiKHO%%Lj6%;ucbAdWTOH)8w@~EgwkoSQ8g?o!4n13N6$^r z;=zu;%CEF$Ac>s6t~&AI7z$1ju8aeC!3Mh?<13Hpu&+!}9WCslX;);!8lYQ>#fYlR zt&<)Qf`;1>Rm@Z}p%w#W_L_S2Q6HBJ$gE1nr}U@~?-2GsoEOOLcOATW;b(g;cY^DG<3$c*pOLdKaF z&qKhS|3G0{uj*#VN^7q>aMaI(j-mUlmlS1Bi492t4;SP{f_&*30p__co+>!(#E>5v za_SX5llBWh26QMKz8@0jIO0hgl<*TDv}QqdGiiHX5@ zq`&;(z;DVk-#Rp|WCAlw8DJ~Do@NMJhLYpno$i?ROSW*73qu#a+#OBOfWu=#6#gJ7 zp-W&PN)*K8OIEgJBjKj`H=jSN@bHIRtIq2FLF9hUy|n3z3=cb8@)&fG*eZ^WOB{<6 zU_k~Px|nE6yryA1sIW}#Um3P~%(T-ITBn`iESs*-EybP%@% z7zxlX!XW6a80a7~kRUz2MIQ|)Br(B@)5G?7h3LuT($^z8G*Y#PZ85)L!*;(8+n7&$ z`DMm4#K{Y-dW_BXl*n|DMN6L-6zi`1GMY4At+=7MZ@=QXYHqJlz`sWx9f$APQWXIb zjcpgVR}wt9ASGpVDD7?Ha9VjSPi@($#|-tBjj_b`SeEYUKL$?Z+fmJ)LfB{s1949w zF`-pghk(mVW1&=##C$zTZJBdBAR5AfR$I2R0*GEJOvOj|ps8l4+`bV&TwuJ2{6#)) z_?D8Zrx5=HhRM1y2HLqypzEvqN)4yQzwk^nCaBr!Jy1KAGh?4fj<1m84iuP}74l)% zXWfwU;Z#S$2aR3{ze&JEFZpKbk+48)9y!IA@9l2?3>=}B_Y|g~aa_+_zlFqm>3@$B zAf{5YBKM9r#U;2LrU`aRUuE-%M976WGMpTwAGUmi#TB_Vuy^FqiW$h~z|#L;92| zgmWdZ2~n2%6XLwCzf-ll>}i0P$Bv<>44*8K>rCLs^oHXhkM~o}Io|OcX_9hwLwgfp zrUPmq*nTcSs;qx#t_~&;1prZAT=)cNT=H)~$`jIt@zwTP$QSO?+L#>z zd@1b|`a$^$6DDc;R5N;<4w6_$Z6T^Z-SHBIlcs6_MY(eb6^7Ms%Rwsm|EqjIjJeW2 zUUIWX-9A%lk2sBove0f}^%1`7woEe}Dcfs()7atgS(4tt=7`Ju5xme!6#PMZpGSpT z@?2R&F$|BGn-bO=Lgx;^+>Hsk6lwLmsMQbX;~9iY5a?F#;_y*Gll;zq=58u}{V-!? zQ1oGZ3-$(gYIaWr_P?PMy1o#~dx$7D*B?pTyAv}&+UuB<0zz#OOm}e^X~27O?Zd^Qb`QtHGYQZ0Ad;Fel(C2_ocExfnXG z3|T$S9Qe?_Sm*O8c_ACUeL-mjAv_837pn#nP54j@r&-6;ojF4QhwH4;7 zLBfU-1v3FGlDnWMl3Q(xPp*i12fdlLWS{^@?K8Pz<3^$27d2QflpXp6FiEAONG|b` zE%||Z*M{XH%g>UJQ}CA8e*ECpK!N$x_iFz~y%4*M-+?H`yIxOGut4ns!p^(WGfl_n z35&Jn4Q+D8V{-PRDS*KEcleFNr66$pB8EWK?~F0%77suGGzha%p7NT&1i&@WquOUO zVi?T{`cFNZloKb_+SY3d9Un{T+iTh-{`pfQfiYba^D!_lZ%(@dkf6^cg-5KQYVv!M!IfDfMNpp0D{~B0#?M?s?PaSa5FaXnG+K~?Try8Ty z4w_-&4(UKN$?VH=ZiQT|%#T>?(jj$w7n7x)7it?(&(6kvb| zCu-VU8!>S1OCvYDWSD~(emQF&fX-~d-1S#1mD|nJ?imYhWfZv5f1rch~<1_>>sVgWx zCdq%|C_j>J`4ZSGM@w3#xpg4TFijVE03u{jH)DczmmOTe2lU$Q)!ACuFE#=HDNGF5 zMK2o@4!JX7x;N&mU$^A&PA_kn?zuPc7-u!p+k<`ZnpX$7n~Ma0iZsLtmi#9}scFEPhoiok)I8u)DTL zkb7H_mI#pfFI>Z{H4)6InzEM&5X8fjpL4|X`w@8*zeu1nGUovH6t_XuO$PSV6(NLk z9e(MsZ9zHtemCbedhgFsnt96a85-?ret6y~1#~v{o}5yV@>i)o!KZ)ewXT6cJ>c05 zxN%#d!k5Nn<*;J;jDXIz%IkugA3^sPc(ak=LWUX1r%XWmbV#-^-ct1QvD|jXiTLRvpYYDURzR+*w@;GseITbD_!vKwY-hu`Xlu@VdOq>* zY^(?~S;@JC)6OY;#-fjO~m#sTv^P06%JUE7zp3UK+1d3iIthG zxOAk9kP3ELHz|a#TZsuMQ7urNGPd90sFLWPI36-bYFHa^w0F!(i58$I=E)%^}wBS+yzo zJkHx)@}muNwr27?jll#_R*cE6pbXZb1|-S_u$eMD}|SKP{9+uY44oFKb)b*Jj%5Y)fh zdSqHv%&d`|jh(KyKJC~aUK_WTJ%=w9z$Yv~Tfv=Dxy^@QJ-HG9EYbjXcb2vbFLZ4u z?|Po_;#jDdJWt93?Xu=`;~?W3`z=fFVtMBmLA{n*-w!^RnxI@xd;Go5r5dajp7YOw zNR)PVZG5+xC#P-NIy3!TdyPGL{!^V2L`(MXkFMC6 zEvO=mSKT{B(albIN;PN%n^e9aF0OMwwgjBH9oOo3+S-QdbF8Nto<=}>*# z^soSjfoerNPQmM^GKZ2X&QhW1ysf@YE{Mn0TZglsQMNu>vyjKMp+`}dW6&6{`t&){hwT5Wwl!c?>DJ?A;IfBzs&a+ z4SPc$Ed3eBhv(VVfnRQ<9Bj*ob}Qp{ZL?q3GE8mRUeA>0wP;T5YM%wHr(L<|`B(P- z&edj|^%q~fVWt0b|vk^k(lR0C_Whs4<@i2q4zw?V!6bb-3II_x=JK^CiCx zF)w^Qo_(=8m<5mg+AadO-v~c(`LVgap@r{AEAA_rPk2cy@~Ar$nByWe$iZ0j{&JTk z!0MNeWkQi`aK%F4!HuFTOsk8Q{*nkQ!P$^KFF~4!5yKR`?UB=QB0>Ey@{6FdcS_=5 ztEJ=!wA?E}Ta)>FGmf#X!CrA#quz8tsh&jzpKMr3iprIZKT0OF1ky5HjZC3GCxgH; z^T$+KNb#eT2bPik2}@L*F$3t>^IVb^4~QX`*nB_n*Qwhb2jt8x0U9wuPE~+-N71KC z-hP?4KP=wchkr1g*1GvUvzuxEC8dl_ma=r3#;8bBw=B-%mMr^rPtXdyjrq;Ya|+-tibP2eQ!ft>4RDE8EEq0 z-T9-2A~j7lehqxtbIf^P+^e%cN>@l#UtgBBWW_}|kr6wm{@rgzF$FUpeO1K3g%YW6 zp>g0P%eg)MYdoOhj7C|x}D>M%aC}Q@1%{FE8RNwE^2zHVPd)%xEd0ea|A@^@z z(|C0)HBKPH$k{b}C3GU^+?REhUAKl%=H7}`%fq1S=j3)pFADzR>H-FD_%=H^sVHvG zTWV`)9D`OydkiN%-apw*ZrIO0iu7 zX0Puxv*BssT=iU$nV)KUtnE&Xd$enyH-Gnof4b(0_4@_mDegH0b`Ut`0>n5vsdH31O85lqnxAXJ6R)dl+ zo9lOUJY$|zhyYco{LJ?`3vDnnwiwjHe7w4{{fbO_ImX!ue(Tyvi>fD)1-G`Hlw#BP z#;;M2D!I9#DqCMYWGmMfIm8OZIP}hYW}M*s5+@znCF3+q1g3y*#wFH$4|aNJHuGYRlyl|AsBN zqrLnwp4aV_$^Wtcwh@3o^LOzJ@3BF}qMQ^n|6XS#rorMcPoMdagPHBqMeIavL6vnT;zYq&Uwzs0 z6CZt>vW1v7+8H+tjf@7i_2mxEfr=@-lC+WLg+n8vk&5E|k-3_7#~*c@2z&87>bC(= zVsei~NeCq+h#>k5&Xg}$86Q$*E^Z5k_=6VJyk(8bJeFLx;j)@)93Pa$IMeo2Mf>P7 zXye}Jcdy7p@sE5m)vKPO=Br-tI5%|4cQ1>xfd$LqGF)=Fur3UN&k~Jd^U2+`yTVp# zrf!rtpGQY+7doJJd&!xkJLv;MzTn631~M1^^qZxmK%J;wIsT5@#=PAY*-i~U4eMJm zvrI(dA6~pGK6E@|9TjOl37i>6Nvd`rvrQ_<$@^aiN_vB&=F|Lde|!N2nu9|%d^>$a zeqX^SzNy|OFBmB--)0(jxg1B0L;0Eaj?83quDIuiZCUJ)kSaYGlRK)?+FD%J$)N$X zii>E>2_Gslqk$E0hnPC~aqug!R^#$_3AhIOu08ttRwaXaES_G{|AfZmJ_oI|k}6T$ zZp-IxX8WhEOE90N2VXhjdO4}uXYG}KwHG}()68f$pG&QcqMW zk$~#;ss@^Tmo~&M{mg!@+)s0{M{-onZ$CSFW;;7+xAyb!;Aq=iRB%YgL+%-v+hk!M zEUP$ED#>{eHi2Jh>{(?!k(Ufem+!^uZEc|c&d%8aPBL^c+Tgqj6D*`nKh;3OtD8A zFVIZm7IPW?-oY_I;jMh0Q`hc@*B-El?o3D9>)3*hDREC8)x5vY8RmDs8N$CN;f=#f zaLP;2+P!{!ohkQJn59H^fArn)V_AIm^nQKh5q1Vm261`}@tZY!z#u}X50iDD;_tGM z@u~&6eYvFNxRpSIvKN+oA?~oJse?)`E3%S=Hh_N_Ho6e<1JzZqTZjmn-)^!1!PnqK zU)P@_Qnb%));gHug2uF*soWUXqHllEjlp`hbA?XG^6V~-#?6|m6~gzOquEe?E>ay2 zAf-)ZI9K1%mep|ncp!HX3q$_+3dd5+1-4IYrq;z>p~B$@{HnXv!PSiP?`JI?F1#BH0nlt6`?EG~zD4^fZNbdsn^@dk4#o8iHn}2hGUO%dUY4^kOEA)_`Rs{FGHakJ# zIAbP8;dlkUXax5$5lZ3s3~J#x6eim8`Z`%bp?yc}`yB3*)4?vWrTnb9vugQa>GJI9 zG0>Q??RF8&7a)9Rp8MYawEXr?O1c(sV=$e*za~J6Xqr#E5Ol6PxIU4cu=bSj5u_Tb zSeeuLe7KH(XZoefx8vdK+tJuHt?P3J!H>0F9GiekFrMdE598OCfX6LIpdlAXvh*oI9FIOIY6Q{a|RTQ0^!a?3b;0-q8g5>xlTSzTYm%YUKH!jj+T=Z27;CewxIk-%LjNf?VP`>9?4n zXfD=Ve_7^O*pwSKc(mBKMYP_|7HuR}c8zG2;@F1iM(y}ORi!h_ielx4Q-UZaJ5AmuS; zq>-C*IVGo|DEilKIm$fbx6ISBMBj_-Y-sSvOSJPq)JlLu9PS)k#Ah`xDjIRrz5V*?WXP1T%M}s`z}Ne{t~KZ zZS^U7oLcO5$mrM?%>JRKvi`~3C=C->1L%T%Xye72;l z3buS})1JA~FnlDgQ}Gl+MO$Cv@HIQHxOT4~MH1-+Al!ez?eITnkU953H=H$}=x1m- z@X2CCXvQSy?Dp4nOE71HgI5X6qaxiv>b4475*!V%lDK2Y1#F)_5|&YX)PM% zUx!I2o+3)6OK5zlm0;VXz7mifpV5{bEhD|mQaNaI)+qt)ClhRD4Xf%>+xEbZ7Ss+` z;metMjKf%hwjHnGpThZyAwpH#{I1{f(iA-_MRL{*!ua*P{`PPG1GqiuiOV=3=dhrK z7q2<-lQLj~Q$2UHy&#@DtZq#Ayx(YHeO}_*3~?ofy@jsRk}Z+xJ_~sHZ}tvc+3q0{ z#05}&EFhHIL+vPRY;w&qI`FwZ{A$gTL)(!d;#;4~pFXKTZy4@Qq3cADQQLeX`IU^r;Y_q6fX#^bwI+&A?ROS{FB3S@Fa%5!|)pB8e zr$dn2E;FC8><_s(DS@^fhu5*3$FMgqphu__ju-#@DlTw=^>8~|1MBx#79y$l?VTMK zd;7P7*MYi|5sjry(c7M@i7M%bm8b5z-K}mqX#-nL{5@>BRb2j8NftwBM*9gaziBDG zDvWV+Y`b)j`<@+Nc2v%s=g9NBh){}f`&O}eInZs8z-8$R*Y53#*~a&J?4(~poxO8W z*-yiLJAAUTzww?;P6%>+Yz;4$TnZ%VKX%9^swU+=ZJPH`MaQ<7NfabAHPH+w9g zCp`va7i-?u9&{7LQ^yXpVX4wP+dsD_3FoyFWq02TjR&R3iXyS1c?NX4RdogsvQJ-^ za#-J~vf@UpXi22xW>SRK6n4g=5Q_f3z_)T62Q16lW4|!YlLdgA(%Z2I@;;8ZYU~{9 zoTtxS@0@vMqY9tJqKKYYglW$6;!P!+mMp5J?k!OB(B5S!oGRvV1DsS>PjddyQCvnjXqs%6;-v{wemDpMLo8HNpmDe~oqsSk6$P*2`6f+Z=+4 z4ECi%seee%Ava>vPC_l)I_vlo^W1Nv2%84mFh7b;g>e%_}!ZfL*eEFJ7Oo7|ygMdGyVDq}b=MwS`%rdK%~ z$q+MjLam6A-wTQGLaPgK6=9Zy1`R|9?8*yFm;Nbp97x0kI)kFFUL~oul!45ZUwM69 z)S}W!DH&3$tKjYw^nGS3Wd?JPoJagEou(-A;x#;XN46t1^m8ulbH^2C@*3J8n zTtw)P&tGsMm`|>-D!BSGX;NF<`=tI_Kl#T)9P~f2fGx7spKlm6&MmPM_L52~b`Fdb zoo}KBH!9{!q@eD@q4T!kp>49<_>boX9*K#0{)UoCW<9ob-hV}lnz|Q5n9LZn7|kU1 zFn5Ig)yM9$+x;=SqSJbY|G93>_r7kvtzG1|{7z%}nnvqcZv{D7ez^;TVaDfIolKXf zm%wxzSqSYVq20+Kj@;TJ{}*S0Zp9d*SyLdhsKmma)Xj&XLfNss@}$^X=>??eHb*?Q zb}{nL^DtWC@EiGZH9QQLNu@ZUJ-c{w{SKof2Lp=>zy$yR9{_^YcpCd*$j>9F002G^ z03d)K{ojj;vzZaJ8i$p*nYop{m8+G5J&U!AgZ=*xV&uLEamxn))QXV-SpN&*4GL{% fWM!{rX6I-Nh5CP&BOw0Q3l_SDLfgX1|Mvb5Q4lph diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index 65d6a51fd42..a81a131860f 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -1553,7 +1553,7 @@ "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." }, { - "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -1774,7 +1774,7 @@ "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." }, { - "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", From 897bd649237f1aab35371b9f3cdff34ead4cf3fb Mon Sep 17 00:00:00 2001 From: sschuur <78623042+sschuur@users.noreply.github.com> Date: Mon, 21 Aug 2023 22:56:17 -0700 Subject: [PATCH 42/47] branding --- .../Package/3.0.0.zip | Bin 41836 -> 41836 bytes .../Package/mainTemplate.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index 4030eebf0f9a742c67ebb4108f1c67c90650028f..bece0d948d62469184307a59ab6b5575a4a604fa 100644 GIT binary patch delta 3593 zcmV+k4)*cv#scid0YP(@~ zg~UTvH15-esbSHbDKLYLRr1>~prp&bKS_u%D~L2G$kV5qL8aQ^Af`PWK79&ZyoMv? za0mk>^+v*f;^daPOIzJsB~wLF2*s(Ab_kC8$wyOEx)K3G=`Yukv9zrUgmh5zJXT1D z(uO=9rh}UySs&b?Os)sIL%Fbz(jtoqW|NGTuA6a`-Olv!9X1f(p)q_1x;b^*ESl2e zz;)OttSizyu0uA&x{ayo+`p(GFY$@`7 z`WFzA;=|Qd)CsqCcdD96GkI69p1$PkoG-V-n1~n3?_0Ax4CzGMhG45|2(}RP13^FB zwr&Ld&^P0-S*LlcaX$(*O#=GEM6_*tPBS7>iC`f_DluhlJO)seYrd+hvx-!5$W8=# zAZZqVR*?siex04gnR(Okw%BRdql2qfsX5_N^EZ4|jK#|yckNKU{+7iLSYr3as;2&G z7~e9U&61N)%BS3|-V2C-*W}t5QE?MkH0L5TNhhJg;wQvbmOua6 zjlK~U?gb)0gAeO`X%=Bt)+n7UfHm|aBN#q0Gzb+2f(7u;@_Y^Np-)FLX1e+t8!wm8 z+8H23F6z3rDY&Fm(HOC}CPv7yy%aE_Zs$~_2zzr1ctqU>^QaN_CMA$W-S!j&343FI z0#u@ITN#>!(p0ID3|^vcJ2_kld#_TciMs8Li!os*QH7nTOJxCX!l}^=f?|wTbJ!F1 zX4N3VV>Mj}FYMU-VIG>IZsVP5ObTt&IgpCF4HwZV?9Ju?E9y2|M5?ein**0_N8jA211{$V|Ymt#HkS*B1K!cequ7y35HA|J* z#}kHchJ@jpwaM|UiDkv`&Dz3}1`OY9%8lWhF?_Q*O=A6H_+|{>T#+z*Gx4Je!#5Yw z7zEC07^4!MGaAYW!#5KzvM_uzBrnoN7`|DTFnqH^@+K6+H|vrokr=+2__Tq4;hTvc zWe!(^@@Wc0`HJ9akc8ozU2|giW|lk%!|=@_)go+7rRDmwY&ybs@Z;$A#|d`|wf@n-X2d+!(i)YvXgP_}GU+xcnh_5c=VV7pVj7OvR_Bq)Y{2)o(i@M}bd#~VsYFpn! zc+CBrmg#lr_dn13=Y4)1UD7FPqvZC2K|%?W|H`+P61QF?Onz}246mbqKK)Gpx4F)! zWzDU^{WjU!DEu*MQx>_V8HYexzLg=TR@bGUP!kVWp{c7EUKOeu#e-Z$VHlGC#jW(9 zKgxHa4aI5hlUzdQtGA_Ql$o>cA}68ryszW(PWt$N)X?+tgp+AGomfiWJo78B%PZw}uZB_B@AmG0U9PzU7OgiI_PZBBpT~LT4|>x*hldTG2xmgzgW0kHn+SYR%{H$@bcA0AFMp+4Y@aZ# z`NjE?s-hDOznXE%Ty78~uSa7d+uGozWlbCl z?VsIeTzU@?LM$kMOq65z84~0Vzh`lqCEu|p(e9#y8Ocw+{Io6Jm@VDPcu!Rexk?_n z__P}ccM;1FbQc>l9PHxT=Gr^BHa9s*SdPsyw%oIa1bSF0NIN|#&Cc8Oa*e0J#;ry8 zY0#*f{_DnazG6F2@Hu}m9zMX2ro)*m5X9g9;4cy^?7+HzJ5h$7xcyie17i6oS$+tao{f@?9m;_@wzEePA+XI!>IjR07Ixuft_Hk7#`vIBN%cck$6xi5Grlv@ z8rp>K(?n!Ub7s$r{kPGqPP+M5(UES~$44n8g`AQOul-yO)O+SiXV0BeWyEb<;(lpp z#-d2f7yvted>VD!DLMsc5P+$$QR72QA}Vz!Z;{hRQtYnhF z(Z)s)I9i(zfur>w^DjDT0!M>JO|%+y5h)LHCM3wfp4kkTAe&dohXI#yy?X&99VU=3 z7*ILUVIDTF4KqB+sLx=iMU?2iPH z$D`;HL`hZT?297qVuj=rWnX5{j^Waef3t6?krNP~0FG_C0;gPpZ5u)=AZB!Z5^qVP(@nXx#x1Zdwl1_E(@JGh3KMgrU{WVb-JOj zbtxdy|my5hNWDUX;sq|z6EBQ-ldZF)&@Df{%(U+Sa$P*JCN}Q?7obfvd0`3EU#$TCw z@j3hCgm2$4WGojfOLfUoH%7;Qpn&QTct&q2fSNpd2Vh3qC`8Jwk!e{DNzu)fr?3Ab z(TZSBq88Hqc1M$lqdnDgQ{j#a3n^(IS1{KiNv{|tZQ+oz;bUVGEfRf@9Wy7^2*#wAcVvZZ@vix*fQl6WE!fu;|-BZf@!X790c2 z_nCH}kiSZ!kUOjrw+hKs!4O3nkV;umw8s(rlSGSlyzp9dCvk*Cz=yfl6mjVeR*3L|cEPL;|sv^2o26tR%piSxqKq~=bPX7I1s z-&KapogS`Z-SFD838i9x5_c8BSQST_iGmhlvEdptVePIX6}v9{&|@MVmDCbDv#y7m zG<|`Ch_ivDA9IO%iAGqz}Z+uOOtI9|qjrVmvniIEs>-gg9GhY} z-XAO{rdVp$vFr+e%c&`r)BVA6W{Tx(f3TdJVmUX#LPV#5=g4-=L2_K~xn-oRjL}Aj zQB$0aaJTamo6;JHHfB9AGbH?jJ+zpn4^?yM)*od)yGkSwGUcaB9SV?_&4 zjN*JNP-s_Cw+$#pVZI$Gls&O-aB1e&0E0P!KXujPV+}Qbl=YAq1^w2M-8sPwGtld! zo9}%SR7T;ybyUNNFD8EEnIJME0WBi>fjPL@y<|iIT0wF0i>d`X#}N?5R?x~+r5$fJXREm30#I)A~u=q4Fvr%Ww%59@2Kh?h1*A ztZ3Y)4O4TXJ5vw_8>{5EVL(ZjeSeY=VN4KdMv$jZ(>0O}D%A-GG40{-=~L+9H5?>| zLl`KjEfN-g9kv`i zw&C%R9Nf&u`j8G~ay>8|%7uMY6w^(Dj$?>%q3svd^sD&#JNy@-+_ED&55`Z5jqHWuAni26y1PdWPi79jAk$N}(ReX{|b|T2b zN3&pmiadPu>+CGf%$tsP#7@H=9bC0a%?X#9zu^mFEK2scYlrIfw=8PF61y!{HT74+ z_?Gb`56e&(jwdVL3}BT0y32SIn7)iyM4LghnToEuhto&28AF;cv>B!)&NS4_0M1`0 zijKgmJd016_V`a>yH$^DmYjrAKIQK6UO<$8CfCM@ik84)I2Qp)ItdjPKOv&B{Q1{z z^o_6}FA(n;d|2m8vk0!TM(Jc>tDz?u!SIP;K&apkENp+4=WBQmeL9kn($(MCc)0}B z&R`&NvDURs!PTUS#)!Q&F+z^*r7#h7JE!79*qc)zBkDGo$BM8wDd8jPwx{4m*c%gn zP!e_9$}l99rb>-upb~Z4$)QQudzAuA)NOBEWC=ToD%eC_DhntRPK{>36JxZRL!7WT ztA-99tLZ{eVaMhV^MDj}8}C#jQD~daK~vOixQIz%Z#D;0QMcJ5K83y69Arh^W{X%A z_GSz46?Gdf<5t+4E+SdfZ+m2bu&~pAPz1Fw&@f#zi;Qf6XTkmj8q8$TEbN)AS*pxF zo-k-LBn;ZDO^#He=A{iiAO%i62!Mw7HPR zAaGWL7nSIo(Evsmw3&F3g+ZGkd6724pv}63L7N?tH=!7`S(iMC#GuW@rwt5$+D!Z? zbGRCmPg5YuR|HRkBn;Z@niGRIv*bY-25lCp7HP9;c4E+GP4cI1HrWq@HdiDc8Zl_I zQ^KIl`t-$>j2f1QTNl%sF=#V!^}8)*(B{L_iM)1EYLw9wX5-Pz9K@RLB-${jxx59r zXv>~nUteWc(a9g@efYi;_u}DybMmK+H=76Bd%y56uj2lwozMY#PBw?(t@ySVj_9nn z;ZZeh@Htss-%fuU1l=zCa)0nce03QQyEOY{JQ~Hf&&kH%2T9^y)Fpq~djEl1@<@CASw05=xl-SH88Bxb-4o@{8MGcpdeB>1X=C&2>gC zYiZF^QY2GHrJi0S~(3|c#JZ$hpI1>UN%$5zX2q8!7|kRX5fJ&W5c`Hnq_b{8GYNPhC=r)}}ZZ0T0Ud#YNDyu*WSUkxyebwa%`5d<(@qx(8EeW+UZGYcHX9!Ydi%uZY{!3 zgGSx-UpJQX72AP=&-sh-@Bw}_9nNHdApZ6Tf01Be2iDzxi8A!W?Z?U(FpJ5{E>@o_ zFApTo@|K1wMmr_2R&Mxq~SvysQK?W>My&K1Y(uPdWDx; z{3~cvgxLq%ie_w)Csc>>|wJ25I`#VwVPN))R+kMLA zM&(3H(NqYtUCyz&R1^Tbk3*Zk2IOWKUeWJ-MnVdIhEFVxjpwq-7yflEcv>}W+Bfef*I|9DWIN+;Ub5zXYY4EWD7GPZd zHC8*%e47iJ-;^XRepP0bM~~%Og_UBi4>5eRtPh6as~h!NjaA95VjBf>zc_TISk5}7`z)1|^b8jma{m`pNQx?aZ7lqIDC zAUUJa2XwkNaI{H%Rfng{Tvh6v2ag(9$g1@%4el;`QF0RwkMuR6C(=;H+ctz$K-!SXsMru+ zkfzXvG-?u~IH9YwAHV19I4^Bd+B#Azp^CJ&bI;{+_xR3F~4O^BSS(+!2K zO9A<&JkyBJB43Eq70;bZdBoHqmA)8%soC*q(@Tn53DE(qz5_%=^1}=#Qeh2*BE;Eg z!yN>Fk$?@LWB0;_c&d5^2#~WzyxDA4qQEpw5!Et7@E%noAZ=T3^9BVk1S5o zw{byduJCamxsuT+rn4NYyX-3OPFUp#0rv!rzTEsko|x!R;!IuUjNd^Ja33&#{>s#g z&)Fv@eEWtWW4T~is!Nu-F*^PO1yql~GkQw_)a21S05jS~AyRIQOv`deif*nvef=Ma zRs?erwUF+&JDNls?Wvxd3U^#sNJ;y+g1Ht+dc`m)M+p(;#K(vizH(BqyzHe>mE?kl z5-Hl@>gRpwtS;0GTga>s9J9uM5am9l#Rjl)vvI}N?ZEY%z|I_nMc)Q;b5kd<;22=O z&$I)D{8bu-++mftRY^O0B(UBXeHR>(mGcx=NGA~;SmI4j$O)*7V(9N8k9!U_7+g1z8>?injHqemYV z#bdN6o;|@=k%5!G2Y!_Pg-%Bx?a;9*NkcwbPQ-(%VN~6ZDEWxq0n?4-n|hmmq)a@8 zl7^rAP~99%pFO0AJf$}0rSY?9R2iaI7;%$xs#KPtr2%fGh=t@%oEM%ZHFu&kgMZEb zt}4``xT^@psyNb26tobF4cDLvYj+)~*mdED9ux7Xq?Xv3bv@jq z=?ff0oDC!mSyqbGXI_=DL(C@J*dB0?3tRi=Kd@Nd74P122mW-NOfdf02`vX_6ZuGL zetcP{nvJMqQyywXm-?j62g#gmk~o_uZz>$WK3Vfol4kwnOyy*M4at}fk}#{2FB>Oa zDiW3B#*$ddPfP7|`af?L&I@7$tMn=HvM?cAo(t;BuH9PAY+&WO zyJqFf$+M5M*;;<>cLn*~O+YwVN9s4)4o7*2{lju(ilwF=wJR*2O|jHeRd$8t*c8k0 z{$M#V#Zt45Wmi~#PEE0#?hlqTQ!HougXP>5%ee^_B03E`N49GYlH+pEEhA-Rj5b1y zn&NDP<4tzi5`gO5isX$2&lR#4c})4diPgXTb$x$#XFa*@G?;IOWFeKfb1X6$D_VeJ z6z5xkLc5B(Z9p*!^X)*P?1^=QOEb3y7|aR$sjD6zYp9`rtcT1f=(mpS&Ix9ifnFco zeD9l}G7A5#qZ&?pG4UhM1d$O5Xc5s5%)!m>B_j&Z3XSe<>djL5eD{n-A0GmPC+$A{LW7|p-fH98y7ozIUciEwgvSt=7~zwuWFnP zxyE?6QBnV?sI{y|{coYrwiXwb*Lhdcmia}NCs#`D@HElSTH|Z{{RflMqEQWvwG~%& Pnt))NmH+@~lQ5$^9b5A{ diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index a81a131860f..fc278aaba7d 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -7233,7 +7233,7 @@ ], "metadata": { "title": "Infoblox Incident Enrichment Domains", - "description": "Leverages the Infoblox TIDE API to enrich Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "description": "Leverages the Infoblox TIDE API to enrich Microsoft Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", "prerequisites": [ "Infoblox TIDE API key." ], From 50cea0ee88e1a957bbeeca02ba8acbff16615301 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Thu, 24 Aug 2023 13:00:51 +0530 Subject: [PATCH 43/47] Hyper link added to createui of readme file --- .../Package/3.0.0.zip | Bin 41836 -> 41890 bytes .../Package/createUiDefinition.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index bece0d948d62469184307a59ab6b5575a4a604fa..aab4ed67b923027131af09b2cfe247de9556ea2f 100644 GIT binary patch delta 3223 zcmV;I3~2N0#sZ?p0vk|E0|XQR000O80%#alT_|JF2@C)L{5t>u7nA*>8h`CudvDt~ z694~z`woQf5j(KuB)i=f!F3njq%U0hxFp@)At?%4qAhMHQ6;H3Zm+<7miuV;Np6PJ z(~^@qiJR`CMd4T^Mb7ItGvv@8|M&+&I)B!F$RgU=C7sZiMDGrVuEmRJOs6bjvGM4K zR58z&QP!u2Ti&*}Ge{IW=YMQA+*6Di_WIdAoA8($E@SU`Dh&T6@_yAa{!^!K*9vJI z2&QnY=iFCP%Zc$ucJ9gy+2C`gG)#npYl~&w2~{*=1_r^1kJto_zKkb)S~frv*Kha- zssd=7P@!4B=owSZeO(<4jRDiX;)%&t{u_^`L@WQ{X(1g&XWo>XFn=AVnkiV(poCC1 zmJ|0mID$qVGcg2V0g=N4IhA_IcOryVlmfeB&$`}dLycnlezhNgJ_ z@iab-H#c8M!*(|}$t%IAW<;?GQ^ZJOLPjQ12sz{Nl#JO#Dn@v$4HW`guwP4&B0sz2 zRFTt|{O>>iC5Kj&wSR7Ma>(55xR`$1%^7ygF6YoF#&R}~vdQ%DS;p#LcDD9}Oau74 zPYuOK8OO{wQVp{O?Rs7m^h)}ULk5gQbPha`le1XPV#2jft8~#buu(nK867zv+KzUE zdn94XP_Rjq1&WJnlGE5HNmH6pQ-~g_00<%{IZq`Gv)Rncm49j_)FYPLQmPb{qsd&R zxB{%l#hmy~1lX!bJ}dbdK3>L*1Ry6c3low8B_x-&M}96|N2cryU`-llZw~LI&J5q;03?FA1YsBkvY4{iXN1Ly`yu)T zFg*n>l&CSm8{Wfa!xJ_6V4afz@FR1Th$v27fPzE72gZZjlOjnlfz}gmDt= zlV%;h)JE@?(x4tW8BI~l;Hg;PwCn@xsCsyPqGUwg@HjyGLe>v>oL&HXeh8}9q~t1) zzFuI;GU`4Dkp!O&aHP1H9-{dTG}x8T^uSNGk@!a;#sWG(DZNy!qy1|je&t?s}C)dt$(a9nXNX3Rl_BNA&PO|j+~%Z>r@B6 zEgwErMJA+ATg3&@o1(2Pc3`5w0{|@s;HNx5oadAD$&8UH156ob|L6|DIKlp%ZD~@7 zqDI}P8dIHfuK8H7JSkX0dalqXN~TGJe(TvEU2u)=5_*kFs}tp4voHC?W!h1gMm7J4 zA%CeszJbSs(VK#mDph8luzCtrn6)=j(J0}7PNSr#za^zO=Ez0Iy4eXAm^_j3yp$LO zkr2E+L!QuUp>Pi~84xQ32pZ^qSWufA;*oQ2IQz-ergEw)SUfdhwXRAzqs{BMBuYZ=ENPj_Z~QDWD1Mihr;^m`Aq?PFRQs{f!D5J{Leg(S#4O%m}adjkk=({4dhn-*uEslYuMffM%jl}z>_d8v&Sbj$<}Z?}d-Kuah^;PUDt zs~?D(OO{@+f&f+wFu9s>A&5Y|%UD!QqGAzxMU&7*LFQ$2L#GxvEck^AP`OoLM1Pa6 zGsv!kM|YzRfQ_Daj>G#T8`mQbf5bcplRMot@&IO3Ss!S=*C%;ftNrz0K$ja9*?AHS zUER!zHa?y@nV)ucPdgiZg2U`veX?=d>7RBiCGEYRHel+v3wDaO%@qrpKB6kI(j`>~ zWrp@P_a2aCCs#TT^s0Ulq1&x#A%Be528{&`*fBSjnoCDAmjX2+-J(Npr)(P%rwh}F zH%swx45J}Q_Rkux$izj>MkvAQaE;vHb61(?_u5*t&A1D?Y+74no z@bYESJWY8(F_Q-xT<%dO-I&{Yow^J^RUhkt^z-yQumDqESlg^c+0cTD`iX8mvw11?L>emyEW;bM4 z2ib^vIENiEgmQ2xc?P&wcqK&Dl6^%df$eVny?q&1llEG4tcRp_3RewA1!Z5@F;x#a z3eS`i)73r1dB{X!&u*rW;NU2mraGsDQZ<%YqvrXE0QjADoL&_}pjjD`>bxf>WR20G z6ugDwngzca4R}$y;=S%X)ogp<|C=n>It^5i>6M8y-Or2fA$bXO9y!Z#v?Jz8Vd0tBRo`4t_BHtC`k8Z18c```+bn`DIDZx}u5z@#Jr}8F>b05l z8Xaya&ELJl4Vb}f$`vm1^Xs499D9-fjt384NreaY1*h+9G3#Bm{CEYvZy^4)IOu_M z&W|qe@WY*Jk&%JSx~a75y6J-cJ9E>PMOI~zS{8{@HzYr>!!1N|?5bAT;hsnKtP#N8 zjJ!{oO_^XL1b>;2AF?17c1M(Ndt4<2?b37QC<}5|M$%Y+Dt3^rC}Ugxj`NepY3vF! z@Erpip&Cd|9C<#t1o(5ZxtUYBx4*Z!S=J%0S5{uF-kOzYh7}S#b76Xm9tQud7Uouh z!3vwaRbcQGl%1>ofStou{U27_FQg&X0zv-!nYr9LG=FyP3>qUtu#9cUHVIJzS;&W?4bpfQwZwO2`wy^TyGb@luejmRo?9y;vwRT^( z0@=D4xmg9Wox)WskOgI5O9e7#t1LMd7e#oK{T9Vpa-Q0dmkKOXXC;$98Kq#o1WL zdzPt5()wNU@^<~8@*9)R$%HFyy4So?4km^d!LNI*ywBdJROtK-Z0zUD&&rh-?k=C( zJLEYJwfp0p8fW=Kw>G4_>5pStR?C05U}Xv)@c;i%O9KQH000080Oe*FvlR@!LUxK-fcqZ^ z-y?Ql%Sm>-EsEmT`K-JFx43@CKT;LI%_$X{^@}GH zs=2SLjp1g%w6Az#vXTG6qZ!f4e{xb-N71=A<0ecesb&gBe>7+zw2jroeGU%cCXbmI zg0Voz;l7+nJ>>CJPK3O8FW}PC=d+Uzne)Je(Eq~+$pu`7jL$+-T>pF$pTwJ+FQs9R zH#f=qqmU^^BDx?GMvl*7Igbg~I%WE_n@dQ~zvO zBrze^2ErSV zr6E4xNHhp+z@P%IW=vZJp`8SP((HjRwb74DYfz6Ik7j6Q;4llEmwiwjT@SBMm5j(c z9tVgoRDGYv=>@3ghv0fmO05Fv>m{YEqV97Le@TdDQVl5%riTc>fd*XpOb`528yO97 z?4Bd(7}2@w5Ga*K4{rCt;jgKJNKszDlj>|DD?2 zIo=0s#w0=}(uqt>3$z=Nz$%l6gC6-GY4(zHzZphqFBh={4A<-QD}hs|lWOFw#8h|) ze;rt>y;ky^2QFqGS6h&3MtGIGULO=GXjqI~9rdyoso0A(0!t^$HJ=EUr^`!3&mH<)$uw!mZzKED z3$8I-!c(KtYDf9k>`UHpnUD);R5No7=^ph49rs7?3RS97nMK0t#YF*YZ=|A8!hxMe zNl|}GN^!(di;fMmQ!cQqAd^LDF-RgIM0j!dw|b|Yx~V@v!ZvLn2_=>_o##)F>d1uR$b@!87$4x# zt&$T4;z56-!iFy;&@VLMgRCrjva_|bHQ0JI*xKFzf!n-Wh}7oA`4>8HS4I$oy|I$X z7^;_AYe6SWVDok~Bm(Y)QUtEze>}AQfvkDS&`T%?V8j5ct2q~f2=u#*MFkQSMCcVE zp^bvl%jkwrEpb@z8x`Pk>%fR6T?fdnqepk6PJoS`caF{bBx~0rPkzQa2&+5YHF6(% zRM|7|e6LUPd#(8EL4z(gEVBJ1n7XywOARFs*N(Bo#xR4%IxIY;DJ%qFEVsHnwHXdttb0ttC(=7+|cFDG(aJn#!d~+#3j-WLZ$^Kd66`8oK*+?bW9gdL$J`a_7fv+v1 zZN**4Wy{*4DtGmK-3T7}e@|9cV=lU~DRHtNGCx(^EFgor(SS>~c5fCoCHXuungX6H zlMySeE@m)pCYWM<1N9$^DFDdLa+WlLC|?%Mvy=xED|wK?)gEQhjkT@UsoU^#^|GEw zzs%1AOEC47z0F#jO&!;j3u_RdVhzrY912`z4wZK1pw<}`iJ?6efBYk~!&j;C2#(db zow)-tEHmiD$}9`#Cjpa z`z;gEI|m8i`)p_3fAGLT+8$IxV`JJ-nQvG9u{^Nt1+3nwtTJ6X^~&cO!>sc`b=uWg z?)Y>4M%~!uMNxxaUzRjV{d%F%d<@mqe%7L%&S6FjsT@K|UIFeFQ3+Xf$-JVIz;w6% z-dM)fqP>nW*S!c~(|A=y_BOw~n>A~NN|bafAT9x{>Gf3=$#6gb$*mZ>f%p;e7l z)~H3kA^>rxou}935V)-jNp=1t7i5jup)|au8s+bX)F#E4OGUo6GQeDKDZU!D zS2E}Jms|4CtsymDC=7CCP1AVoGUnmGHoG?@Z)Koux;hx_YgYimb(^vAkQtZ!4UZs+ zgIu=yv&#vZe>Veh!(WXXr`5~VV{@^P(H@&et&eXSn_CCFWo&MjaMjpcNcJtn=K7j* zE*eoOR@*FsDY#+!+Cb~ub&+bNUh7G(G2oWg{KE&_fElc&+{Q(|e*Me4BQNsb^We#A zsc^x*(Dc3C$a-Jhn7fAGw=n-&0`$NI=cgCA_~F*If5^x{W!-ezO~Z5{|GkB2t0Jqa zNUe&*xf_ZfnBf*CIdZ#J+2Wo@b}a~CZbm+&%$7_r5rWFc4_S~3J0r@cJ#Hrjap}43 zC`)p;jihn^shB~!O&NRVpV&Wnmd0*l2EJorBUFRPi4)I;l z%{E+%f0f^1-tFIZwrt9Vzi2eP%+vNT+oBm(MDWao=`BYX{I^<~TZslMO!8Kt!3%J9 z?)rUp4pa4iS#Q6ThFAoG{l^(x?wlGs_ePD8A-Ioi$TkVl0@;?WuoiH5pRpKMyd6uh z&<99|(yj5sTeu8m*FymAF&Jx-84Kzl#R9IZf5pDD=o@3v59?tOR3M8>sDyjy&v1F_ z&_U=0LTGJ_`r-Z=wX?N#38&B$*R#qi%oa$?te8P-0QSU{-x^f@&Z}>XS3iDLUS(8r znQCoZ`tjbllYqG2(5As=i<7OoD`c;72x8wJ-1}nNWb&u8{^G`HS*@= zf4|4C4n}(~$@t|VZa-&ET^nB>+#6qVmFk2*wM#7H0#z*If!&q2n?#mNRmNPFo4#kH z-yySpS`V|1_TZzrJAFWnAChO_^1#wh%&B6#%{kj`Irh`NajdCxclYVDUa9M__%?n% zB9S%7)EXq;wJ(<%_Qp@k^@j44?2Soue;@-sUDWm&``H$8dds6;`9z9z4_}Sm^vWNj zT)&s;eqCb^4Nq*87jgknI>jITl!6`=f@UX&D*{-TU3O&UC}azJyb?Mu&Nv2+QFezk zC{O>lZJA=fyDk%u7wO~&xfCvBQKplw`a(69ct&tJ2lPn zi*Bt+dD0)-w2YSjaKYLXKH&fV0Z>Z=1QY-O00;o^wiQ=kNwkHVmH+^9vsDbgmJL9z n6<6nl3H#Fv000(~A)`10@U|6`T%#KS2$OiDBnHx=00000D1iUW diff --git a/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json b/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json index e56519b6806..99659a99bcc 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 8, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Infoblox%20Cloud%20Data%20Connector/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 8, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", From b3569df31057c20d6e26e9ffd21c9d5f583fd1e4 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Thu, 24 Aug 2023 13:14:31 +0530 Subject: [PATCH 44/47] empty fields removed from serialized data of workbook --- .../Package/3.0.0.zip | Bin 41890 -> 41837 bytes .../Package/mainTemplate.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index aab4ed67b923027131af09b2cfe247de9556ea2f..51d2a830578d6155b0483315ed90cca91742e90a 100644 GIT binary patch delta 36915 zcmV)vK$X9u#{%uf0WZDnTc$Sc zybqJY4J!?Z@D@j|6GF8=_YwL?lll!o0R)pg4m<)Mvy*xbHh=Fk&nZGPs~c{W#)2Ch zdD!+zc_@GZ(DRv3y(7}+T<%k@Wp~6Lj`l7Ku?%qUdFX}(qNr9HSe0T}1&K`H#HD3k zs&zm6AULigWHL>)yjI!rqNHqo7R1yHX(t=t8xlu+A~j)O)N=N7Z>|&3PW$Mx+a5 ze^`=;jcM4=oy;vKv zobU*yIy$Sfsu|X}f^|XXt+YfnLwv1Ya5|ozuYA%?in5eb=|I!9Wm_>IwNeyAP%YaP zEY-0DXJ*e#qPeDm-6Evjddfg(ml}0g-A}m&)DL|UCA40~q8bOg8t-WRhj0-`eO&DH zpn~oesekW6IF7bPcs{37TbeNM@}~jyHY~4)yF3u?OwM%-JTqlWa1BWpR0Du-x%v#y z?^+lej%;9c4cz5HaF@H`E-W`h(yA&A{sMQvev*|83cEw8-MP~qr+Vp40q+3!d=+}?#lCryD|*! zb+=nY)PZnka+W0u$G*=mX)-J;d?e)BzbnVJLn05;dQIhs_e+=KpP~2lVwv0>MiJ(^=znR%-O;DZ z3fz5s*K%y7QQi)mbq==IuE3}v(Pmx$U~(E>c@7&sW`1~En{L}0Xldcc5Z>=4e4FLf zku8;Y5Tg0p6D>8Pg=#G>G|5(jV9iV0$H8@+c0b5EWOrnP2L9KmhnTPF5wp05msNpI zS~m3bv9coE!?f&hKsVFm4S!5-uiQ&Cxt(ZzX8<-MnmmYTPqNRyA<-Ip{9Q!bW`F-_ zh}O2PUq|4YdF?HZA^Yl~PgS6kJ`Fv6^r;B<&_`KIA7ulR+bj3dM`@=|-*y24Nh}=0aD6A7LN)Ar*MHL4aQ$&rQ)nb! zVl&ohgIM<@Co48&U4P?LMHlO~IZ^R6tZO?+Q3vA&tUH@~@f_@2ht6DX5ZlUHhcYdz z)59`-Ez9)H{b<+G%P_s2VSNWZHe;ARh+$81m}5hRH4bugF>ISd98bfrwzC^`AP!>K zTfjlb`m9{OhEau<^-SWjJq$9|GRPQiZ+qQd<{0hF={qyB8Gmz(LCkrQb0Hftr*S5v zi#gkz2YDLiv>gMf18@yJ zFXkY=Jjub54f)bIRMN$lZ4Q(?4PV;Mk<{V0hA)3RKkXw-xww-tH64AFDT(%Q##+l6 zYp}8HReMQewSSYwdN9&hgGggNL(*77Nn<@*(pc+BQ}?m}THtstXc1lqk>||mbu2>b zi@zSZ78>!|XyL}RuO zVp`SwXGJyY#5%4u9Bo2xLIRg>kG4azRNh0bs+N9I6@RjQWEya!LK<#yN9BGJb)Bhr zz(W-SPgOk2V->^CRXpQ^6+=!|G#t&EtUJ1eoALH;PSPh$Hyg63tu%Enb&mR$URspj zTm}Ao;yyPoWEy-ZaT$d-K+GsUNW+yMug?MsTJh3L&7rzwQC0+z-VP@$BXZ-B+mdK{ zMO1~mw12r);*=PSDwnYBd}<|vP+YxLuIQ2_3@Y)5poj>2{^O5KXAs2BHNL9<#zF-M zd&N~^mxX80J78Gim2ap@U9Q}Gl?}7C`9RWZ zJ0P(a@6Mn*!_96%B@-5F1JJYZD}MV~;BA_6{2@HmAqe1qo{pLO4d`D-5j($T`^e z;m4;JFG@qhix-!>8Da4?ur)r23BLtU$bZEezu+Qp1NO?dK~naDdOn)WTdx(&=D&Rw zojAGk33J_phNe6B@QlWvJxXAlMgp=5NdO6Gxr%w%7C5@{c;G}NB3WF1MG*A+`|*%i z|5Cae^!Nz9f)5`8f{u?*(612vh~NYrlNn4DBp)ZI(`Y&k_}{K=rwl}Hz;p(LeN=9q z;UfbrjlM^nOz;1k6Mu4n!!N@pn(2MP&i{9RfMAD_bK+#apd{F8{P)o zHLd}SE}CFwf>TLE5jtk2IDl0#=zoimGsgkUb0`F=FoN%wU77G36~Xk(P;SM9jkPpH zi1udul8e8n$Ep@xNai~P)30v`0TR9SV8AKK(vI)eL`zwRof2Fw;eQK)kbZ4Nu<~69 zZa}y^-kf^D^$83y`FK+>D#3Ql9{C`X4MCpE%4V`d*%~)NB_&&R>lU1WhU9R#1j3)_uo)4sX;VHI>&&nwNf90|J0G8(};+0*}&?%L> zL$%WI7EY+Ttzz5J1Vz$qL3IpGFfH2ops;I__U+heCZq~J#Ulk2XTEG6>>Ub`h z9R-TsRU@~tUZN^;M}LW_ch!*$xyu4sv%2)@qS{qUl0~b_bXk=;Rpza=lxdQwc9j{1 zp{He+&})#uhPOvF(_N(9eb1g3L|H5x!^3xAYN^BVU?@#X{d}F7)}d z?yy!rdTugjwUrt|3qk-R#dKgCL`w)BZ8#@X73Cx6zE&e7q8Cta%;(8@A4 z7Zy7#BZG4K-6!A$I!Pe;_I+d%gqKU-fF9V{N`t?)Fcu*72Rg1zA?N!KN`5?ywHF)>XEp$V2PlHkUR!ho&*(K&Hf4!>HS zEA~=Dt_fL!S$_`9q4Z_ien)y$>FHw4Q12R})-`D&W(*u9rPf4D?i(hvg&(`rKOeoW z=(ikh#P!(d!iqLp7y?8Z({nX69jg&o6@=*>?+MR-8IB;}VdR0!ms(Xu>2$ht==<~s^))~-tUw)lCJ_Xa zTLMq$rT4TS;{Em%-K^5}VP`~1HY~-FAjdWgBB+XF36?d}AW*A0EuG9}^lyich*$WVJu>j->BN zzOgRhil?-2%9X>9F=A!h)U2%5&v_c~|`*KPu2I(XuQ>7Zgi# z1Qk1wKC8Mch?YTgAOO)sXA7Wnc$|_O;*qg9iuXy-n1p_!!H)1+m z;(H4(>(nu~I%UeI^yAByFi1^zF2`+@flwJpF*-#)dWm_C01^wKDH0+@|E?0f0;FAw?u zrdfg)2O-@EO73lu%J6KBo(qP3$_D5l{9DO5KWyC)!hP~d@w!oaUA!IwXFPy zqP2p+lF<$5mC6|A(sIaP{|-hW)>-Jcve+0gf8n8nW3pRT@Y`=}@S^|oTq7M=$A9Je zdp~i#4X!uC=^a!ix2+=YP5+D1-0;xy3U441j-lv1fZetgd*#@>KqP=d#iX z7a-+j?;^bT^_La)FTx5B($(Xp%aQa)by1>>`xhmZ5uunRe3GCz!BN8Aqy2`y<-Pin zJ-+`B4jn2-0=Fpz4>OsA1N6q@@3bz$WsHiN@D*w;aFQJb*zL@vsOH~EK!5v(xTS{f zYhtAd#tYEyxB47>zX#J98a1B3WDL0<(P^pt5~QlWCHL}z|AS`oOqA=-`-;?m2?*Ro^zK9&vE?OiCG)v zI;jElF}JW;w#GPa5_@OI`hV->IBRS4txT}{QD^$ix4%!$T9R%jTm{MQ9!+mDsZ1yV zcuE>AVM3o#J>kjKmXS_3oG8}m%ewSMT@rHS)1CY?KTH^!=}vx>@QOcS{}c8P1^Wz? z%#B^Z-CmCR47U|jjT^XM;A-7UPer2aH9&7_Q)~rp zl-WFBUP0&n@}3f_Zqr*#=?K9+sBg2-?DZ8}nN8E=HH*(tdAf&StQNsLoH%?p=a|F^ z+p2&hH;7AH`Li&BiGP^8D$!8TU9etNd{Aswmh%TiX3nxBnDW!*0A3~83ANS2Cea%v z&gE8tM?Xmhl!j#m3;fkvtQHgRDge$pI7p7YEBaQOXE|x{n+P+e2c~zb^hKeP2cD->Fycjt(U<12?T4$wjO2jAYbV*%{LzL-F&f_Pkn_zt|Axm zmifDj*G%Lhe1HAbVXtc*e!V+xo0p1h_p8Wrs{?924`iEJ1Lq87ymrdCiU@Z@&9c>C&z4mReG~ZERDTSxIc` zQj$ugDu0z!zjzp?o)4yDI2>WkY&a^b#lk?ih56Ao!(S6G>(sFy3pNhHEZQrg8 z@NYf~Fb9)zpniYApJmW*VRKY}`4Em^BW#iV)ZOq#zI23Tme5|)k)hj>)=mYXo=?N&Z;>`Nzgj zVSqU{0Cz+T4cv!tiFf=a*mV^{8$FoS*DU9_&4_C(hKAx{b}4B2lBU%3WR!MR-GPLqG5guH>naCcT^d|e)vSH^MQTW?_0&DHN1tM_9Za|;`j zUS`G~c(1WBn6u?>Kz#uvMisd9BX<{b-qspJsj*s=)Y-|boG@jXq@|3eO;()u4whNP zI?L3U(lRrwvKwX#z=lVS5c;nTW(BGS&wt={IOv5iPrrdZD#&shORy`nqpS27rexyG zz@bWo0e<-5WC{j2aK!frEMmQ3{h+q4{E806KZG5xew8mrzxi|!cj-6O${)paX```> z#?jDNwLEq8qzjb${J(O5=fxz;M3A7eRpPsPVPwiTRT zgBae-`x?afTmvsTJhDp;hAV&}92RtSvn8I5>V8pQk1F%0yPL3*C$Q>VM|T;qT%pX) z9*C@0JP^^)f=@+o$>EaAmRtqfI6hx7ug`~k$fBW&sXhGM6BMrOfD>|%Q-28e>T}5H zd%8L4bIRO<70qjlMEk0usPyg3jnbESK~fdZG?A98r-L8j@+trCtdR?-s1xD_HTN5o z$_({mh`8=WTJ=w<$yx7HTStWt*V7|iPkIJ)QtC9T?jf}~l^mlQ$20MOPN>c;fI4TJ z(1%d#a67>5VEpaCD!OyRmVa^n)TM3a3ayg1e8%Tq+5#z+;`T}eD9|{H;bT6EfpBM) zL^OQI=JXw~Rl(22e@W%2yr{!CF!xR7v>M$G|9u-rNhqXop$b?Bg*plqD4u*>1@bPB zvAn!$pew9gpD~utxz-Ei(~B`#cILBW7giQ?r_(Pc+_iAm!d=U{Yk%nn+q{8^@m>6_ zYpiW3jb)ja;}F3zFPp`68=WLigKOsNNJDD6?+IzZ&wNd zRiUEK{crvFu6Q>@-DVeX^D!(0b=$FoQ#zGkmvl7_u0{By+fl?ZH`s~V>)~wzFczyK z_7a@8b%#L)YcaZu$$ub@;EIMo^5d0B(3mj0z7h9(_Z;8lF6wt_Q&505vPxdxlYTrR zJnAf*^acHUndv^hC7qy8f?gu340=7aT4*y}x}pv$n`ko(%rhQnpk}z_<9}AgfYNb> zF>I+DTWH}WQCC1+VLo&P?P0(6qMj(=7fwpzq)c#QpVv1jPJgkB)?3<(jV`gAbhjrv zGZ%Pj7XwetdElu{v(nYv)~b~w(+y?ScX90Sv|Ewo2zG6qnxgV3euxwKkfGTP>>bIvgJFnrQ3HC!m)0_?EQE6%!=0ePU8! zU1MbG^na^aiA;?K?;mLJqQN_MD`@bd!CR{ZG;B{N2vt{u9oSKoz z!#1}XGcvP~&i;mSjayV6SD0!L1TPeQ22)U?U~cQKFXVm(@i>u-UYhG#RWC@1N?f{H zhPA{frF6mLqNYo$2)PFh;Mue(w7a`or{x`eg)|GEGPvPNa z!VO&_Ev+ySCjBj~DIo#<7yT(3v4^T}Z-;P=k93Douh)(5`s|`NP}xauEP%?33g!qVfQG zCV!cXt~&w~kgOIa8^j@947>SBeqJ@lfB$zcHIH-0FDYlr31yq)+0ygw=HAY3_j&tb zbF0(de)jBn`}xLhw@o?zax>iS?5u~p0;g6|(o3==dru|1%OyVV6Yy=6d$QEK#6*-8J1{#Fd{GXUs!7(X8|rK7Wyfra#z}@QTmi$1`3z{j0_AZE#ZMZ-se2 z2|Ks2aS-+_3}%%!R#`cSM^<^cZu(Pth4U}uQ_zy+3yjHG#R-cvZ?QVOYmGCh8 z=@aJxT^n4HYVa&1$IKZ60!s@SpZ{x98_d61eh+qbcelce-S)=%)_Qw;b0cgAyMOCJ zdpEdzez_f7Ze2cqUW4Bi)nCW+f{8NIz{2-8l$oOw_H_MBIi-q)7Vw1C(G7dB{foJ6 zGP+3K7n3itk1nF_!Co##H2BN8eKc%O_EK?0ZvO%*AtU(bY(YBhHe(aDB z&X63k34PchC(~^qpZmJp+<9K>5PwrVy~u`Hoe8!y1T*h+F1kCNt?l;Kv-Pd^_TJV` zI|#Ne+M86SuWxT{tamm#HJCZQ&R5`K_`U(|g;6vzu!EaGc}iBkWu|#ZRtY|kK1bKw zh782Z^aofu)r{3BL$w-}`7N^yQaN|4v-|8~yR+Ng>s(UK?L6CQ?>!5H_J8(8C)nHS zhT-P(-5Q)LPD0X)uzE4fet%F#&M~J#bcrjK-xxao;?g3^H_P&V zEUerpE^x2nPo5y(&anm|qe`8fm9%a4@imJtb!Ok|(@0mQn$nn84wa>$w@j5m5U#U_ zS1ekoaDKM6{(SRUcfB3#b$`P4_U=ZPT8HZw?aT0aryFcM>um4sR#*_-_(MGUbld+I zHFtlHx?MOzoq(s+`zWUF`Br*~!pD}$|CP6BYTlc`0227VWntg9V0;K%8n`sHO9R6{ z=)ymY6ZN6afoZEzORfy7}_h@6g5#=Tay`=24$q-+o3;w4vDG4Fx_<#gaSO&R*kcQ(<6C<0#CIBAsn)D4?z?%`a(Doxj4{R!ae9^2 z@T00i&?$DMQB3>f)F6Cz#VQ?LPwNFt;Thj! z^5!na`#3XrZP7qQ1GPfyucOwYf$G-^8mMTX)@lI_R5Vc0K(&hiG*ICSG*Hn%ZO}mF z;Y9omRP9p>L_D7+;<-D=lqK&~`$N{^LV3u?t9e??`Z#P(#=ScCgmogiIb=n&@F=6X zt%(yVdBrhcv)ZX6*XPdZHd__Sr+4Jq%3B5qP>%cVBShSHCkI$wb9b8b##04YK7~yI zMx(sB<>LzE2f6`c9K{Zb9S`DW?)hMuAbe67d0+f=yti2}TZ}h0Cm{RrJ|?SlbUl+q zFfo4u^)0M4FrCH8!$QJ(Pu@($XMbouqWS2g5Tg0$X9b}7=*7QiKH6JA^AXKQG#~9E z0L@4E0?o(AXg<1tc$>_}aR9q(T`=;v)Ki0`F(A7|XLQ8oegnjy>r>b~iWn+B?rW>+S8W zaH}0`t?#yjXB)d)d+QhLJ0arzJ|N!jY;6|v&GLRMtlZfva4-L*0lr;G9Rb09$7FjU znZvE!i_TVOvwg9*L)C?6d!6?4-MxQ{_Or|2^4asw=0<1x`I#B)x6#Gp2(deD3u?L! zQM0p?G2`)n!C!?66`_w;vz@D-(W}{+ve4x(HPRQqTzKkUY<%uVl<~;X4P8sXRO0!S zgLv8AswG_-T=%WB%EudJU#fCuw#m-Sz>oj>UMyNzz<&?(OR#vT4+TDoXBmGR{D^4W zI$CF%XC~!$jQ-CPITM_xPfnq2-zO>j6q!3>svf440$Ob4l@%kKJ>2~f6qk=&TowmC ze?vwZLBsHdY69n-UIc7;)~vLBy+PjeyF3USD^+$Hw&q?A&z5xKo|QHnZs&ZRQU6=B zA}&9-DCbblJ&>F$2`Zg8(=L9pos>jfS?P0GtOQs&K)$vXfmsI}C=+sH8=XL(#doqH}F+ZiHvY z7EOi)XUnb>K@eK9OsgZjIU#FNc-jQtObgG>B;)1S1f&Cpp|D(BVOj21PWpd|6F}j4 zg$4{VRb*6sxV6RIKD?};-0)XI+r6Uy;7lp&Mw#a(uNFz>RVj&0$Ui&Fp%8rRLh!Y` z6=N5J>J6LPVvx0$vZAaKrJtMRdIZvM78$x)y;+PP^!&2(joTqUBH?{`1KcJ)2VPXM=-L!Rh`!Ma`+i8!V7&zIw`@R}r6t^}!Fa0e^`9 z7^NsWQFP9Z=sc0(+7xlQStTxu7Ududuy%Aj#{%;r7z)*BOsTP@lNz}p%Ede`%77Hp zMS*C^U8g;B!B?p%S^&(21yCl-2Y)dAFM4tRs->|6;lD15GD}R+}RwS>& zRMSiPnXhu^s{T)gvs@apAiqt3h|abNYCsC|)3PdV(md`LSHoa%Ey(xRo|W+{>%9*F zy4VmT?L#B$E)EiLL!ixLU_JhHGTzv-F7xoFo`=i#t3E2X5onqI?af6ve9KDmB6Pop ze{DQ#LD!VJG7yVy*okfezDAO6laT3WbTyu3$cHzc3(;?VJQ*z1`%n80}>Wm0=sc;hcnx9AO0Z6GlZi3C~ zU3kShDRJQV?7V|{R5HV6!hiXYNf;sXGS_7$>I!+~29sq~_LV|jDeSYnIT>Hbt;q7S z3sqMj-JY`S>aO%v11nvhlYlr{e-qkbK*GQIF`(w*Y5e9#he3s=fS(iIeNv1>jdNJq zesXUqnu(gBhMH8HalNHA{<-KrVD&KpE?Q>Q?yUcZbdNgvhqv^tlp=C|60_KeZw7Hf z4ffYT!JK2O?NpwCsF!2>iA|ZNp#k~Y%7wJqVJ2zLgWnPzDCh*7u%m8qe+XG#$?SvPm3ut+rT~wVpv?`7(e*XOFZ}_ErV!1*fE)bCQvqmlt&>BR^Q13~|A0)uLf2JvQ*?|0pg##XUzPW?N%$5=G{c$fIv86${mB8p1U+ z(`%?=cFFQGW$u+Ut6U~I*40%m3*^qH;0ePNkEaYOuhxQq9L}dxzBa?84FlUHsIg9^ z)(h&V?&K+C0rWLzLmP#{@8Y{Pn3h5f7nuX2P{CeF`E@@d+bNW-e?HlAJEtn}iS;6B zLH%<(#$tlG`W!3&7oKWaB^mBh6W*uPNzL8F5?`r16Z|Q!8ma}W)jB0(>j)Uho3wMr_t#v%e!Oh*JVcguOy}4TtYt+i|lm-{bqAUJ*O7?p6|f5k_0_~LZVP#lxV95iq~cRFdnBL)<*4<=;wZ(y~w8kGmv8zisq z(`7MtvS<)lt|z)4`lk46d6P8-apMNP%k97v#WG*hYlefFuSUhQ(bSaUFy(6k9H)Fe z73a}~vY-3k`te=AP=0hf{P%4fC86dp(f6E8G6>gBrM$s#VVP5q= zAjMAsY@r}t`Zc^6jP74GB#(>QbBU!UqdqeUn>eY@s72$h@X)(L8U-N7CYj63c&Je3 zoLsDdeBgnTPCN|LgNV3)8Fj;cCv0iMed(@_U@KAmVFX1uf>)X+Y2_m^+ z&8hQJ;Y?P=gGX$zz6@@ixdaFp>uK+}O{6z?CL2q^QSDXnxUE=U8oMR6DNDe=o zkbi&~vi2!V29!@i@)vUW`@u1J7Y0d~WSwF*mU4yzQ99!R>4~ENW|PprM=`mlMod)$ z>_{bTg55P)6(*c8!8LqnJC7NWFSpemE`7^9n4K&;5uJDcTX++ayfk zi5s;QfxZ>twaH|cRnQc*t2)BUQb+4db4j%ca27uI=W^~#dw|P*Q@)*#4|81Pu30^- zEi9zsY3e~;P)P4}h^UZL=X(P>(ID!7YlQjd0};};mFRR*J3GS`4?fdne_kM2Sp@dQ z4Tdc=x0exqi|!`40&A_2b*JIIxm$eVj)8fdar`sURa{(73uC4iS7+=;LSw9)0yoXc za%oIk^IL6*;yqPPp9YGzd1e=CDU1#Jtd0}nK0grWH--CLp3H?}_Hki?)!{*;;D=%L z=8%F*v$+^x!G)FaP{6Wke~=(b(x-#C8>;Ioe@|KZ0D#Ixg_@;VJufqBnYjo_s~tM+ zmDoq%5D|hNd`InfZ}v~#v=2VL**|?#Q|x~T?^IXU{PG?e)irmaNq9m^Ts2c$iQf`( z_i7Y+O_s&k+|jW(3SJyZKWR;Bn(mEkI%$=+y`ISE$>W9Do^gi%e|&scf6w?l=(3j8 z-Y)_xt30F>5lX(Jr#fCAo)(>Nc_7((V#2vG8^8 zHVwAfmcA7P2T>VxHAy)74x&O}Fl98|!?r=m5*@dk+zw5TofjH-pi1F`BMr)G?Z_QyUmf z7o+Lc+pdf}h|zT6mpx}0hS7BAESj!V>KRe$y{S#dyI0l<%#n2SS1(|VdtKas8zBBS zH?$Wxf1VdxESQ<8IgztB)8M|6%b3`qQ}k?OeRuC-qaEx$@3yyh*LT``+uQ5yz4gt@ zz30z1cQ>}TSOre4;ZoXGpfaj7GmLx_~(lke*wJg`zo5uug@U020saVDPwU>1qq{P zzt_uT4`Agi2|h}th`0#X;;eBPzy+xnZ1ZNuCHs@m^anHCImKs?h5m8CjxFF{w0vdG zLrRTXPX4}w<>VQ;%1~{-?(J@;=Bv1rmUUYl8MfA$yPN$qhl;Gcn~uu2Qg*ifRW{M z6ys4v#bHeDIE7#Tm?W+d9R3I_AOo_Ie+JuUCc%#0vZ)4x6b!2Lh>HJtKuy4_cz91P zMXrDvr~ygB5s5E}sFQSfE@6g{;cYKW$mlv4r9ek~W1*(xWyo$-_Tt+vxrNtHqnO&D zBQQI`Ugph^WDs`XG7>;0g~L8=O*FMiUb8p6v=s)V)Pb$)N*HsktQ^0rl#t}Me{)TO zgzSTk0Y>v{z$GVlQLjfXLNW@zg?*@ObR7yZXyvjkbs+W!gI?6({nL&`gPlGqb^4T& zr&7Sy3A?SuKAr$ubwaYde{iw_X8d=$eN*~6)J&9&4{Zin6$!bJ14;WH4doo(!yqNM z7xLpO`J7Psrxum{Z^0DMa(y-ge~AS88UQddyO<>#xVsMFmJQ2(7f^lyQrLvhvb19M znbFGTA?-dLJDQDvNlqK1bVZj+9W#qrNN!@7)Qk9bluol?kNA>~cSIZcB2O#GVcfaBksA;>f2IN}=zU$j z9*qXci?y|G+(}j=k$08Km9=h^40^%+njnVrhhUF2u?|;O3vxsp2XAtr=nFVMaoIAx z^R#@v>XS7AJ6|YMzQe1QIoLlvXN3yT@Rlt4%Jz?sZI#I^#=Cud#9XMbLilag zmd-|CMXCwQ=A?RtR#uJ0km@M7BBrz=)Mdbr zZLMRhwbgXXFKg+cRgr7+uhjM-raeA@oa-1E;+TL${XI5e-o;^!*sONTM6(b z6%b(8y%y*9)t3^=7YIDu{wC+V`i6sks%( zMzs^d5nHXXXie>HX;FZ>$jSDmDk+7a{Av@$u2NVdc_*rFe^u%5^Qv*tKB2}XDnX5_ z(Y?&J%u(Z-)G@?38dpIepvHw77iwG!r*T!OGHyy&zRv6>g|z~W($*>nZ|wt}*Xh2Y zcgSw%58j&9zMfz1>|AbKUbZivJ=>t#*Un{oZ!>t_-l2b7Zf|bxY;-y`v@hNvkXpJ| zIO<04pnGMPe_@zOE=x47j!A>RMKsDuagTS>h2(~&({{?7n)qrx8_zcPyf>h!Ye>0Q zGP_le&8nWBHEaMicfp_scTynyHB10`spwQ9D)ujYLLpz+@0N2xm~4?}ZH=-*zYF(Z zKrE81B*?axgo@>G7{QhvF3*^X_vDYln*aI4py_FHe^x4dM%50&4{fO7hvX0PeNn08 ziaO3f1B`T+iU-c=aL0#@J6x7J?#29t65-K(Siwac^n4?k*#^(Smg#V;tQ5yJ*Vzi) zTa7Ny0^~nHbospIXpBoGEjRIQjb+ZZ z=BEApe~Bh?KzF}yF!zB})FOWWjgd&`RvF*HlwaNs*`>bjknU97_>O1d#)`N(3EEVu zpRpFA{$;G!rnVN*&EJR|@Dsk$u2#==lohs~TVd%b7L*XPJ-G!HGTWM&U+J}Ly*S`G z)4I~!(iCnztg$}M3rmBQ_kck?x6MI4rE>i?e;ap|=sMv&ceC)Gxr2??*|^a>Te_1G z?a_e!e8b(apTZGGYpMqTwxF3tnNc&KJxcn5#`ok8zA*SpeygA_bQlDF_B`M1dB4-a ztr~9e7_Ru=?=udP@d4zgVlEh^2M!A9A4-577@9%}$la5_HX?Kp6FFs*+dPxS3pVgT zf3G(!PY6wKwZFD}cHNfju69356`F^7Klq+5wm@*!xI224{xHdBimkE+VU6~b7bARO zdAwBgtERYp8JdM#xm(GVqDyX2ihg@e~teOeB-ZWz-jH#)80I-=67)*G8uA`nfBnKS*$CJj;XOHN_InY)zR6LRW+{<>C7_I zRjt+utdN{M%DK4aOU281vQWjdRE{bhs(1^a;z3WHoYwLz)ee&WZ2LhqM5|P`e|b3I ze;faCR=TWMd~WjkUc!_)x#bI&5>F)b)S1?izEh}nvsf?Q&ssQ*%>59m>ROg8fJ(1X z=}rA=&Z=v179LVvO=)4m%nb@K6@J;a_SkM+nK!W9_Msa$HvwO~ca_%Ub@l4#I2W+a z=kiry&!{QU7jfA;N!I#zu9Uree^Ludck3!A2uzo)qQQAbUeBCU4|A@cTVhZckbQ zs6(a z=w_-rGkHp~V*zKUlyMdx(mPcqs#4YCLzovdc!vsgJ=FD3*IPJU&*Ki&!>WJPQrU7Z z3O0e`bYOgX;EUcT$UIxBf1)QjQ-X38JWy1W(@!UW96yqOrW*I6eFq-4x*V6(jD?N#{De;Q`Skg4k6wy1u<&&|&Z8_Ohk~D5Dkf{iQ9d zO4exo7i%{G-Dihuyh^tDz>ll^#=%dz+4q-P|M&kz3Q20>OE1V0e^tP>S@^DZ)P+1> zzSE(GQ{rU#NxH#(3T2ijD_^x$bi^=26>?~niur!#zxY|G=#OH4W?evy=|HW1%=Y1< z@;zkYH^$qwxmAAljnj*kXY;-6G)2=S3+^UY! zlan+QgdY6u4_Wo!!~2&8=KY2A;;Wdh80P(X8Hrry@a<~y{puH@ z)cTSxBM$P%>@yfDCMp8(#UxSk3o`&fr%DdP0Tp#&AD{$Zf1cb^e!f}#cmdk%m#;jV z@DWjEr8=*es-v6WDoiAyntX!$UsBdzUH^qJbu;a?KyQSYg(Pj5W)ds?Q%L`ezEgF6 zbZr_bw)}n}GQjG~UnElFkd=5%OZ;3_r$D!OC^yk1qhEh16ByPVH@eGZ&t>5QnZsDe zH)=LRaoH!Ee;Cn`C>E5l4K6?QEUJ)j5_67rcC{jgr?HKKophaQLjW1`__Y)DX%7P*mpsUbtF`yUPsbkP;Y4tQv;e=oWWn*Bwl{3<$#Z*Jngl-^YH z(>KTpO1?c55>C@^NV>j5a-=AgJ;3dUs+4pjEz579Pxtj#%^ViLD(>j&N2R>le=6-d z->B67d&QEMdH$&vI_Z)XzZZm#Ed4=l+Pb3fqoJHtMyO@PM4d3LOrduRHXL2fI-**Z z{d6h@^dfw-LV>9!Zj>Q4q?2WBik8cTqDEH$>$L^6`wGE2T7 z7pTd{eqIbNeF^1#nsmKoR2*x!wu=RK3vR*P-5r95#@*fB3U>+a?(S~EEf5@nB*EPs z0-Rp!J>%QwJA3aRcbD`S-St$@am{&GKQ&7s-H^oM-EW&;P2H4>wjW?%x-JoaNxk{8 zg12a@V>Af^O#4`}^pSnv>4=v%HC4)3@BZC(vJ z<@gg_y#?>`*JQ1Y&XUdab?Toy)jTN(b>iRB4N%?=Jn)(}lit&6?CTr_4~SZ&4;nxI z{!JS@&N(fz_n}X(6P6FCWY19*`(h$3A#$y|q^6U-&odz`=RM`lwkJ>2^tLYowzGJ~Iz9LIlaGlt-~ z4aev96MaLyOKxxX_t-@9gJngfl%<`3RwB_4bfcX}FIUD{I6hiHwgKNzUVA;1q^r}N zq1k3|Z@hOYvQD$zAV!iP>rSDay!1A<&;KRo@HeZ~rD~Og?Ww~S>(pmCE#g)8sX(z`!}_}9g4|e(}*pQZ&SA=nLU(*{k#5V%mFO>cRE#W zp1po@^Ti4SlwAf_I#s`wOQzxTx2j_U9?$xBDwK_+dSeeMksV(!&KM@V&0a#iZt154 z4f^4=A%9Ij7v>6ZvpGhPzjpsN=5X`ty6WaTVdIk9b};V)B#9U~j>daXpY0ZBigw_W zPE>e%tE#83`x`kntnl>p!-f)~EAI#enn>~t;GPT7rIhwg=h;tm#H9xgaZA?b-#l$r zpy<|~!=Yj+EE}xuar2PNuuda;%=8zm>4a+8xu#uGYlex?>hX}7;uK3;`}%C)hzy|I zV$GO{H)s6;ixO*XL*3O*i#TJ{_OyxG&nX2Sdd#PjsshO0SPaknec6)oz?yBINvzZd^$@0({){T!RGX3w})U+ZpEBqLFY}4rAlnYgxTgY3=!@q>Bx$^ql+M1QvqM@ z$Bk8x!MGjY$`_;a3t?m#bs^UF)VNYF<`hz+r_zA#d4SBJ+aX5fOlK9f5TH7MSZX6{!gM+l!awF z6S9=UpL00-ZGYab{pag|`Ulw1&m{t|=%qf+f6s!mw5!DbDwyWQoMvu)DCs~FarP~q z#hF(5*e@Q@?&MV-Vdo@idhb&W#~0_@$B-L70+@b7sf{vmSxh^;cVG6&F-klYrRS+y z%L(UjFAot@{ov!!`b3g^uuQ$Ym~eRKdiTs%`&4xBqhohWFsJ1Of@|0339@(6calll z#rbbg_92?x8Y#SI-IFS7cMVcP);YK?Tygu;7q%&}#qGWOHZVOXPlPudW>)Cb9&Yn_rQd_&KfCF5q2cf|w@&1KfAZ8L3E<6S9!vc_?t@Io!ioj`06}6{XF%-g zd-%(AmAX%l&s;(5mJDgLr&I56-=CI;#fOh{aH{hu&|pTfR%mB`Z!td~!!aSE5y+GC z;){zbO#hON)|>O3aJWY_HKnZ=uIR;gl9wHS@WgmGyl|sUe?d28HZgML=TLaiZ2jZl zr2weE3YbSE6DL^N-4cZMFJPR~Fjh&Bng^Ir7Vt^ffn|lW0SN%{V7N~h!7X#HvVXW&I%yYb4G*ap< zC52n=qV~jscDAYDU(&bS;B(+Z_|G}OzvAwyJIZu#DJb4@<|Ak$nVoAW1(|OUq4<1C z^&;gbILQnx9$3ZWCun(^ohx{cj1O-lLK!h%4J|H=GL5>*K`k}#<|md1_JsDb7(02D zBJADx6$XyJX?}2>Dy$AN|H)h<+0;-M?xL*yB<0KnA7tpk?)Fn(am)5FNz`3VwCAs+ zxBZ8*-wmI~Sjn%bwwj|H!st42hLNv7LnH0W&zf9+FVYoLuJFK}9Z_KnW`=cRqqW{< zhV|oAm3M%SNT9x)3q46p1J<yq(AbF-h#2cuw|6{Y-KNoA z3F~q$b07f0jcm6xRyTzrV(%EQ2&PY1(Nj*rZ!jm`!(PInYRZEC@TJ#zO$upxM5KeL z&*;=!5|5YfBmsW?z-^FDcK$9KjSreuTJ9hLIR1rb|Be5PAYk{P$2ZWW$E6AFYu9VX zZ&W}M0Xh1TvEmJSK?2sV@6sp$maccztnAuW<1Z3pT84ZkDm5a^h1dp;k$jT`8lj)! zXD`0KtV}n*(LiBX4d`b)v$V`xwm%%OV?l$K$a}7qexn6tjU{uZUBZ|6Lpv@4r-B9R z#xm8D9i7Ct)Bxj^aPU9FYY%B;a}xj$Zyh|mO;poP;^?Ucw)T**t6{J6a5Xf+O%(9( z*#8-x=MZxjVU`C^4oU0h@HbxwYCpo?_ucl+_9sR+iQU8=NVbWLHS2{NUo-+#H&C;_ z)Q0dlYRXO?+8*_z0_!x$#mRbuIuPYULLEf&0LtF&;bokg5$W94$z4%(gUIMh*n=}q zR}YO*Ph>f|Tnq%S*>k-Clu^^t^5mwv%&j7k`aox^~On*-| z)IX*5m3GjpsV9ar&zJ7lo-V%~Jx9<|hSN>Fmga{cY_#Qx@F57v;MM7>XJ zk&mOIT+d&Z{zl*KbnoGatM^Mzru>|O$wkfg2~*E@HK0A= zFUd1i|FlxvF3)vrozx*3#)|7N*}cep{u9gJ(7#a~p?<{pjO!@W8l|C2wX(&0E=;`ZII<%_TlR8qFU;b)XK0!C}bL z`7hI<)Nk>+2%3Zq-^ZE;yoo^{v?(F;y^kZl6;1+j-Z}6x!+#$UuOPqddDPFi1QfH( zbaMM4@k?hr$2P$!Om6&ryV^~88~IedD?ao=Q*NI)6%sIr%sCjDKD3jwo}ISW@zM)N zUEuS~pl5q>A)N_3QH8OR7Xp%~Kib}(i^C$zPl-d!eU0(dSt{p_HUyj-eL))|!qB zFtr!&cNXqMTRMG?yYp>_OHDX7KEPvq=-6C0MJ9sv82MILMJzTw|RLcDk`?a<48PAkIcWo_FJq4!=PT{R|Hd^QVi>7Q^Q5jd|T$ee$*4zHCb`*qcnU^1}69S-ui-rjJn89hh21!#d7o{O1R_a!@!wP0h&^`w!rhB+X(*Q z7r|dzKPdg2Mn`Ai%BLfQd0%C22jccZ7?_7f{hXL-Qg-+@rM^w+Xv_qqM)nbEq z(!~b$caBcJbGk7}wsl)t*yQF*{b=F8yRL`{*B4HZW0YASgAG{vK7V6ExTqW=i}HC; zqrlEdtv@0qeIfryprBq-BeolI1iI#DLai6qMsa&rEVy^M$F=Rix}BhX#7!!A5lUt< zpauv^;6hH3p>+^SMNfW(rY1g%2w#11pnc+pP(~viprwnRpcDLp)~D*6Swm%#(=?7- zDr0W1^bN7IyKIwMlnE=p#fN!@4k-mLPgZD=lkwl_ZYrOrFqNoxG07PP6MM`$G2-S5)8voMNW-FPTi#`0rG^NQC zqqTtAVQ<%)NkfK{T-zbvEJUN?K{zbKjc02MV|x3-+eLhDOjZ6_U5}0znWZufD`{_G z2&XIW@hiH=X-We~o2{af#vn6fTV`VJ?`OZ6gLUQ4NGyhasz*%w!3R`CYF#xVR z<@4 zp39Q23~^MGXRY6i@v`jRM((QSYuR3fD925FRxUUc)X3kJUOYtwpmd;Au;C}8mN!BzX1+-T8w_Uz6=NsTM zs&+q6n|zFoeUnTgHYP$E>a|IW6%@-TWSSDl$IalQR(>NF*%U$n0-FPqh%O0TJ->}g zPRK%adF)D2g@8U)f4n8xSB`(DimGPJaoY}(@sOKqoQf?mhiVA;wxXlTH9ZbHKxfHw z8fLBGsuYsG-gChD1HiML;L4pi2VZk*^pe~|wh6kCpWxA95Ws<`=C$Ye!M{5thu4I> z+2M**4jI(4<7+JXpx9xp7!3aVuS6Y^%W_|UDYNERiBPz!lE?PMyWPSWbYv8?1ij-)2@AH?WGGv@E09LT_0M zB^s099oG@&FVZSfo?&N*d7}I`QVl0i#uR=Jd674g9Psus^hKYLAB*;^Bco8Imz6w z1-};lHfsP9u4x5VbepxuME8%rq=??EcWFpwqc`S#M_^}j%q!LX;{XK@Imi*ZQpU{G zJ;Wmn1ua*jkBE-t2BQaof2Ab>l&#{eW7m4cHb0Kd&D)-G0^L_|bo>ZuV&Vpu6s&0A zGfXMeY?s98-dIXb2r~vte5<97`7p5QAu;&&Ux`IFy1!RS!k(AC_)A9jfEWEq&3s3_azRUyIJi{G?4^U*+~z0gFqe9w>`h z=@iJt(L>{uPt)!&KO%|LDD8H`+(}}B{!vEkFN3jRdFx!b_7?%d_1)V)S~UZ4plg!9 zng~ESuMtDuIp1#y7eA4%_!nzUb4`cLmSADM(LX^U%Iea;W|@1)pbg5Hh%So~r$N{6 zb2^R=KRu+Y%TC{N&y1_;x^p%>c2Z4zQ*}%YIGSo4WK;EEEB}Dn&1sw-+E-paE{UAR z#XwaS`KWKnO{VgaNb{tCDwy>eJIv+@AD(~~$?3me^}}A=)>nQ|IT@Cm;<_E2ZKkJh zAf+>x(9nHm9oapnCrZ4RnMYvxA%#W0Npmsbl~{M9?6*vtX*+`ZcKuO0@Xx&33sCb; z3E2H@L3K$b+MyG2;E#lR_~QwT!S-}z%moIT@%|1nW3;sR04hKvr*3npgLHH8tf2u) zVtdR5$J$+2bB@A?gvUORXH~XDz$kX)#Pr$y%N61d^K1y8C}PlP)&l&~FW_*)x+AfZS6aOw8zULmw&r#>laP zyR@PAzW4Kp0Mzuhb2+p&$F}P)p(!YG#LG_&38=$xi*sk|duX9$e`tq|p=Sg@=DYLf zld#`lg4ceB1>u>uk>5KyGF#cEl$9$V?Pp+6{*H7x&J3p}$qC6D2{0+TGRlumA{QJz z{3a@yuAnuK=0@wKp9HB?u+<-EofcY?n=5D<^|5M~sRo+C@(h=c;gkN9a_5>qJ|ZI5 zsN8T&s@FM>2<+cq$jI2TP>Df+5PaECa;O4=QKxnAvB>@USV8MG(Gey4o%l@2qFrV! ziiOUo@&{YNtuoGrGmf^r1rj^rcy>zof!zlqo*hO*TO*=Lc(< z24PwW6!dONO|+T}iAjcUeSMi4es$JiWP*{2Wbt~P6(7iA-cT`0S3}kYPv4D19{-yx zC;YIrrD|?}>AOFQ)sF+)E`OOOqlK(dS%Fvf4(qN?R2G@ZS@Y$2ry10gf3DHFnYaex zNiiP~fVIT_QypxZkF#&p^)N4VNVa(-pT4xKM8nP8Ik)F2xjDj{Mb|pu9pHYEJ?Kz( zyekR?dM{#Tv}?OoPydAku%Zj2R_MdbOr46MIbFER9#CwH=Wh<}SZ)q}O3NfSr>W>@ znTky)#%QHHAE6TRxbE##ayV3CE2;rLhv_OSS?6=0r;4S}I3&4!!=K9>_|Qs%Q*k_2 zoYI7gZ{v1cGv&gm^~DatP+=f0VkbE`7) z&K@agPAlo;Bp7XXih1CVm%(bzK#WU?E2F?M;sv4FwhrvtGsc-;s_4JvySOxgMCd9j zY7UFEKP@j|?cr+89t{sM>n@6)4-YX^Nxh==E7$E3Io*=9)%5pF<@nai=iyM}N$}RX z|4eGz${<4ArHWet6yvYcmk+EyOv(=l%%le7YqpI>h*~Fx|B{HDSH31;-eFk(n~mV% z4AgkGb!s-Ey%o`}bZ&Pvy z;bLMxqGt(YojicovK0Q>JEsuHHL&>$^bbB;4ZtkdUus4vBn%So?X+Of#xl5ikN`OO_EzliL6D_YLU{qGa17+>gD`i#oJ}`A)r97eJTJg z@m1jT5u($^wlZMJI$&D+HJU@jXsMn%*TB}M7n_S@D^*5F*&w8z-L`ks&97nqMrHc> zc>Zl|{(iE_k6XX0tP-K6r>JFmuh>WE=*7kb^Sh-tvGtA3Zpv=3dSky&%jD76+vJ?D z>Cj3n@R;R1SdZW9eXZK7)6%E07_$XyKqK6w8P$~ywcKdGe@EWOpR)^Ends$r>p800 zqmZ59(aUvg@9L*^^Oe$ae_gsdKIy23{kYd!@HAh&61KAD$vE|eZ>C!0LXpt$Ve3TL zZ!@C)#jYl_{^im=U;lFE?@8ZJpCz6dhq(F&UHLBi<-HN_-UFkl!&>8ygrgGy&R(gO z>@q}(i3IhRxQBPSzaX5sg?o?@%QfA9sadxf{&?!ks=l808EhfDm*FP3x9v97i#k(4 zmWoA#7>rOP5JrwgD3d34O%}5Kgh6w<-F#1?v}vBIVdQT_mNXJKgizoy?-WO zd+_~B;&5kfQ?#MM4{kpB1ueT*Y5K%;u=4Z$Z?_5uaRVEct0UL=@VRNeR|`H{qVI|U zZizjA&AsoAfVv!}R<9r&f2!M?uUTFPZrQqT>p$nO0h0G;rXJvK59t59cVeh%Flbpu zJn3lVU*fC$Q{6O@=(;s*o`%+xg=J%6|8 ze+eS!-0r$=zx+$lp;Pug7qFWxiGDaBQe>7wiv@0zoLH{V z++tFby1Y_2IqgzesLArMTzGk*Zu89zWsh8n&N|wmmLr_`^_rpn#(y==!BNombxHlG zI-OAEsQYoISz62Fgh|+GN$N+MaLw5Q2;AYp1CC7>$Bkl@f=GkRju2KN<7W3p*c~HO$t*y`8==3{fw%Xj6pJ~W%b>%4dl;$>L-Yi6<%t> zRb9J=wiWqPW{E3W?|JgE%_=A5)Y9KMAmDGnyOCjsid!mx%>nX^A)W~!QumPGZB&;; zil;zopHM*M^nXK6FSJ(|V@6sJ;Qgn)O!ZMxW)0|7B6@tX%Zu69Tw^9Zv#J_%kT4## z>y$kIWHbw>azmf6rc+H(NW(sz%6|D2zYR6o${Je_pT#<3hN+aPm>_vMS^TGN_gh`H z+|D1C&IiDf%V3^5$5VmB0F!hqx&V3OyhU1;Jtv{0U-M_v$Z3|VYPCPF$__KQebB^u z$Noab#+7{Cr(ajeUPsUe-{f$(tH}d{_XH)d+d}25FzCsdPVg)y1e$^sx;}X$r|uFJ ziczl@Lm{WCGpHw-2Yoc9OkMH(1gCp1Dwi{3!kumiFBeahJCe+}kaIHNDpQkM| z!#Nbrewq)EdGb|*Thytsm3-moO8(=(4p_Rh3-}JaN)Z7=FS*HmzkdpMLBiTxkmeHk z`MvkO*0cUy?xqgz14gl~s?xo)u=~159nCS^8b#}RH z_nzP9-;9|x$jnQPEA9lbPndXe=+S*Vb%Q*AHGHg4;4!I(x(mfVY2-CdNAB9dDPylnzXvk_@j^JuMcag{ct}z zu}kmds=mK+$2!7IF;r7<;Pfg#8*&+_m;Q3QV26K+Zu$v3L_c1c!jszly?;?(8pF}M z$%PQ6#QD5po%p%{J5Z%Gc94Wwq8w0i5XfacJq}jGBH>Ro7l_3?3=;mBTB$06$yoAG z>2uDU`Iclqbg^AsQG71YeRik6>S?6F;(Mhp9q#a3PLA$Egs|bu{)0RfuoRGN;gWV^ z9knfeOEs3i25$QHK{70rFj=82l6WaeXd0yGrZYx~&^mF=Y06b=!-YlFE)V#WcQUq2 z@@J8$KeQg<@3D4uRqekh7Z9Rt#a1){66JQBJ5-XO;-?H~EH_qH0HNoi6k3vpACGD+CzHgSgl*R+ipAQNL6&}SN>?Icz`TQN|0MHF z*0_LQz|eX`jMP-LDa+WX4req=@MP8GkRqXT-0&LCUMh<%fjjD00G5=N-ARPVG>(0x7pYp5W2-u77tD`Et(IP7&&a z5GmNCsN?d!&JYbJ=&QXaOZ^omEA6rxt~D_9%0E$Bj1nfl9o*3ELS`HzgWQIud{ESv z2;ux)NEI8yH!2HLNu!i{oD4m+`(Lw)Ts`pb#1qnBdnDt+fz@fk{xmI&-(_CJp_{(f zR`Co82ST*4id}750i8zjDRbePg+1(3ZCbdNJWE4@HYUS)(YeotkV_iBrJ{a#@E)VA z!izn1+XiwwF&y`_excgs-$xxypee6QVcJCf6!X^Rfe|0fg&$#Ik6ntD#d{}a``yc; z(X0Vwe*WTxMzFv8P^ePu8=}@&L%h(X?^nGDE3^*E7PwgwQQvRnvc$edLGI?WIikNN z<6azr*lo`%eO^5eyUQ$G;e%vpS09XG(~nD^md33;P9B%$#uDOHljmHCpoxLs$(OEp zP{4IEq8k&WKr*izi^cle+a4{a2~MQl&jpKY1x*UOjAs8@u}Y%w_U+A9;bJz{0mrRF zqWkF^2~#J$#D!@sXLgmex}gGHd{xoibxYMhFm-I40R#Zji~3BKDX%)yE4>9M?a|SZ zUXvH8)*-gOXtz5ydD=}0mIq^9H?KaK++7E_QSzG_Z_?>G$`Iv^XMh$5rP*Z#%|_?w zSaj!oR{Ft)F2yYRNx%}1OzA^PV?``RvT_^bmUYxb%g+KyA>vD_u{b%e>#_sEAl`Sb zisRqE^c2!6TvtP%HMy*^cVQ6M`fga8n?-fgk4cETB!0lMu?r6lB~$EN%s^08N^^Yz zcAdDUL-5{fA?DT4soXSAX$sf-GD`V-BX+r=zNYa%s0XP2^a*f3X*Lwgf^vU-%*j={ z{o`hOA4&McHmF`vB*-5v&^VS9!TDjZqSF=i{znSD>(rqj;k%7S8bd#7_5SII48is8V8?E?)V~}x( z_K8~pRzrG*F;fE(#9^jhd62~gpA|UGOq)gQp@xt}6+St~^_g)g8>NzyBO2ASTqz0F zm-?exI@z!br&;#oM_-RYP8#37dS*pmo8R~6C0wvW#wy_fSX`jDH8Gu29&O>Y zS@3Lgp>ou=4{Pu3fsINpr!I<9Z%Yl&c%DL6+%QB}`kNi(@6R`UA(s;+0M#hOWcr%{ z%1pXNHO$dx*QemS3H4tWh(*$`8JfcMWSO*c#RhpakLO~;=VG_rGFM6LdR>H2+{F0$ z5tN?FY5E!XBcV#($eQf}V)dTNkBw+sYl3o)>(saToGj{t_1465ODiW*ntyUWUpOUV zDBRIcV^T>nldGDGTfN$Z0qH}J;UHRHm``FQcvQ~$Ffer}ZjQdj=^M@!-7#cQNlR+= zm5*j?CYW(a6%4W1rO;x z0nFZCpL$UVaB@&> zIHQB}BncR6;|E7lH`G*wD`N5;2#^)7E^v~*?6Z-SbD&DiqEWLur$Tb7DvE|Cuq!ZKEyUkO7`C*cw~B z;a-MX+!ckvT7?y?x`!^1fFR}G+)y=Mk{seq0myxcC#!-liYBWf$^Kl{OBQKUA_!OS zWw^Wl0B#=hDe|~vTnZf&Ojgx8o_rHURu!fPUsT1!^7P?TvyoZaq?za2O=zO_X)Uv# z87_=!t2;*Vj}BBE>HI5O#Nr=DxA?L1hxsG8M5FV%FskmhK?OpA_o5(i-*2srPmOT6 zS^}EPAr<`GDbQNCj%bZvh%wh7t>COqA@Zp)1X|e(=h!sT8skuhmE6abX7@$2i|Gre zx7JoSR*52W*OE`e30PMvmqXWhZFX=FTAf!$_oWGCsD5goD5Diqe)6bt<*0})M@V%} z51o9}(jEnkVhAL2M|=W?m1-3q>}GUqS**7C!bmPr!$@*b!AL58(O6F0{u6?znw?q+tw7 zlq=5L57%lZ1m%+BfJ8hwdrW%w!lw~&U+`6xn-ip(>}9=^%ZOB!G48Ncm4&#|6@0}O z7i7K1^{?2+r#p@Lon#gl4ys?hsD zThkj;G{%NHJ!v805%8`5P93MK1yG3{YUReEBJQ$Q=mla0Z18?rl8+0Mq03`hfc9vc zF#6jfxq#RXbX-DJ=xBtksjI0U*ct5L%)xve zESsH*I8DmMQGLQ}LVKcAGhHr0q1dF@%kr7&0`@#=^-+CH`W;hqd`*0r$1f3~&%DRr zxV!_$r3z`iY(+vhceGEF%;ySllk@q(!-;cqjJFnc?N+-8MsBH|VJQNS8*axqCC8|_YX0%1;gv{1g z;S@M6!Q}jmoLX#~riI9+;)=kga^~&V>gek^Pk;fPD(Hc%j${_wDLyPZ-9!OQ__#8p}PBQIiRlHgU8Hj%71GE(s>xM+51jjC?(e;E_qltx~ZGcFKU=(;Bd z37xNB9FD{F9%hS1%aVMcJoYe7OpHp73ZMX}75OMiD8%V0N_PtO(PKO!yaOA$3Nxsgq_8 zV3>(%{sXgFoM9O-%%G>hFoR74!wh=L$Os?#+dnXS7@5}{miZTEa{o8YG?{mb!7v+A z0>jK$_5TYq-2Z}EsMLRh8GOutVAfFazru|1e}Eb8zc34x`v1WU_aB($47bC_L^o8J z4irs3XQsqdKDhx72?43qTgE}4Bi?yOieZp@(#NsL>MY!^rrWUn#$O1~HNjD(363hw z|3p;}?l1@(RUmLwfx<#Ns{V55%&8@A?YgoMkSRu@p5_kVz_4K49SV6&rkg#o&=?n)WRE)n5tPGRAp8Ym!a(+(P;8gSc- zr6IJ4-4~y|YN)D&F15g%ySLYtXU#Edb32PIJ^^!XtSiK;=F2xzf709YihG|1@5lAG z;%_FKbd0R*ii{fWE$+G+OHt~ou5M!o49mI>t2OzJ`4|ygFItrA;hQ|xlNb>=fU_1x z#FAE_P?+kUV-sE3CTGbH@2i zfqGK2)gb?8p!66*t&`m~d^38y8e|tgUY#``*#lmG=9H61_g>0E_ioJ~vXgH`qDlV2Sml<`JJejN|WIE&?gbU(7G#hs`amk{)qv8tg+R}DnQziHcn z|JCf3$^o_G!mmMFp{Y}~!08cYlm2UNhqYTlLs)B&oQ1@!SRR4O$&t-EnX`v@3{$Jp zaN9NfW;7U9t_9Posk8e|_I3_-sKeU!$wpBG$qAvBKrUzWw(hWYu67Q{^|C@QU|35k zb_qc)!gN?m5ow&wIb^$`5jHL#jCy->|1N^6|jzr zY?MbgUHYIus>iZjZJ~`}=)V0})r~c#$+RO7RYdIB!DmX0vRzHEF6sxe7arDJ0=`$1 zneJ3)-GAj9)KJ_yMc2e}24QF}Sr*$8Xo6@Ik4>x6D(=3iGo{|GmYUNISS3x&b8*C5 ztYq>7Wyc)D>bbOK#}_Td4T-`~j7yebQc`6hrIRvR?Np##7MwdVPrKfKizc0qFZgWg z{}xRhzTl#XO&vo5hfQ7RK25<>40%b`8_(cseti1Mm_Jqqc?n!J;Z>C|htnS#?Y|{8 z8q1HtsOEBdy9i@Qfq9~;{x45}Slrk-Fi?I0d92bgy-Q&UbHTJ#ZOkS_1S^Guyqp1w z#zX|M5+PRvug$B2!&*Kuv{epF=>J^asE`L==-}oSx&H=rG8tK9Qyosz0&OKOU_||I z6)yE(iAz%Tza_57qP0Nh5ZJ)vt8hQy-=q^+#BWPm6&ZaT740(}Vu!C8L<25d82>F? zaKVKOE;z;Df>R9ce^N{bPN>upb*K~BE zO(i^kE2p9t3jC*nzBkndfCB$i-*9D%dacqTR9e#un>QMdPBKy7?l(?if>k2 zy#rwtzYx8R|GAOZzYuU|xaSDY`xgR%*I)<)=TRKe1?TykGG_h?E+|jDj_=+!{+g{j zK{KlV%#p)eh9vYSc3*3oI!$}(-?`Ckv_hdvi;I! zs0W0i72Nkw;y>UgbmnPLbMlW)vbW6z6_lg?L|7xTas_jP56lh1Y-llMLRN=a2qz;m zPrwGA0HWC#qN6R6zmvOA$siGY1X(JCGWI9N*2);SZUJJ-#gO88(Yp<+2^iO$Ok`ujDELEdJD+wd zxyg4c>Bx7jvySJvB~<9)y{i=Ay=`RSy%7<}m60Z5ctZv6$dJjETfv+E=mxAQuu#C7 z28*0etu#+_nam0*StXi72n$YdGn@C1HGYm9_E|^qApVIJ`sLy(EL5J&4f&tSH&cVF ziVt4$p7A4r0%7rFt8~G+1j9R~Z~{yYe2U56qA38PLM0j)cSPkg60GH;o53uK0ewx{Nu3(lrT=Q2b6@`(iB|98o(Z_U;m11e7ew> z-%O_AACF~J4l|(iuf-Zr0$Z%pe=SzH+JMSG7HjDML89^>i=_h4!+U@|R(K59Vi2;j%80>o14@Dck zM4ZCdqqgu>VXhI?#ZAXe2N{*4;PF^N@Uk`uaKWGi{$z#F)0NEC%T@ts>Se)4pjZ)C z%x#dULg)!jDlN|HN#FpyWtC?S&INavne@t1!S|G_h)qZ}*E0tXofz|Yry>FD!N&9n zCH%pGC49a{dptqHRG6nHi&RY0oi5d|Fln~bMBKEBeN~lTErULwv`~{gD&hw|FYq4x z{YK>}f|3F_6UIO*>8CYo9nttGLfUZqDVdfp_TnvHzKFLha4wbFhpVWgpQ&e~pDlhx zKf}f>%Ee9k=p5;BEQVK4P3R;Arl}+aS`V(4`p!1xY$aR1Tm!3fN({y(-rpZ&I-%6||B z3UDpYk!@5qqJ#=8?Mrlgc^&K7S4BF4P=Cx0$%_-GA4?efb$~aum{E8Swp~1aq8S zpL^a;MAkjl?M42I@pI;S7+0o<)(X7ESi zy#|kR-!8h~ua-Nr9lvhdco_0k)?ty9)gNI1$zC# znX8wJ^W#=Y5;1XpC49H=bN=PuhlPiW$)vuoz&skrrMkS(y!n==@ziiA1jmbYeA9$6 zUbM}zF<}Uu^P-OE^jI@2!5Yvu`?2|_q{c;k9tS&GRqx~;ONDy)DgJ_;-CpLB5&IYG zpbqar+vrm^VtER!hc;9e6AROQ&8bQ#w z^tm2^+kp|OB})&umDY`w8_8RNZ;XU}OJ74eUhk){ni;vkAAINUH>0hsumQ19oHK+575gU4&T zBmPjVl#eGNq?VuS1I*7AoJBrzqD1Tz?UnBb%HU@> zgp38vaXGndNWLF@Xoyk7ylJJM&U-@ioL4sG&ksVQGHv6it~g&P^FeB^T~qic z@g5K5fzKuofumfeb&bcmXLjt-6GAr@&+9%&p3D{FkA8h6Nn92{cPMZXhPouC^Up&Y zZjm3V?k4^mseamgs(?Rnz|X~Pb5|oecFy3bTqM@l$*4=pI}R6Iv`F|?%h+A5p~t6= zd%TCZi^-YN5V%z`=)A zx-hR=0yKe^DAPsFv?Y(27WHpD&kPKd5i>$6k@j+;*O4$&O}>&LVY@=yf=iKzNE2tr z=6sz1GPZIbh6%Z1NEN}H3Hg!{eV)zSK4BEBntY)QCxNUf`XO;9?7TWnr$q^Y?3aQC zkuJs(YxI45YutJ4@#|QABx?forASdEYxHnOZWEQ8Ms(fzmCEXRK?wKPP zbsg&i{_vD1(gx)`T0;y$l%$?dJK|Ze#w4mPES1BgzN^8#detH&ni8)3(s%F6FVnl0aF5~K!d+Tc771T+xl>ac`_pw?u6FlKP(Y}~Qh{DVb=QfkICd6! zoI~n|ean88+3XPz4Dnl_`3JLo;AmzOyIG;YCki>7lk}a2)Jm@RYZ}s{X%u}a5{fw) z1(NvQ7k~FN3Z*|e;dztpRD>0#2hGm7)*p{Ac=_Sx_wMqNy)jYyWxk=2C-|tic4n47 zXH3;Tg1lda*6=Qc=dQosnXo=GR+FEaKfes`S~k`Wo`X(7)`6TodIfR|!20~RNGG$b zn%6Q)Pg5k>aLM=bc)e`LM!a7hrw*0;5HVUF^!uj$GW|yj=YA_TrmS$%spRx5^?D`Z z67aY4NqG6`ITF8^ku4x4g>qS~f~Xs+XxE+5&h6?-#8#nPKSk;mOhpISxfNe^MtN9%m)s#ir751a#ZNC-c^1BjgNdd+*P%>U7B1yk_6?a^W5RJL zFp2r)jgow@hHSooOgY~MHq|B~B;(%c@s`f*3Nb!qh#Wa(kq{v!8PGjuws&_;Rlt!V z$1ay&Bj-J($yZQ4l81pW?brJ}I^RZ*J})+XqeV_EPk8N>f$9)$=I<22-br$Zx;H2+ zAHztUp~$Y&0vz}2k^BRMA zjhSDeY)nHSS@=fc1T>DiB=3mvW6RMl8?p7&7S7TrzC($t`StX~@^3AlD}gwysV|O~ z7SjE4Z}vR!u&%_P{B6@B$aAgM(d|Ge1OHC|fee207J_~t=!e_Zji4X;W*j!_G;cNT zN1>)Bpg&AR+qUO4BO;Xu7DA*FQ|5`s0IG7$S9Nt(kxCBOi69Ro&B7{w@<7sWva>id zZ#v!cLs51D!S?(SRZj`3~9b_XPA~a)1Wg0IDc&vCxKUa8lN!j@t?wW zs~*`bISHkF%H8Tchj>kYu8k2DH-SZSE<%%Z5-KcyLTqLE^RM0LJ7M8oAo4T#u+Eld z5oTqL(#Zl?Lr*e-;S)oHP+=fg0RJq{x9}eNbSPt{tG}`FatW=S0Yc=Wu4|iuOG*`u z5qoQ5gdE#T0VC>mPDP5aH>ZF{)NL@28ewlz0!h?uPeG8dHzq)TCF-`7p-CuBl^V(5 zCF-`5!NZ?Pu&_5> z#I&g2_Q(KcVW**g2ybDaVY;{$8QB8ag8d6Lm}YS;?3t`ts?0u~Fnlv44BxCxj%Q6Q zD~4~@7M3(%_-0dX4Bw35o6V_-^^f73F?@4H!tl++k17n`Tu5UOIICfdN_5U>C?gEt zOuWd#@Xe6CNE>1JW?jPY%?`<%Pz>L!OP)kx_-5kM28M5cCVrGTTn);nDG=o=f~P?e zhHrMwiQ$`B@*oVuH;Yt@v{^MfF?_Qo`BOKW?1$l-E0Pb57{1vlVfbc!`szwX4a>u= zi)qamzL~iC-4-)^^TA0YuU(WHWi*A^c=R#{QKvhJHXv#)Z$U2FvZvSASJ_o`^2b>p zzVF1nc=&>U{AuIu=Kl7xU-*}oaevfK=m5PSo5S!%eA^30bk^JOsG2tTf~>A@r@sw? zZkK(zH~1mGx`>Ben*AakjpCaZWMlAyBylh5l0Q9r4gXWyx(nek_X}F4*QMY8JnNtJ z`E_(jr>KpR+Y1H>B~1P+-&#uCdXX^s#Z550iu&|_GyUJ@I-`~~w+i>$WNV}F$EZzN zUu3mUqsA?1sautPPNd6bM(u4je--$L9r@2$AS91+1 zv$nCioz0tZgjttcWR?C|;D*iJt&J_o4OR2b+k^)XFGw_^z3dc7mP3`%%twbdn1Jk{w~29i$Tw?~Qhv(c&KSLVF0R%_@J6?UW@1mzYbpgO10QNVOsOcvn5q+-yZxpTYB~D z8f36$%RN8N?NCovemd6i>ji%`G$RFNiahoOIu_w{)qJtU9Prm-NE#8-EEYAp&Pd!D`UVcCNH~KeXhJbkUYx|A=9%_vav%s zFvoWGNFoHbIY}L1G0?&;yv)^r7swbNv?{57$m;m3UUJHJMp{Fg@O_$yjA_p7d9nXC zn$<}+|0+7t?fU32rKFHk(&4qA%Ypj9T`oGhRUYdVUT*QPpiL2GA8ad{u|=Lx z9hR)UQq)k}ltSpEj-6sy#N*RE;;q%9RC(|3M6ElaN}O%?DVH0S6D>tkAtT3Fzw;RhDHuL~vp6=M%O+p=*R|kPv2R+*%^vqMtSBa!i8)AtY1h|% zt@%>7Z#sn8bqunL(65e2duiE=PIQ=ujcdaUPcrH= z7-~@^08Hiqn&%f&nk>hEVjxzmV9W?FEsDvbT$^O z=+nhry&3dr{ej0AsM94feNd-Mg?%(0SxhjQWUzF-jH4+_N(Df2MxzhtbZy{hllrO- zPno%@)Hx3xHL#FX>suP!Ui6~mIvgJAYsj~f=>orxZkRU4oNA+gVcfrZ1+wo2Tqa!iVu%rdcw}*szKshybA^xli6ZQ+oz;VS zVGEfRf@9W`xStGvdN=fZC+ud9!lrLSxw)wm+Hedo-)Gu^LjEd^Lhi6i+$thh1w#~R zNGfGT(H=+ePZBNK@xs61+K5Da%{0S9M&1x|I;!v-2A7MnkGL!5M3->XryX%n0Umc@ z2@^O@GB`WigVuIa0gh~wP2mK6YQbJ`_l%U8(W8%w;xSr(6wjXEtH{7f--BS1{)J9m zkap-;m82mbEhpk()iA2=N0fX-?||t>@=d)>KT;;1LP^8VeW-2*rq3QyM4nQc^V0ZP zG^z~ID~!0wIaMml(9!_6(u76iPMjB>CN+1WG=qQ5{;o1)?(}dS>xS2!O(+$UxXTE} zvN+OA6tob3^9|Ra32S$CRqVP5BAO5oZHQLzb0d^_f>?x)Ej* zUfdmUpNp>c&wpUCydysRXAAyxl#DU{*$FKNXJh$DYJPlKr<#qZV^bb#NtgPh&WdEt zHc6b#lQ$KPU!Sa5m84leIa4`VLo#MX5@vbwW#goOOGTn`+*lAx`Dv*gtN-(6?z|vI zu*!fEFLM*J#kruq?Aoo>OzxWPa+-B2CLQ(D!v?*YKpTFj(6E*O8}~KE0Q-BJeSB` zhi`*ynW{9cDWP z)fDlqpI$wFS&#bPLZNLfE-bI} zuB0vVi!4vBlx*=d(a&1rYyABOP)h*<6aW+e000P+6Qf2BL1`FQ>@&;YW|jZ|U89p{ MqcsN8q5uE@0Mk|piU0rr delta 36932 zcmXWAV^m=8`@WrPvh60@wkFqP+qT=;wwr3QYqD+Iw(WX8-{<##wa>NoTE{xqesS;n zIvV$d`MdplX7js}?KAWBxFi8Km6qr8bFy&(vL!YA<|@`2^mCwU=q07NX))FP}Ecy=j6fq3|yD^F6M zRQ{kd_ZbSEWOGEV8^=21SK<8lm%5lnI6DG2GYD{EN>yyNG=sIUs2M#GGUFX8=YCJZ z4my$}CYe^ARrQDBQmY?y;bk~;@*F*!KVx6S9QLG58RKH(^klGx^Xj`wm!${q6Yd5! z2@a7r0l^0?lxP^(6lTA3}=P@Q|%O+CzYY4wR!>Q1Ck1s6j`FN-<(vi(E zJV$lyrY$P) ziVX$bS%{P@7I^V(8@S|tOcl)Na<}eU_MrO60W=9z`*xKPY%YbjCrgBNNa2zWeProp zCzVs>W*YmjOOQFubEu2(w~c8*S8URfbWs zGx%8}jxu50qT=1osloGgtriSj1rKo*1s|l6XS{Httne?aItm|&`o!@c9qZ_2rC5kR^Q&sc@JtqpCs z>H`+p9nzqCb+1C(KTiHj{knd|4r!bL?H?bz3`jxVo0pg-nw9hS1w&rr{7F@)IL#rGAN= z^^LgY{67E@!PT2V%lUtRxBmcnf*X(j2QY&FAHZc^Q7j9l$*9%evj9e;&ZPG@Ica3E zQA=hA0ChD)+=931!1-T=A%hmY{|G}A4xIm0i1~j6#Qz9Maw6!GO^`+v9CWI>qz0m- zU`np5Dk(U#k^0}C)Dz4<`G5< zr{&hEN6>NA)G`>vZk$x|v*ooL_qW%O6?%S!rAAz2ByZ7LVX^LKmiZ^p!5e;y;7AD} zIn@ytk`nKlaWA=;D-nb1`O;6+muY&PJ&bVv7mo4jNUGDzv{XOX49KbLC%$aJLncb;48uMK;|@8P@KNiPOXFr}r)z$?}&jcQpa3XZn&gjbw*@ z8~!(Zr#^)3P|AKz0=?ps%)bwcnm3L1 za>IPzzrNH;dkiVl6)@80fza%aNW0$blGz`2ggTfv#aPmIXD;T{LJLd(j z#hE=27V}Q@{X&RXTG_uQUE_FvR}lTzWc$ejwme~d?Et^3j^tYomh)hFa$2Y$-V!D- zru9aJm%gFbnkFF4>-#o^ZX-ctitL+vu+bCxV400`QZUVN44E4$U^@(P2BRaH$0TpG ziyeB-yNh0KxZMs=43k7}3va+q3cT7mRaq9LS@XMkmzGo)<+gPKmu+4drA@4L*Dd{K zvMSKbw^FfeHX{Q=j-d<`cFxJWmgy^Qf%%9d2K+FW)5NMskLUY{gq^UtX}BpCHy(>NgYoAgD|{zVn03} zOQmCcVU*!I{+VsI2k-UsCzfFg zbNTIzgh?RX7~W_qDI0Dzo;!w>M0aBKh;L+`spJy-7lFTZy0g>LaMo{2O6zjmH!kI0 zPfSBP;jRiK5N^MS$|jXzNI(l#t^#_#)4j9|_WyD^V^vR_$7#d7+`U_;~*#$Sk@ebW&}6 zNGb>7FUjWp$uQ;|qIhYZlSI-%)mP|Hh={KUA z-JKH!EZbJ&#chkqyvv*ynjhv0K8|Q^j#-~uJxS(wL?gzjIzWviZiR8HKRkRf6=x#T z^sEpU>7(jN!ynwZ3~>_h;x1l;FLyDkt$YIzz<> zK`3#tm3tz8=lM|ChXoa>KwVjSHXbZF-wZ=zO^~~w;sKO?_YO^`{Q|vWN zn=u0m>v;1ZI!M)V;H+M)`-JVR-?x!zc>(yn z)K_;g-F&vJHl<1|CKp{1T4&`eOD)k8s$6;1q%w-3;|+?3w9g$IzD_#xr{iZhg^O;~ zNx`F2Q%4Kb;twe!H(~8Pdg-*qx^2*iPLGo6-L6#wELtbf<)~A-gw58aaAXAL?#XI) zo-xi z0IycP3n8%{YvF#@WXr3{faCkJ;bdSmMp}@^pA9u$^%vMLp>frT z{-&PUlwoj6Qk2oXJKDfM+uLzr18-?_n}3ESPuP84u#sJSd;vW>!Q%E&?%shVX zE<*xfBb#1Pjy$HsPT<9?#21B5_wYnG7M2hEXC_|X$JsA3F8hPDp^F>Ij0^CHG$4=< z`hk5o=cT0R^xX<|aj|66&zm(esw1c3Pk-~s}bT&7lL9Qr? zVhD;)_r+N7b}3A;d8iXDg-vAL@iAiJ|gk8wBMkq0J5=i?$f+u@qE^c5vm!7J-(lp?|nprId6x z8*Og`vPW221h9BayzrUGb<@~nFwiFxAzUR~K+i*ISK2}%iVXqpVmzdS9=st1lWkBO zJHD`gE88?+86S}T=|8fw2d#B~yF#BA7{Nib7l7~|z^49SkgEQR(-e)M+lzFK>ixcS z{afnquuq1D5cnptSijOK0#>R&!6c?xIhdf>=}nrI=9$h7)sr9P7K(FkkH>1m&Z8GpiVxMetuc?NstLS+v}|WZtjUNj=1AsZkpk9Y zwN@gXmTvKQ`9c|seN~Zcl5Ate1QR?zeS5H85ClgDe?i6->E)I8QwQ-FsuPAhVd}Mx z!{6{5e(kQJIDh=tIXXJbH$CV4=@Qql#_I5F4QF!k&*9IYtUaUwXU^x#SjN4dHz}elyOE1Y_$2BEQ`29=Z#PSn#9br zd?-8Gb4z`U_!&jFwTCtPZ;ZjgJPCE9dBC;7t&n|4iEs!xrZv_Dg1S^2Lw?FhJ$Q74 zr8JCOtxW<1rye?#&12kDM7z_=;+;-i8m^Pv2;|LnqiV@F-s4y8nzd zkg^sK8&QX^Npo34LNVhz^CO2<}TX1%^;-!T)vgg+g;hyU03!Qam(7SKZlVy%Ci z8L3b*pCh_mB3N1j8fgf5Hp3c0oW6nTA;Q>M@`-%iTykQTQjNq*CS7kx9SgzTWQZ)R z`ctO1G6T_*@aJaaiPluK4KrDw!U8$PAX+rQ*E+I6Kb>-y+3M8h?Dr(-8A2oYXPi%f z$E-$Hu%451LW$#Js(;CtZ34Z=g?V%VIO3Pn|LbGyJEWaE*GFwn;1`WT zyWeGE%1(Sx#-TeN&3)vZFm>^0gC)=%IK{>%<3K8z0N zB>3QkM0F6AG>RRSnN>egONV{O^&RRyhJBRE){2eSqw6ZtO`@n=2>Df=)e~z$%?6N& zq2i1D`Y_{UtPm~pd$)y(FJ?u@Vpbv&gOUH*Vo8-svdnQ6!1i zAS<$VTqH85mktv3vGiXtsA@V_5o1QPi?+&?tip}DXgz#EDZI=ky((s*#*f~V2Ao}H%TDo8{lg{P{p%b0M-TQkU$=Qu>f|zr@<^kj zbTKC##0Pr<&A8%;S3>DEU`>7;$)=G{rr?h!cw>Uvy^zRGsrOQ90CQdUI%yE5$O6R8 z8lichH|~s2Hq&8?7)TnqW59`yJI^lI-;N8@5UlRk`o1r5ja}ikjtv*?#II5Y>14<6 zg1;=J=ncUNsOXej(koF->L=P;6^yI<@83H!`A$C_vVPw%C2?~J+4FzRos;Sem6ra{ z&tC$gT-6NNoYIN30={A({sH0IRwrE)YMBNdAeVj>)4k8$OgZ^V`>!%X@$V=(sblt1 zgaV=K0s$?qxUl!vGhvb)gO=yT8B@Cdc>^_OP50!1$;EI&;66NVX>bVs3B0a6-% z=1dtbV4flZ5*WD`+kUna=;)t~5unAG^>l(Ak+oPGoZKV#Y=2IZ&2uBt{yGch@KCIJ zJ3UqBS;-u02p*LEO74U@k+Y5L?2BQ^f}Wr~+0fr|FjL-2 zyD%aIdSRRpgif%17te+3WPgqOu#W!2ET&&=k>kI^W1Uy$YM+l*)IDwO#h5NnnQA8e?L$@zY;sLhEuquA zi%xI%b*_5Gw{P8ZKWO~vi-??r4?ptFQNm&QHeX64g^P)e_I-RttpeMtkphY2B#-A& z_iie_U-1wy{-~x>3==M>QXc63BKfcY43$KC9K8R)c2^rfFd;EK@<-42})1*O05iYN@hV!Xp) zg@$fnPFtZuII(vzYKYbQPy6Y~(og}F-yg>NB}~Kkc>Z`~p-@+%E%&^BXcu>p`7wkO zXSAu#8)gGVn4+S$Ozr&w^0dH(NOXS8L-5F!&>79bvWq2Q0;5h)>5dMAW65Z@l89da zYzuD%OBVyuxXgabb&Z0-!sOyLcEz(XzB3%293!hSQpfTN_Qa|aXNf=%Y9Xx7TLNz! zx4pGo;erdj^w~wWntXb_?A&jOc?#MoZ|Lz#qa0H!S<4I@wN?5CNCTk1Py*(28LHuj zYLK}DC;o#-ddYSV4~9u=4EYL%mecmoa*0cHXo5zzGAayv%LC8lKe=D&w4Bv-EaP*& z_Lmy?R&AWM`()$?p$GFlT@A_mc(bDPddIF>COvZ^70uGGMr9f$6Vi-zA5FH7<#4}| zPuwz-at1$ox6?oPC-8uC&--8{C{uy({fx=Igei?h?5)F->MXHS@AiOGpIVpc17AMr zn#|f+Ml6Esdf4_%QQL4d4(7WP8van~3@%oO(%**uM4f^;fuM-^xAb698ul83rB$@u z1){e|hQk&5hvT#M0)#`lZwQTdlFYhm7IcMmHrsr&8g6z_F{S`pDt%$>P`xsqF_ZbY z?zV(6PK+sA>a0d}qxA8x#?+?PEpwbL-;PsTvxNNzXB+#o7Mt^rPrFwH(xwtM_um#%WHR z-;?AuT9g`DAqfJ{5Fxa@JHhw|@CE&E_)c%Rb{xL)8Qxt5p56%-+ZyO8T{*2vZ!C_cAAT(- z<$~rU^Gud||FV@QA1)obmF4R|D|d$bGqpl=|uc9plDyj5W9?u(ZqO(TC2}k0P%RMzX0nuXL*+ zDT5oQ4^hAmclwP+hvoV!t+!qddjlgMEZ`j18c&)``{y>8? zB51~UwcwXt2VQ|)16<21HfCVkrA8oa zj+BjT8!j{_Y5LqI)gCgzh1lid4Fl*xlqyQZk11fit)E!57uz>(lsI-LG8E)%KSe4! zgQ>j><=OigAMwb0;d-w44~VTvN=F;zr-zsaycX9f+}ktDyswWWk8mDDr5dmuh=>kBO@@_PgBhw4CHp=g6kvBW{OrbKw6T zjaouMSO|J-9DRDnd#*d3TG*-=V#I-?X_%K~I4PBdeoC!lG!g zPbJx^djql3H#eNVstcfj)=u};=pH`Tkz!+pd~OaF&2VmeHWL+f2AIt&K=E#RJF8y&p%g+qVPPn2jXW%$S9QKFRXq$zr;M%$=mJk zO_|C4ja!+q3@4FQ3eT>G%J$aohIQYiu8obef6dQNxs7?Y7jEmx`!yW>ms3+-BeV`y z)Unq?gc=%B}RvDw%t+IRsI_4agCxv-en2J6G{U<=w{v&lBqBUU+!x1dQJ`&WEFzT>L-Zmka^=LrAQwEU04LnCqj zDOxn(c#tCg+Zs^Ddk5;_NLN-jH(?pw*YVD^&o3`0V`>R5s-Z78cg|K9-5eTSA1^dx zAoEwC+QdoHsTv6A;Pz8loL$EB+VW_JHR=@6a%*|o43QqdnVYLN}4BE~*aHKEF~ z+ZR_i+kuU%i>7B@^<-yWZ{Ew#P9_U`eYe2RDm!dDf%U51*1gi7ozxXr{TI*BrU&@W zG-7Ejzh7hOjC=V9htfJm^gB&H3CN=9>px61xBlB-(GEjisp3x|++E^ZBeTFPzIsZn zn-S^PIj9^zbqXLvo0d}}BpfPg;+Bo8;0#>w0D#9}K?>|~XVs&5miOkPTkZCb_4Rf< zT`PfV{id2e^BlX{y5-fa?W$Vhw%d1)hui9JMk}OmLf3YOp*4TnrT5C>D^Lxu@xI~I z(eIRI3oE_K9vHM25Hmxf9s`gcI=C%t|75`TMNjrbqtP%6rUERj3&!B6u(4l+*;pF_ zhyZlXg3w#1>ekd%$EOm(h?Q~|0?5itZ;dYGj$|b&9chGJSm z@#ndrC$VIOjTr|~JV5k*Y3o4lGFHZBcDoP-cts*#;n7we&?VCr8L`9fj_A`{_Dc&k zm#>h4b7`Qv_ljDzOe#ZbcX7`(O0!d72i&NwVD>FxR$a{UbDCgF>J~{&+fXDN;fCl} zjNyv+wY^XV-EsBGmMZD4+C7(?JV=V7nW3;9y_(o})zw2vRW7Cq)1QtOh<(xqX$Usi zJYop8O}ROPuIq1fQ%x6cbyJn`Xq<~zr#}hpb}DFnTtjNAZx&UnRC%Ims$tEc0Ppia zGr{=Q>b1?WXW6yA{Y^7NclV7g=c1v0czi<-C=ko7jX{6nW2hQ>+)|4_Y8Ica3tDW7 zpIXA;7zhhm^nU^(p=fYR-BA3YXnX?x7tz=hJv&eUaMkw(FwnV@AMsaH%!l5Q-mH#2 z#2l&}WVc*bzciRMH>TrUo^b))X}{|d z-R5dF_osR?1LkF=;C~Q_;i#@P4!`t2-BgbfGb*oD=dEsIXsVN1btx00Hi_ynvBpFN z^d{$xmWB|8`sJHB!je9%2mpCoReovYJXPHvW+#+1O$`oLy^MN4=(j}K#vAU!}tJEHSax$%W(wH^nV z2Hr>+9{AqQ-)@=p+Awde*a$uC`^u`Fo)jlBGcf~!kPMYyoMi~L*@$!%yX21cxx%*^8L&Nd z&dP-6u+z5+Sb2<`1%sGu4)&6cz?8|0pJ}bY{7z&jxv2B;fjueZZD`EZYJr0{26?W{qc zh7KY)TK6Z|jd36YWSik{tiM6GaeZg}#O~6Ssd+`iYS+eg{#oCaU&*J9`!`VE>5idu z$$xHR=hBpylhx}-+2(;y;#OiSEVoQz<>tm>#`ntjQlXen`fzL2ja@$WdqvhR7v-L1rGT6uPcZ9OaN&3<DjngOXaLfl<`4iSNQ&DWyVQD=A@xd7_+8gq#~;Q-c*W8f2JaZ=yM`@N0d_W5NstuxsXIub^{$v zDcil=(BUZy6EV3F#gF$Qry3huQE~~i*>Etk>Dzxp2wRM@RK?yL1y_piTB7-|()01k z4UO0R_yvt9YS`M+R}XB|WIv!$`uE+#B4C@8kCeVSSVy&kduR%`?$!i1dCPtGX8c}? zVVRcGqfeZu_>D?Q@_j)UCUR2;*Q}QvFj`FM9aK)EB zxGpakg3SpJwriN-WkJTrZM9_UMd6UyS1s)P zk4{nC?3JyoX(kZ%K#H{{!?yT(KVd^xDVRGVZxGFJ(0l?-byMdBv1kqcS7T^n3y!Nh zHuNVz9Ya8vty{YmV7d^{Y{sJE;oxLcqi9x6f44pS$srj}icee{f`yHTR#XmBr0NR9 zQIZPCIEUAxngWNFqtZF(bnxvIGPbR5zgF*g2)EGC?U0B!JZzXT9j!jxDOJ%T6A{Tb z;bq!X!dPY6>eyR?KnZdX(cq{qipekFkG)um_g?mqP(9 zEBPy25NcK5Dt&R`)PxvnDb?m1WLfqu#qF7}++BR$hEXUd8zT`9GfyEFF3fFLd$Z{3In`WKE zz+i;s!`;4NIMH**S(RQ3=sf3fTHn@*pHEA+kX zK(G1>4gk@=(Q~MH%q3lN#~f@UTQ(|D)5N2k;vqG71u~2SJaOPdtk{YdR_3H)HjodE z2(e6sB2Np1{vA}$=eF-uETGea9QA=wB^`0ig4Ex_jQWw^!GFs0r0DEUnH5TD{C z=Um9rZ3~ny$Q$l=Gi5)r89puTyD0eP!bbY;q~#rLUVVtDt;c+#i|z3bM)Yth_UO)D4Ung_X+Nk1#WZHBzpZNtGl(XNvKkwKD$zR^gu5>_37ri7z7t4d5;-!h9+zFfxEn*D7%#t|4e9v3V(#h8 z(iN|raA=BEUMVIP^-rvyqeHQlr5mD}$4t38% zCsW$TPi@NE(2g`KFe}ZcSTxhIw~PT8+K@DTW&NX4H5+-)zezR=W50IkeQArrvxx@j z-1gRmvlW9rRTY_zSFCuGD2dMwu>m9H;*1%8AIn3LwF{;sw&Py=2t;%jF!>e7W-cI@ zuEyj^43|aIKZ`LsCQ34MjSTsn`&f1p)xtB!L?uV)9}Oa--`B^fJyfxdajPP6HCp`R zeS{AAA5pRNE<~p&*xf|jZ#b;N_&7VRL!Cd%-=yRMo@kHl$#zbdNCw?WFwN_cD%8Cjd%#j?m-k?xwLNy$8gDQSd?(FGu zANug(Nr?57(z>bACAhKDD|{N0-3N9`alDW|`~7QcCi)Ou23B{8{J_sdnhU_ss7aYh z+jr{F%}R9#?Ywa=@a@>GbP&S%u}tlYk#E0Vnq{K|cdKMUYI1WNRlkfE?Sq<;upF{t zk%!#)FdyZe{<&nGIZ?xnKI;WAIsWBQKL1gMn7c3gichJ1?hzl9)h^TD(yHL?+)TJs znzB!gzz{F4N$e%y$P+P3R|tgh1uBg))9iLc#U0%Yo@VEBQB2~qIS9D(SoV-Xq1Pi( zm^?BXHU7g*fnI+9S#vdS%Iscmfvm|u+eY|SY+>V>#2(_Z57jxY+lxNW@}GGMjm)T# z5O1DcNG@PGv<6ct@!`ifo(-wbd((fvefG=$II(-VZs(E~*)OYI{RgPDKp&EijYB7< zA$dt|5U0fysKfVnoB=|Sd0;Cd!W|FR9=zC_-P!Sc3|7_32CtsO^`kvDz7$q?JPm_xxPZhqW z8g~3lxKn1vs(DcXAZ8O<7wxwR@CjZ1n>v0SaORax>~Ytx$%o}2m3$wJt9*VjVS%cB z9{O?x^8XdLxJ233(d*AZSpbP5&+jZILvwrmS^9op7IjSs{cqxv>g?w#)bCEo*xmdO zY`xz333c~E6f`lX{!HcLqP~pENa(n217FGw9`_$uOiQBMT8>%2>~GlcG&ZdoHTr)rL$Pd`5EUqfYUfTHR7-ROkx&;E1IMusNE4ShtC+Kb1Iwzv} zZ}g1+H^T%xY8_8Kvj_yyt{HCSPoTK%#_!C6ua?e@V_+!qo{SG?we zzX}b~gK4#xpjuGWJMV%f(m_hh=429_^UR&w4&s(ZzP4B2`0 z^su<^b^Rm$!XckET`+DKVATInC6JSBuS8`GvN5Mm=IMt*Uh^%7alu;M<153>9YgXJ zFeSj4%?m6kc0=WpO-XTRV@P6O?<;xW4C`zD%6}l<#}z0V0@ZcN2t*2^!kPC%y)O|2 zmH&)G`i#f#6eRx!VKuolPKT$;3qD{xIC<_zyW@aQWE$lew4pnMhc0-r;Z1f8JB z2jYyJ6k^iLp;i*4*C5)h>uF@U3`Z>ELW=qQ8UU9eF-c~3!UV6!whsrb%wt-g)|0&z zzcb0?U$e0*TbWEDc$`+WeSWlk)=8rb6@RF$)Lny9ivD+}O+5SgN9$!nf25W15|rUt z?$u2|;KVVZ-R!ZpsWv{cq%6#pgtT*+#7Im&=NdsnJm|kmD(QqE(Mx<&l~_sA+A25jXV)jmjhg`K{PBPoieJ2-gwkIBr- z(RIl0C)>~%wZnWiU0Q^twO<7Sb7#re>3q)v$Ml5=eMlY2pG8Lz^b_d452<{iG)m|E zbYGnr16L1Z&KE-sU#FJdqE#LElbyaX4}dCNll>Pm`RTsl2EyWFN_PpJFNn}#0oe3h zWo}wVr0+4JTa>uW2benOYlsH6C2nvBzwqt*(!rQuTZa&A3|tM>Hj z^Ol%b#^?+^9ki{XgQV{tH7%N3gTR8bt#qB=BII^;n&eKl?h%>;if)Ktfk`r*sGrn? z_8WaA>Pzf!M9{aI8V%+t=p}d0|VBd9U+e=vTiG1`6bG3aO-AY{kMyy1M0T^0Bm_8^E2WnjqL% zXVe4via6dL?` zN!QkxKpfN8wAJ^TgcQeUNB7u_>4pJnt1+4fYRlCM9Q@j7XVYsvB>|fGhT)_Bny#Pe z<|-R z)^Nf><8_IA;#hKjX5?J!{c5oD_ICFz>Fn<8+}hIL?pOnwnp@lJItOX~Gr#VQQ)usF_RMDA9-y{JV!=ocEGs-7%cOfmgS|fL-X#f17nbnHzcZH+%PVZ(AZi$C#F!;iI zgVMF=cZA^y2X=&`bs_#sJ^|3o&Q8e69EjL}rhp_fp{ff0&_S&7%VQh`N&L=@WDgXM zP&^xx5Nkx#L#P}(_Fn_VB1x5xX;CXMz2SauCvqpq1tElAsIk9%#Km&{_B;Pz4Tit= zG8B>E?4=qM+rxunC$AB48?DFMb{!?)OU4~sfFcN3{qe+NANn(>7CbEhM3)->=|2++ zl&RiD@;?_giD8 zgmeS&9z`>(1{3gYdyy8?{(1n3svCsbM#Mr>i}`)R!t_4gEiaZ}QljT)NsLlk0c{at zrgCzTsPxG{D1MP=a2jfygnzRFA9F=X{B5H>t+BD5`e5Z-KP$v?_UD;?HZ#kf0j55j z(j}U;l0M?Yyah2nsU;W(R973DV+i5diUAl8U3A;g5Lw0<- znfp-Npnxoy`xhq4Mb>}yR&=2%lD!zrMHu-E;C?>+(Qmh8qh}>f%vj?6yuk%EyKU)n zZA@Vb+zFVU*irplMF=!Luj*hDQWdjsls=Rs8|xdJX9Cvtb^>tg>+jyYz@>pZzs2>X zosG@)6<_Q&h_Udk-Uyvb0gNE4H0w<}?2aVH1KK)0=w>fQV-+v`o>0KZ)Rgv#q_y$sC%)Ph zvaIlMDug|YpBepP%N)}qKns_-n1Z~5Fh_3I_!0hLUuXlxFjdX{Lv;?_PQnw1w6)s9 zb1yD%;DwsCM+$XSlW|*mrQS(*vh$JT8e2t7dprmKo?+GfXs_%1E1RXY{hzveu9~fG zk{Wb&P*fAFaXUY|xSK5`^*NI*I*=j>YPEJKkMa9$N))tiN zv|IJsdsc756XGYZZ{_XmY+g8DmY;iz7_czcxv#|O1${`@F5hqCrfKx{mdVFrffDod zTLmmTnY?xXbRnOGma@xgc4+IU>lu;V6@%s(*}VCTUwiSq=|`4gQhWbQkToN6G#-V2 zhhj1VO5r<}Kz=;qh5L9bu|@MpLz9GN{&q+O2QjCV8fq}G4JUHw#uaTajg)3C3+;0! zDNOa@W26Yl&P~fMQg{W863ejwBY6k?8eFF0Bu-%d2UMa>W)S??rA1<3h~UaN=fUU; zCh`VEq;iK8(W@(AqB;o6eB6agO)YXi^V}xHsd}i*eD{rrc*$3}^5L^HD;jD)sfHJ-elt5_^w$#!?%Do=|@{zpYG`X=P?7JIHHb5FjlnW1=e|FE#&Hg!v&D^BwCUh=kd&P{$@vHdaW! z2t8u>+dx@irAIWEVOm_FRfXp8liM@d*>N&0GVR_ZKhnGmUzJbg7E@?2D3^!3>QECX zC#d(ee-~yKt59k3mm+MVHRlH)P?a$Pm)pVm8ZsO0Zq~Xxa>@0%HZpND$huzM{Isy)xkTzRd zf4uB;w4t17aInRJ^Xp|A)% z`JLtYCtCet&yP29C~Zzo_0HCMWpv?O%4ivrZ6uKN&g(Bp?mCj;RQ&X;)XuqI?6ko47paMA(BBp---+H9aaXdm5GCx;{2F5(BXk=wXR0kyd(c*J zXZ6|Ow4Fx%lUu8nE2PP1Cso|d?vhQ0!KUP?_vr-wx|hqU6qOH$F)>=)AYz<(m7eEU zH#@ZD4il7zseYFi)gS7i+kgR-r#&wZJy^tw@t$2O;tHgxu$LCsEGIsnRAOI_X_LGk ze;s4}lS}gCm7Bc-IO)`jDm$kHK~Y!;BbZN)P@8y(#q7~AxF2I(Z8^OC0I zJjRWSq(17;EnJ-4NBzgQMsv*NB6KBa5407u)lw>F-x!zez}p~^mOX$J8~s2c^;gs2 zJQbu9#>TJf?xPlp0KUBLSxtZN1Cv*&wr5lD7n8%NrpVZI&{7e^ z$=}S|(;rxZa2TIT6VvcWrOX7Si%6@OzB*e4%Mib|nKTP+F#YAViruKO#l9z?Or3q5 z8#=o{ze@_RUzC&~xMF}9L{q!9#lz%;MJ2ELIj_XY)3Y-FE16TDIn<)OkqlcwOO*2N z*i%Umh4cJq@tOi?oX16FK>_U zzMhWmcs(D2`N08vQAW~)bFeO5xh~yrkz_6X8Pfq0sEku6(LvzvFA%%TpVEGYO`xUP zqe@(VeluNw$L~hXdyh>wR}e7>&whS{n4?{hl@F^NV<@}&;OT@#{8UL&aQKEBd#gC_ zMlOyh?!;V4K%R>Ki!d*1R0P1E=FM`JpT^nAk`1PAGm1f(``$(kMBvw>)>uU3Rh*%p zU?Lq-w3$4dGnxWm{cZbC9<3K4bUswh*yk_O^j1_1?f5`*tW9?(4oQaGn<`$1Tp9ujB zZG9`NNRyA6X~GTNBgy*WVYipI8)-U}mXA+9G$K|xu z(f!zx8^!>b#_04?<>D0T2fN!$#A3d zTm?mALZg5cx3F>;kxb@?U(!ViLy050q;QGKb5itB{a(wW-u4nrY(`({!%yUAHG!>1 z5zWt2;)|Z>LrLQw4*wrxZy6NVv$lKV?(Q1g-AQnFcPDsohr!(k3GOx!+#wL$g1ZL| z?oNO+`S0_dr_QsVed_&i(_P(Ntf^Voy6#_ht)9*(9n#K{m3B3-9>w2-;(3||OvUz= zP8D|90gtZ7`%m*#3}s^Ms^Rv%N~Q8NZF*eao`^zy6_FJ)f3fLJDaJUd^``YTpoU!B zq4UH3+7KX!w^_r#zE_=o8L1nbTa$zlb#!TbK@0XfuOYhcZd9#emEats)cAv zCG8jT>=Q+oB0zsZuS_Kx;9I?YWIr<-jhV--MNL9oNoDY&99!r8X?8|^9d z7L>vjkY5RpmuVWVjdxDM<~qdTPl{K5d)vTQ35UvA?E4*9ITZm|;GyrJePy72GB5Rd zG#l6RcI$gWv1l;v9aRyKz3W7#srJL~>ND(}nJVTR?^h~ISZ}@)K&0pS@<111#O+03 z<8_b9#$b47@qND%Vk8 zr+6rpm)G`0w!A%jGh!$B;nI1LdOiDDJeXgUV{#q0E3Kg!YShMy3oa#( zwdFUmi>VzDw=e>l=1QIrqXE=I$8Bm#7IA)CHje>_U8bcs6 zuA3obwK7!Dt$$g-$u##N^Jy55Z0~#f$sGvZMV|SA^)LWELV7m)SI2eP1&6c7UKi24 zTPw;~Jpw>RFnJka(oVdF`e3)OY;CWDmQ-#cV`_%Z+35*@{ZyY0_n&I56^x zXd$Ae=tMDhKJibpDSY`l47Y&Y_OiNnd;i^jsPP34 zLWZmt3WfaL&Lb25qgJ@LibY=RY34R;NgMJ7Z?-GOy2*Il$<5pyrfPTh+Ove?T`3i6?+)h6at!%!nrkb;{k<+1K~} zWmpCHAgw%vZc7A_TkZ-a5tN|dZrDIH?ZVJlu!}{SaV`;_py23A=k`XLA#Iv050RkZj4B411YxO65axQ&jJ?7Q-tpb+wgczpP$K9SRpH)!bsEzJT7_VXI9k$*#P z7@F{Ti%}XEZJ>8#Nz0rK{ls4__x#XC#U_FG2wtE!5>q)W5hGsN;jG5f%p9M>S)E;3K}%Sq??;iqxY+k%5`K6D&vQpV=QF?O09DB8`XI)7YR~ zSa%Mb*n(I{BNTZ%@H=IRwDO~lzb*kYFrrz`BD1bS<5Pxw=ub9%+Y_M{wKMtbFK=OI z@V9gh_IG%EfRIfrn$6F#L%vy;bOgi_fDm5tXY5;Y@UZlcg>5Lrw{*Hw)I&FvslGc$ z67=Bb!0PXFfZ;hEIUR<+{rc{AyS>qSVh+Fa3AHr{v$9 zLyldIjf#FczTXWL`h!WsPT$v9@QkjAPI&p$7y3k4a%&FE9IMs4Vyn|NXS5RhN{`VM z>7oXdT5cPXFWR{G(|uHkCe}mI+c4x7@9SdBHeiM z{Npo9;`mwJO^{P0Dc~F9?t$lYcHO`W!mO?ewiCRC#i8f)fkbQQ8+8ZikgE_*#`eHE z8rd-RZacBO$fY}9>X_dcyPm7dI%?;k)7PfX?b9|R&f6_W_U-J)nk~mzdxOaA#Pzc} z1Kn6lvkkPrI*i@%oX)W$?G9`dSC=+Xc=xzngES+^-9uUgK=G5F_wFY-(SIJ6sV#+m z`HE&zi*FS9%CX7T727$pAOg87B^)lR55phy87q;wfi;vm_#S-{CqU(RD&dHHzt>bD zzpi=eUV#H=bu3`&w6ho)f-OMGiugy(`XATL$lBsI;7ed9Q((b|ZjAn_gmaf3g;ETy zl(bgJ8OKKhz%hdFQwYq`RfGP8{M)ZL7UmQ+eN3EkCD{Ix*tK87t~D)qK4WN)b3cbS zs*R#z|HS7ug%bWeIJ`>~8{mTj%|uooWR#EtOpGZd?-WWDGryB0H5LngXd;}mRdbV; z`v~_W)L}AN^Ew+C+iQ707<(Nj0qd}IlCo8tOc1?}0ML!l%Ur+};mH#E$^CnEb@-CE zteB5TT_Knik<&B}<`N!?=PK>;o&o0=M8*C%a|Zhw@bty~)1=P3fA{>X^?tF~3TQ8~ z-QxFvf6}4sdpo|mST-v4&&&Ks3P+u){In5De?0<;A)@PH6COnFH-YyemuKKD{1fyj zYgn=P3HC=lk-ZCA^FGMMvRdnE>(PFvi|DV>R;KW(M!MUlX^IM5@+lp2FJYWIu_N6K zvDh&)q+!XW{yunybU-g}M+fpF6{P9y!E2tKOF+?D^JX<&vxtFlH?!kfLQ{rUBS)ut zy@;;|=nswHVM7>Nhq)^;z5DdU*WdPW?f&a*TVp0g;}}K}T&JAt0iQCqYqSa7-3X5p z^P^f{et;#+Dgl--=lp?0Mj=?jD8sIVcp2Lt3?uHQRkxvT4P7l2;0K_#ljRA!UThniaioObk)`{Mjj_c%sBU|vT=QclL_J;M z?m(A~of+ru|B*JyadUjcbB|LV;us@iXK=fDiJaql#!swHK}N+lq|5Zug!|*e>S~O` zSA0WLD#q7pyX`_KsQ7!`3^cGe9?%BBsFA@eV7QabGOS+dL?&dXXF*mPMNgqwfMRTL zozXG)S^8}ED$@2mOnLkuo-q5Ror(8FN>XjMGdOelth<~VdI!R&Z)%3-&mS?vzDn=B zeZC}pc@m+hKnote=lEvC*P*99QO(8^zQv0TGEGrXWUfWs`mX1fL=IoMkROCqAGvg&_Xtx7Y{}80ZbKfMLwWfvos`v5AbB*Z4 zb_Wzu&(Q@coQTxnxh1~>4e9Fe#Ed(e>+sk;I}LSKs~yMxwu%S)x)0dbC#~WGx~gY> zSjEr1lw|mAz8>wa$prFP^Z@E^NBWE>=pRzkOj4@|b6OGi4+T1+3Kt|HFlk+J3vZ>f(c9l&?7{D!bW7B=+&>T75V%Xny}PE>vel3HsI71EhCcB^o{%;fh{^Ys#uL zW*xahAz5q<6%u@A5%&;cM8G-^F4t@(VCUq&m{EBndEJ{LA5fWW*ZRVXt+P~LA^H9S zvyOcDe1K@Q6~1>Ku?;9%oTp+6O88=$ImXb6?(mswCyP zFsJ&l44Y6*Nt=}>+deJPmS};PQ%<%Daf*pmZUrrD>(zO@tMswSB<%KV=AIBwSPz?^ zDg){*ZYyq%+7j||IN!>nvL&AVeWL^E#_Bkh?2_0cW-4?HUWwO@?u+&!?D_GeWcBVY zLbjKj{^Z7=ttd%H43=j=h}Gf)RDQ4^UR3r|MEgFdQ{m*K)gF?QKU3lpDQcEfi|vIT zXqVt%2+un|3G>Ql;~6n(x(-*y)(?w zz@tYOPWG*^)vbx_{Uu$Ho=%gaI0XDk(@}85En9lZOa?0=8rNTkExmO+l3nD$R>HNS z)t;B2ECmQ8cmc=`*Yj31#aKM4==0?ctcRZ8&^RfD;zhDsMF z{9xfvv5+#SqeQxQD>6EX&|UX*rPoy%7viG!KvDpB8=`#A9x}=`?Qw4n|9+;>MLBy- zhu7l%34GIhY=3BDY$eKMujzDbn>D-2uA8&#?4QS+LFk5h<;jG-QuQ{XPvJ{OTZhAh z0DjrGGDW&j%EckSpml2H-}~POXd=!P9UUGQpk4j1fAmx54~Q-&`IiW}03;W_OL&f{ zwD$0Ap{tA-fS`}h?@QBs&=Iy|Y&XtYYtfZWTG2mti}L%4B!8Rl9d#nZwM|{wT+pFs z6yt<~-7W@BnGo|xzj(EGEfiU-DxzCZ9I?#C5}d@0?!88@C{-X>|`e3LClN zNyzCUFP)aU!Bgn51d^MQ10zuTq935$I# zWEmIA$NMTktMZ2VaYF4CM-e_5bok1u!4rBTnRNGu+mz9hfqA}^Tj67F;kORlo>NAxo46vxC;d7_$1fX9G z?_j2JRlrU%(U{nNJJp1!-f5Z;K1rG?Hyhz}-<>4QfrFV%xCn>b;M*?aL1f+SOjd`T z&&j-KvTX3pz9*OzSc#^4Z&Yf{j?xF(JGUTuu`WT`T_&t&C6i}va7oNYiKA?%V1 zpz(hMw;#&FLh}=q3sP)|q0&i@Zdl#_g6MNAn@vWRdB#2CeXY4^R?^DcjxyX*>n-+t ze0jKddJ80Pf(;+HK1%?Kn&SbgaB15zFT>4u$^^52kmZte0B>t)a#hu432JAJ>|s7* z3T&EHU-BMry;3M<_3L_>cR1|}2=Z|uaK(=hOZNo%2~UW`{$lg6f$xEr;NM33a`*Xn z)$iAvH-&3avYE{}|0cl}TS)kZCA?2N>|NFdzaF9j+e&Wa;khhsKAgG$Aa6EU?=zNn z;bYgsG{2*kkR``2pswQb3cKq+xt4VOl)2y& zR<#Qs6+PpXgyV2MOHF%}X$35)jAcPxq2T8|EEq0IX+uA6F~GX-k?L6+z zI#;i;o9gpy2=4TrAI+!hIb5pMSYveN2D@f2lyjox8|w(%qFm>|9gev9Y*nYFsI zO#3;K&K%XLI>qZ(k39b%q`{T@)DvC`@MT76U8R$;({;E6_ja2R0EbTEU&MKx?zt^M zc**Iw9fTk6P?PeWxajLQ+`^^LWA*UG0bRpmV}GxPxE5!vYM$sOE7{6J0<^~|3tQX4 zA{5-&^L?|Y;?3-fA&xBW!Y-1Eddby6CUiCXTg2q z7!4zE6Mn16e%aCXs$6BOo=J4iN)EFuvsJrNPzhIBdtysCacGh*GmAHh(|APic|11^7OvIwcT_UB}ax=h@oq^a>p6 zozl?~p`%yO6ZToep`l2+4~Egaeu@lPq9Oc+L-dCH)mm<3b!C(*-MdhJ^M_!a>!MR~ zBj;@MpVX?2jKYHH0sd(3daS9}=i#8O?BHN1ISS4?_+EGKlq3d7WRib(W57seY8FdlbFbp~W2I?4-FhnABGxv9dnzKik;}FEG0wHOc6eR6N~tFHQ0GX} zot$NulAhqLh_@>qiHP_;0XN+Vs{=GL&7eEf40&*|rj+^nvCe^w!WImkb zQXC2GD@-bA&Ued{sQ`C(Lp|a@dF@vNU&4F8VF9}KG4VpR7#Smudc;U^BN@zTQBP9e z+FIq&W;YmHh15Hb(;Jw*hkwOE`D;0!HTIDxJs5Yula>h?9W`XF9}NuA@OAu2sOTh+ z;VR|jpQ=3%&{&?($|aF4I5wFN51-J^JD&AJgX@cgY>xfmlPPitdHx;o$WYSou+h)^ zPc^{6dw`RxToGr~^?+jv z8b7rlS6jj2E|k`*cdGg#l|;O9u7_R%oP7-HuN&L1=GE~oDD`7ExH`nut78xK-@8t0 za=@Qx#adJ#OBt8>OXFAf#T4!g>HbGFrz^nbz*PlDY~{4BnBZZG2e7LB})DW<^HNx zL%$&};UYBu#;S?PFP?YgR}(cS*+#8eCjL$KhPOj9oh@nBfXeLRrmvlnbq8h{Ca~S= z3V4n?^-eyC_siLzeN}ir?tQC~e{l!2obO89WUmcszzpHTF2-;99aUJ}5r4M|t!=D- z`EuBvE7=pg#_RNeDzx;~EVRYp=K^uVgLIBloirjJrP%HOu>J1j4Z)X$A;%<8KDT*a zdC=l>qvEkFmSSSIy@;}>PikCZasWBCf$>^8>Jw3|y^+a+=$`#*m#eWU=*J^qzFb(e zIsaaG1egbMQn+sx-r&f;Th2e$6q)gPEEh0YA0E4|>kyW{ZymfNSAXdNR{4K&{J7re zHFQ*XOW=M&CYvbXH4!;&aa-^PZE^;E=ptzHUU(CFYx44=-Rb>18E4|!Mg$pq;+9uy zHCdG>O8=#PvcDTYlfnrC17_gZMLcC_=#+`4t4nl z{F0d0g<>t`kM}wWo5aN3)&om%s6E!V2ct4~b~DfVYHSg7mx5Qx-{t248#r|dXO_m~ zJ5~L(wH>?<$J1A3Rq3%50$a`=-5bYmS<`2@W(#*Z!&SAr-9(0|OCbjewZ{0y_FMJL zD*ODkZ(V$j{u`0CFP9$V-RF(2r)1d=yGo0!4nm*wu_FoFLAH zER(O;EZ3eTxX`rB5yTLXLxiE*6N#e4A(qMKIs;+ssR8AuJB{~b${SW`+NJ@f#CfpJ zjsZuNi#_Kz5sFsEj#i{DOBi;7Ru8gw-S144tLVOe$eix1?26X41urt#G|=h%a z^^mvqPb=W2bpKuW>CWE!{rcuT@M=7xr=}}tN>M0vYx-ICA+G^2ulMHPEqOEhWwIR( zyc<6psn5`@b!+vHupzhX;3VfCsL)&^i@CeZiNFUD9@jyS{o3t8E9dWu@5RX9ZajQ& zG>r1>M8~_1r%v>C^ZB}~*`bhfd3h}eywc#*u-ySTVf0BZOP|BODja109!C7q|HbTL zrwO_PKewO%I5Axa1@4uq0|_8GO0Pz%$pB5Ql4)%_sLS-NRw6BXUtNODTFk3Y2VMNE8q zJU{6GDxC;cNCzCWrlU<`521$gu+kfH9Q%~ps=KBR6qmAorhU1*dGCI_zMWzMI;kH7 zHbef_qlgGLic7OznMG<|2oQd%9rIoOwg5shcFbWP-wQhVwZL7ew*m4vv`Me;kPj?< zWGB#C%s6P6@%ow-cd0rgZXw$E?Rd`YcYozHfSVb&O3!hj8(rq7D5yqlZ&qihRcg1y z^5aSD&CRYCd?b8dcu`f!*UAoqQ|J5sf(8w$#8N7KXB@pYC2QA$qdB@Z6vtvDSH0!? z*Q4S7HUp)MpO)W_$<-yb7YE%|m>ONXe`*?~VQf0PPg|is8S*Vw%kG~G_GU3H%wsQj z0`z9BC-Tfr3Zl}bdz-IPB97M8S2;l(wjvCv-#3Zt85MlhGD%UJdqlf3sA+7Ec zpt5H=PDUR+r}y&!i*mHSq|rOYiuSiJJBg7XNyc+-KkI@BG!OX?`zc|%0j!13Ig_8W zz00CMXZ`bsGS3$L8#Z~ic%VTpCE>XNu8AwVMNsKMqhdc{+5KsQX;Np7R)QbAbS1%T zC7}qg%!w0F-oBRm{ns03LeI|YWZ8vROX8Q{;8pnH@<{T{@AmIZC_VS*qtRc320Jbo z1owS+HD06N=!Ye929IjCOklmf&wPxP4-Jfq9gAqdYge*wf9r8~PL0Kt)w3nA6G0#J z9Y-xk3ftV!{*}9Q3d=Ybzg+c6gmTcAS$Vm%-&nF7kU&B%B8lHH6fi0(Bp|V^?7bcXjVMZ8 z0N?QA@wF=XHab!Ix{DlIdh3u}8TTFcS#Q`pGSmhP@~YS2AZ>Gmjy)rV>0v1}8H(#7 z$EPa+bDhd`D4iVz^I?(7mMaNGFuny-QdV~Ji7?1V0ie82g|Z&Ywac|f!Q+aTNhiMm z{CiS@xhms7BGeMC7bPXB5BaFe3^#tIDLr;Qa$ExAPfe08)XzD)DvkjWYfwdfWASpd z8UqP-qj?7)TETC{a^j8+!V|hmRr*TBd)jh<3+{|?ZN1?S2nzv@zS075HMLbwZ`6lF z68zMl)2(R+;t6k9wFMi|gC8)YKi5s5F8q!lW+q~+H`%SYCQw*dMa+y^jTN(n1@e(R zcBgEUx+8d%jOa4K(@|@W0vYjI)Q4Sj)k7nBG?Niw0+PPo_ZfCCU7#gwt=>cv6#}{>2j^q|C~wHQ z<*U0r?C|91e!wq&6z@jxVET4Be&HV4j6ED9`P#cNk}N8F>JE1(@8~-mQf(6c?ZvV}sNEaMRkSZ}&XBWy8GjFC|c%wW_W=uojTPwx$VWD$;u zI7K*r>xaxG4E3j{ZTvY}PNO>%=(e650V82@b*O#6O3dtv=>kMuA)le|D(%;z%=qfP zeV$PFvWNT%kwi8MWcw&We^_#kwpeXZrB}(=tF2fDB%7t3e1(-R5V>WTh0I6?Y*o}@ zYbGgft3Fb_(uR}%ShPuA5n0DPTQJSQy>hr3rr5z-$6SDepc#yWZkRPDfjAX}@x1W8 zV>^DnV@X-ap${I@@PuYrF6O*^@<;K3C=-;x-MDTrhSs_p63btg(Ws{Mva{JAF2bJL zSTb7t(o=SrVwL7*eg&rdYtYJwvVf~6_ z)wJzFU;DFxC4F#3>5e@yi=h6qdHI{pr{;xLwVg)N1Yc-gan-jM)KA21xE`CUl~}IW zZt%O{6?&bq^z(>hDS$yIicD`-oJ1pU%q*f(&T|2ewQ!>@=Q5n_(L?B*@RreS-aLgV zY_)~%FxjJstdn>Xydl;qv<-TJ$S;kO1d+NQ9h^4G6kqm-URys(U#&g*@f&(NTt?t^ z{{o`8`O5EN<1bJzjM#dfJTA-(C#t9td&yPA7xN~pwy7i&t@1ODw%B?56410yS?H4F z`>)*-R|ap%7IL1?U@`87hmE!I7IGRVr;7&M0;k7+=SiDrwj;nvfsPEy$? zqmSLD<=7(p8(&3sqyyvFaY6Kn2|LQC^?LwHrC@fubHkulE}Fh|&W_pq6ikyhz76Y~ z5$7tu(JzX}agp$p_(jiz1+@2i*Qi)K)Ogt+Byv9egyRU!q@Wfe&qUN;)|*zukWji} zf99qB$r+bY%VlY5wf8f{wp5izLORX2MlZAg&cRb`=ClqdKh4acnNXu=Ub*QYTbc<_ zb8i!BmJ>Y9G?X<8!5E)Oa%9XuTS1)5IeqGG<36hlSnC8X5}-ti5k6Dq54p4oYB=3T z9|NX`(^&y}&mcwT2&&XrryB7V8|a+!TqbkKkst5TWr}E?hmCl_g%JE^HrXa?Gu7Fp z*%fQ3FOEL-JBmS@IA#S#$yPsk4hm(F4CTu%v9a34`5*{827yp0upcJ=^k$yYa~|a# zap!K*6<^*{$Q7M*5A~K-wna%c*Do1wjZ*^3^|UlANSu>Ms+U?rXI>$J%3k;Y%h|R7 z^W@Crmk*aIh#hRDKRpFAWwyDR3%>8E!Di4Q5kub03abASRuj)2g(>_jk&iWaXX<-2 zwNT(|+d}lq*H-UKl1QdIaWtem+v^HccgBGm+%`~7Ar3N??e#lR4%>t_;%vsjHS7tn zvTF-hGX9yP)?f1zr&^KBcVU%Fz(#1)M(Cke;tq{fn>!zjgCJ)IqTG2Nb0<4j3}Wsz zL5-7Fi19_oq)Ir3zc) zM)`*l=*Hi^oA(pBE(6N@PyxyqWH7W~)TA)95+`Wpj4>p6)bm1hy4YNA{Ju`^ zU`jSKxME7CQAF9XT<`f)McGl}hg8^&D+KnAFcV~!a<1gQ3!7Qu`Bfp4XTpkUIvNce za@9zL&wT!q)py865CB)q{rtHeHnRQ}PfT+|pW?5hs-{hoIXgN8o(97%3Z;!xfD%ym zA@E+;Bu+IW!#p8YA&G>3l*_6~`B+I8;THN2;Y@3N5q~Y7WhT-Bm%{%Dr4KOd)rmadpOByVT(s?x$35m+hvUVh*y+SoFr}8}3U9Ln&3LmSG`J|bV78nv# zVGAih>(oZraz+NJ){F?LrUZ^T&5Ra8D1EU{nvUY1G$p_xix8zRYdk zFQS4f_UfUF^go&Z#HAv$OUJ!ZB_5X8a3Dc%j+^=r1a}V&1KA&aEuYbD})9m8d8ehP$^A7ujH}W}M|dwsnf~=u}%ER9Cxm zlj&z#G;mt3Hm%RcyyJe+{je61y2QO76-Y7#J?HZmGI6TrzgHA zvfpYL4mWBbO%Rp(Po;!-Clzb+-jYskW*AU-6hQ>?4yTlMPjk2ak478mm|s@Sf9^r_Qe%+ zeobM%09Q(uxV%$iyloXGpw_tOh`Gi`c-Z^Uh=KDVF zXAl3eDA>FVq<~{IFCc>1vl#xw;v@)^{PBqgly}FWs$l7BT97{G>oDAq`ip(k=*XN< zCj3N^6xxHBLp8haQ}|c+Gis3Udh6C~GP>`KPB2cgFp}*2SsxX3JWwr=3XoMsf~k&4 ziHoT&a-XHxDi$^`>vLjs3HeH`d7q}obQ%|>Lp}3!6OhM#81sE09K9ptv7&|5+>~&suAqsOS zB*AOr@=mv|Z|q}*6AMNYJYbp(>`3TfNBVgG1L|bV%3pIh!gV?N?TnHcBq1&YaRw1j z`d4^G+O*t)Lt~sRGr@HgVBM{f*tluZGzt9GT{g6t8lCC-f6^T@=s)T%_J0zd)c-?x z|DW#6)c%|9q`*iuLvXcas#0vt&gI?YL4Q4)q)=zSPE zTG{^!o_ug~4u;MGxO)Ly;-*k*9VdTA4I!#qft70PS7sDz98eYLu#PUp(Ba7d56T*Y`-bVFHCjBZb=Q~6v6RSOrKb%D({m)T_ULr^y1)sQO26tNQ_QueSeqc-c)VFqAsu^QM0u~mf;w*OsH3>$CY8m1zLz5lYcZvac1_gu)UoayVzQKmv zL##q;A)Y}l4IK=V>6#i5y68GCT!PcAk`4UNu)pHmsrxT+@>lIUW1+TpRf}JHw%F4 z;BFAOWc(llnui`Ig5fc3M2@kJ%+(CBjxKa{pTJT84`c-o5=pGRcf3&6r>3gKk~H>^ zBF*Gjimw0*QPRkf#KWW9WqyHk5eU{{WC2)*K!i{_LnR`&g%4WCyWi63?|&Guq}?so zgUQSxWoFicD+-3+KdYI3JIBMr&!k-hk=SnVYI(eA&f{)e zJ;dCl6Z6_zo_-$Cn-IktZ85vy0mg<>0F;tr`Kw@DwCz>tK4ZIRBe!FG)-o`@MwWKz zrDshW4de@=i`)5|REygvCPCn&TKPArs>g$qY9$=?f~lkoIH`W(1Si!=(EpHBId`g8 zLEDID5Lwe`UlIQSGrj);GZ$@~ec3MKG_#GIb%&YCN&8xGp%&Y%p9~&VARp8WC6#?7Ff-|PeM*FP-4{$cT7{=uP*XkOh>F#h#K%71~GX{U-ep|)d< zzuS&*OAhC(t$%{>A?U+Z4?vORc_@SVsJALj+Ugu8$5SV!tBvcv8xBEsq`5*OE<7r&-LGgA{mkkAF= z_CGQ24{mk^*CoK=1`gQ-%}Tm-9t67|*7!IRXhM}R6Ic@ahgkrcbnr++@CZLLle4wW z+$QNTDH?=WeOMfe8uV?|#%hGfReq9V<6Y+pt0-EvrriXr&(#(o&J{zv7-(AA;30S9 zH=tnx=Zfd=7U^cHwy#q3^Tdm3P;U%9E5Q&I2tir7h;YE4X*Fps?roFv!72}!k4==n=5~QHuznpTy6Ppi%X1F?9&4%#M`~&( zZt(vbtPQ|meftks!~F$o1mBo~as)6~H(L54hk(Ia=sYG;%*hFLPE9D}FIb1Ct+OUV2S79rQo|D_#BH7i09d1|0@o_WjZ*Bz};EkQrxvf zUZfVLT1*uhNF2i@5)Yks&WGl$5BK>m?N&I0X&1p8OuLXOVA{RZ1k5&SP?$kL2 z{1hont?rk0vqs~=K_IPD0Y@))O0cs{P8n5Rui$i2${&@4SJN-3CTjRW%7Q~#maQb34lIT&Z#2*5b& z%mK#PHUbphPAR~13m1Z^WOWJ-GqkxvW02xs982lxc7 zcr+Lxj}hhRgHPGTjD-{1tIO-lBnX~@kh^fG5b)BTP>`R>ZWc`i8iwIO=8a#4Uj2 zf6tpNDiU=*%nut8ONp!$)64^rZOv{i9~uxm^)svWTO{zZsf_R3?hvS!ZL^wf|Mc@A zc*dBP-ynO+k4iLYB$H?ZUJ#3N%V77uwgsCnxA;p6Ezn8|@z6*LDQOt3S|doo&L}q{ z&M2dTgOYO9_Ae^fl!H-WwUYN=VJix5768}5-Id^y;s1dOtG2A*LH`F8igHti0STV^ zh}af2XxqwQyYX7(Uq5Ob+E&h2f;gYo9fsLfjt3v2Tggk_mwWv2fG1JkxxCJU8E%u| z1Q9Ba>Q|-MCsEHIb30{Rh(9z!cl5}wnj}l$cmDc|HM0WZTS`|NYnlrV*j_MI_!cp* z-FK48U(p&hR%>7SE8L({zE1$eC{tvD1N46}Xp7;JZSempKPX&0Q_}h^CnYrU)arVG4t?|?__tqf ziq^49Y3_#YzN&j^g#inZ&af4>(|?A;p6>WU8~`H zee8HMft5y0tic-jPmTMfgL!FWm6|#YApuVf zh77%b5bk#PMVsmeKA5`bi74YVJyc1k0C zAxl}sl}z<6hEEo_0SI}9gY+=GKk|3Q0X{Xk%V)xr><<#!l!ik#L{Iy>VpTj@;?zD_ z_Qd}H)*epK(TU}#D6cAtvW#Ym5NyUIQQ}gGTqD)@S{kINGC>@_dR(T|jG2$%eox&N zr$S||L0nMRJ=Ib(a@Vus&M;w%WSe>cyhzmVIZ3z9le|5h09JpMa_zRchV2fes~Cgd z|KRC4+6VSee8>}q`x)T(v)rLE^_o{tXb)?mUPk%5%Sp6Woq)2v=L>ZSFU4=YCCW-_ z)erAKikuxIf4JnZs{lxoEZw(|O>)>a!kj~{{R1v{{g3u*f9A@)Lq*@Ec z$9IcOmJUsB^8vQKYL6E4WihuN?>=l@L^HFC`x8ZkS22syb$wQMpWPp6XM!+zI%pw^ ztgw_2l3o4dreppk)#!~+Y!I9BfNY#2KH;~>#FTm0V_13vH(!PaMDcEbr z43agcuLCwV;rd@lzS;YKDF@tq+ce70E7=^pfG@pg(&|xcjq|9?!?bV7o$>!B-}t$^ zFZZ_b>ts2(R?}Xl`mDtwr4J7bB9Vnr>zR+Dm9sTno?*LG+3Gy;j){Itu-;j`=zw)| z3{QW+jMP<=jZ5Pyu@=z%P)$tj_AE`sQ|1YEv>jmlU^WP3NEe1v6v*r#zAzoDr&i8& z9uZ_MMmY5@qb`Fpw?}cg)3!^d&h^ zV)Pi+!7HmODes^}Z(gBxW*R>S;p(8Jh5HIfeqn@e7YE&*yajrCQvJ!xO#G5b$zQt+ zM++$JMU&mGw&@)5weq1Oxxh_{7ueYCZdgyKH_=Y*i(=6V? z>&n#2V$C#uT))aB{najVae}dXg>* zPE|j|jE9>gfbo?n3+7&st0Am}o5eZ2O=Ly3B?|MA&I;#-Z4fS=6wiXw;-Q)r&qA`L zp0a65vU8G3I+iI7*YuL4Xir2caiN+Q&!Q^5D_#)KVl3QDwx?7|?(^08B^9 zc&QRU>-@Kp4|>#E`#?Y9yksZJ1yVYdBH`jq@ISYDgFl_X-e(Fa7fbQ7G?bmA_(?6# zTEdXDN6LXe>wb70mxpYN6!s)D8_tc|XD7J;{#?6maR{ABWrE&~cFv%{y{rKq?>EYd zY^8gR=xi;xpELYb%!k;O__N#qn=C1*38oOXl2z_@D|ea=p(3^qtrgu#-EApq{nySX z=K75asV1_EkS(nzOWAg{?N2hhD%Mb>uTIau&(cn}_pFG2v-mcD-p~vNA5mVvWvih_ z_~KVdgRf%Dx~RI(t`8Hnw9812sL^YEAjhQ`er`XJ(ZS$`P`5*1OcS62u+BSQSK=6l z0cDJs%HCW7u7lI(k!{<9KBiZwcTB6oQ8iF#iZ19ZvF^Z3+8$OK>NErkx`+~gPWCK( zODJ}uFfzX2&n(}*G=TYoaa{q=laZ|lN^D<`F-cq6DvpP|z-E~;WP=NxY9Q(}F6-f= z{TSsf1FD-T_=y$_`X$l6SYlMbVvvpiFgcU5tK98EfWpHH^GVZrNPOW0u1f;Yt+ zpB(Tfxjp0ySk3*S?}&2nqk>a%e?Ki&(*_~fSRZTmCdF-JExeaGsG=M-6wd~#DyD(- z;n(DWJS~EOsS}I~a?=w=>!)`PK+R6H0mVFNN~O?1!TCG{JAz&*;6tu1Rrtr`3s!8h zy>G`QnfRoL7D6;?g}_o~Az(7RCuz`YPI^docSSz@KD+Z1IYB%%RG zMqLrq`_2f^GO`@gugSl=`M`NMY`( zH^SPok+TuPWM!e*lzQarg^D%s9TM$ziL+F(h}OWk^qOp!)Q!p8D^gyJtwIie_znS& zHRi0@-5(yy^wmtW!Zi}S10C^|$Ll>66l_<~&jg-DVmQYa07!g$W8|1}DK?82Z?80AQEEyA?Q4xt6( z7Fz7%dW#dx>onhPonE<5mCHvY9wn&fe#s_BKV>c|^=MN{Nk$GUCt*0%H2ZE)Rbz~% z>xeRp4}~orKsy;eB``O4FwbkZmxTI9k7_qk|M#!QuTrRqy6ugNF<~cBg`KENWdU!( zsnHCAVvJUE*c0|<)gZ!SHC+fV?AZKa9-5+VNZ-fRKLqHe=w1Pgo9MNEtOZI29K7IuFcitrW&8m5bDk&!KsE!e+6 zgPAO@g*}rsOO@Hj6NYbwgyEaD$?>d-WySE#+QO0s4Bu?Zjp3Uye6u-CV*O+IW(?n4 zkuZES@uLdEHy6?v1kP$0qY|An8p;U6Hxnyjst z7`~bKw1I!&n~5J~4p)QnX$nO7ir{IGgyEZAb7J^rmOKc<@XaFCB5hX9P7L3yN&eK$ zCi`Ld=8EJ)BZhBwN*KObpT4+~QN!|Z>tb3nhHoaWez(O8-+XvFk=HItjWU|TY&?3I zgQ(M;L>mw_m$x7nZQ0Z7>#OW4I{D+g58rpuP;72o#45uNomJgTM*J}0Z|+v#tEpxb3%?hk&5uP)A5}>2>M%KhOK;eSRHX(kW`AeXCB%B*dyZfEmm9AVbw7Fnf#7Pw(^cWYxyazoX; z^ETnZ!*ddiXfHbjlI2ikH1pA+&E|+t`S5>gdv9~UJOpJT1ZT3IRPG!VTZ37Q)EA${ z7k-lzq+B$k_|&KT^B(ye&MFx_6wE2JQgPp$BrCByF}NRlFjN|4V15}&opduZ&D+Gd zJmj0TNhv?&pXB16tyku}ujBGg`uKm;(DU+ylW94fSW4eK^DD2*E9G{thEdq>_U?aO zuDLFqiBZaGgBaA6@5;>x9oG-onbqz9Dv*n&2=XR(kD?c6U`1O*%nsLfpZV)7| zM`I$}+Tf*SO&kmDpWSC%dJhpoEGU0WlwOO_5z7#C7aKDi?Bd(z+B>*5H#tdIj?FT*+_Q%SdRQq)J3T4Q z&fD~Iji&9}vVmnaqIe#%8KERKr!f`eh8VKjgpNW%7Hnyvqusku+2&82#bLhcHw2N2E0JV_@Gru z^+Q(2U-gnRzBAGq+Jx`ZL}W~JX3vZLx6!Oly7^bpk#5(=M=2$RoRSW&{ag;zd*(`K z&z)0c#BE&SeragNqDagb06Twt8g<+$It6GDfT^%i<3mg$Ds?C0pht_7G<>K7HUAw) z{bhHOK&FuWRk$q#zqi0TAL4nqxB#2FFI-hM}tO9v>J60DGzccB*?&?*$kKjiA2WXyOOlg0z9E*Wiv4SxpytF7L zk8-s`FmZV4a(~~)qv%SWAz4~L^l3HEqeY)C?&_04pVl9EjDb2`BGU(Tx>VRlU>hP4At4f{o;86n$S+%~U!QEvqN^Zj8k-mm} zE153v`{z5$=p2KAV_KEx&-o8Ae761RuU2RX>FcAJLRzK_$X(;1u z8$v1|ZAfKQY=|#NQ)ojPHHlH2&{f)x-*a}Hmo_PF9jTR2MOxdr=W@AweCNb23!OQI z=%Q|>36V2(x}mUjDInjJXBzQY|WRqPgTzV0dm%eH=E6>Tn)l#y+}cncD2|HL-Uzn zbDq+PA%+j)k;O^+HZJJQ6+Z4GS27yKbe3avmtE!E39B3-;GUq-mzy8R6B8XuoTZQ+ zoz;bUVGEfRf@9VgqTHvn*Z@{;Hm=yZ9k`wo*qNiS=-WVUZt4UU90SbvnSXYmkiSZ! zkUOjrw+hKs!4O3nkV;umw8s(rlSGSlyzpm_u(CG-I9XeJeX@AH^%ZYeUHH@nJ5hWkdJ7Btzd{b}JkCch0P}1;oAF7*! z>9dCvk*Cz=yfl6mjVeR*3L|cEPL;|sv^2o26tR%piSxqKq~=bPX7I1s-&KapogS`Z z-SFD838i8ZcNM`{6-Szhf)--2;Tkky?XDvgyDt3DV9IO%iAGQ5@vPsW#gnvMWS-tSQ1P5 zX{nt~|L4uZc|nX|m47}ZUKS=~%X2|}*|l4%ncOwoqz}Z+uOOtI9|qjrVmvniIEs>-gg9GhY}-XAO{rdVp$ zvFr-VsVSDz{lRi(isfv7u$-G>IXA&VM5lr0$ac*^a$N4YWq+isjL}AjQB$0aaJTamo6;JHHfB9AGbH?jJ+zpn4^?yM)*od)yGkSwGUcaB9SV?_&4jN*JNP-s_C zw+$#pVZI$Gls&O-aB1e&0E0P!KXujPV+}Qw^^h3_{nnA)Il&Aw(Ced{?|l0i>d`X#}N?5R?x~)VRM diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index fc278aaba7d..18337b61af8 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -237,7 +237,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox CDC BloxOne DDI & Threat Defense Workbook\\r\\n\\r\\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \\r\\n\\r\\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\nSupported BloxOne Cloud Source log types:\\r\\n* Threat Defense Query/Response Log\\r\\n* Threat Defense Threat Feeds Hits Log\\r\\n* DDI Query/Response Log\\r\\n* DDI DHCP Lease Log\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS & DHCP Overview\",\"subTarget\":\"DNS & DHCP Overview\",\"style\":\"link\"},{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Overview\",\"subTarget\":\"Security Overview\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Device\",\"subTarget\":\"Events by Device\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Domain\",\"subTarget\":\"Events by Domain\",\"style\":\"link\"},{\"id\":\"2e942b67-07c4-4579-ac5b-f43c5b01c51c\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Filters\",\"subTarget\":\"Filters\",\"style\":\"link\"}]},\"name\":\"links - 16\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9878ee10-a66a-4438-afdd-29789d76bd61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":14400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\\r\\n\\r\\n---\\r\\n\",\"style\":\"info\"},\"customWidth\":\"70\",\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"0 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Device\\r\\n---\\r\\n#### Get a closer look into where threat data is originating. \\r\\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"12793c1f-b77e-4319-99f6-b6b4230d9cfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19099936-395c-4ac9-a462-097e6c1fe50c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"2d6b86ef-4bd8-4afd-be72-83f7cb365585\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8e48699a-6c2e-42b2-bcd8-15cfce54fe4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"f57d037a-57c8-4b7b-93fd-8f6215d1c9c2\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Device in the chart below to further drilldown the device.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Hit Count by Device\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Device\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {ip} - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Feed Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Threat Class Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Class Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"group\":\"ThreatLevel\",\"createOtherGroup\":\"\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"label\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"label\":\"\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"label\":\"\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"label\":\"\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Level Trend for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Action Trend for {ip}\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Queries for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"60%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Queries for {ip}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {ip} by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"80\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Queries for {ip} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Events for {ip} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Total Events for {ip} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Device\"},\"name\":\"Events by Device\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Destination Domain\\r\\n---\\r\\n#### Get a closer look into what is being queried. \\r\\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d2856d9-b23c-4779-916d-abef2e4c50e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a5663eb6-1030-421e-a60a-6af9f4af3f99\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"5cbd5c34-3703-4835-aa3b-228504310c1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3c67b4c6-8cf3-4c75-87ea-4bca83dee296\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"730927d0-a8ce-461d-b20b-fe9cda17c486\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Queries by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Query in the chart below to further drilldown the query.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Hit Count by Query/Domain\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestinationDnsDomain\",\"exportParameterName\":\"domain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Query/Domain\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {domain}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {domain} - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Devices Querying {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Devices Querying {domain}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Devices Querying {domain} by Time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Devices Querying {domain} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Events for {domain} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {domain} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Domain\"},\"name\":\"Events by Domain\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne Threat Defense Security Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne Threat Defense security data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1eedd218-57c0-43e3-a306-a716380b05e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Threat Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(ThreatClass)\",\"size\":3,\"title\":\"Unique Threat Classes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_ThreatClass\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Security Hits (All Actions)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Security Hits (All Actions)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Allowed + Logged Hits (PASSTHRU)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Allowed + Logged Hits (PASSTHRU)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Block\\\" or SimplifiedDeviceAction == \\\"NXDOMAIN\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Blocked Hits (NXDOMAIN)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Blocked Hits (NXDOMAIN)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Redirect\\\" or SimplifiedDeviceAction == \\\"REDIRECT\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Redirects (REDIRECT)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Redirects (REDIRECT)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| where ThreatLevel == \\\"High\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total High Threat Level Hits Not Blocked\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total High Threat Level Hits Not Blocked\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName !has_cs \\\"CAT_\\\" and InfobloxRPZ !has_cs \\\"CAT_\\\" and InfobloxB1FeedName !has_cs \\\"APP_\\\" and InfobloxRPZ !has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Non-Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"coldHot\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Non-Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"yellow\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Application Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\",\"size\":3,\"title\":\"Security Hits over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"60\",\"name\":\"Security Hits over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 50 by count_ desc\",\"size\":2,\"title\":\"Top Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"65\",\"name\":\"Top Indicators\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ desc\",\"size\":3,\"title\":\"Top Impacted IPs\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"35\",\"name\":\"Top Impacted IPs\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Threat Level\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\\\"N/A\\\",1, 0,\\\"Info\\\",2, 0,\\\"Low\\\",3, 0,\\\"Medium\\\",4, 0,\\\"High\\\",5]\\r\\n|union\\r\\n(\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatLevel_count = case(ThreatLevel == \\\"High\\\", 5, ThreatLevel==\\\"Medium\\\", 4, ThreatLevel==\\\"Low\\\", 3, ThreatLevel==\\\"Info\\\", 2, 1)\\r\\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\\r\\n)\\r\\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\\r\\n| sort by ThreatLevel_count asc\",\"size\":0,\"title\":\"Hit Count by Threat Level\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"graph\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"status_count\",\"sortOrderField\":1,\"size\":\"auto\"},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"nodeIdField\":\"Count\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"ThreatLevel\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\"},{\"operator\":\"Default\",\"representation\":\"gray\"}]},\"hivesMargin\":5}},\"customWidth\":\"30\",\"name\":\"Hit Count by Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"70\",\"name\":\"Threat Level Trend\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Feed\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n\\r\\n//| summarize c = count() by InfobloxB1FeedName\\r\\n//| summarize c = sum(c) by InfobloxB1FeedName = tolower(InfobloxB1FeedName)\\r\\n\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Hit Count by Feed\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Feed\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"0\",\"label\":\"N/A\",\"color\":\"green\"},{\"seriesName\":\"1\",\"label\":\"Low/Info\",\"color\":\"blue\"},{\"seriesName\":\"8\",\"label\":\"High\",\"color\":\"red\"},{\"seriesName\":\"5\",\"label\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"70\",\"name\":\"Feed Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Class\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| order by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hit Count by Class\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Class\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Class Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"name\":\"Class Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Action\"},\"name\":\"text - 8 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SimplifiedDeviceAction\\r\\n| top 10 by count_ desc\",\"size\":0,\"title\":\"Hit Count By Action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"30\",\"name\":\"Hit Count By Action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"70\",\"name\":\"Action Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"showPin\":false,\"name\":\"RPZ Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Security Overview\"},\"name\":\"Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne DNS Query/Response & DHCP Leases Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Queries (Domains)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Queries (Domains)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode\",\"size\":0,\"title\":\"DNS Queries over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DNS Queries over Time - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"New DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"New DHCP Leases (Unique IPs)\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false,\"size\":\"full\"}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Updated DHCP Leases \",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Updated DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Released DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Released DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| summarize avg(toint(column_ifexists(\\\"InfobloxLifetime\\\", \\\"\\\")))\",\"size\":3,\"title\":\"Average Lease Lifespan (seconds)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"avg_InfobloxLifetime\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Average Lease Lifespan (seconds)\"}]},\"customWidth\":\"40\",\"name\":\"Totals - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"title\":\"DHCP Leases over Time\",\"color\":\"magenta\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DHCP Leases over Time\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DNS Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Top Requested Domains\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Top Requested Domains\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"title\":\"Response Codes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Response Codes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxB1ConnectionType\",\"size\":3,\"title\":\"Queries by Connection Type\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"\",\"label\":\"unknown\",\"color\":\"orange\"}]}},\"name\":\"Queries by Connection Type\"}]},\"customWidth\":\"30\",\"name\":\"group - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 25 by count_ desc\",\"size\":2,\"title\":\"Top Source IPs by DNS Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"40\",\"name\":\"Top Source IPs by DNS Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DNS Events\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DHCP Events\"},\"name\":\"text - 8 - Copy - Copy - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b71068b1-a89d-4605-8440-802f89726143\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPTypeParam\",\"label\":\"DHCP Operation\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n\\r\\n { \\\"value\\\":\\\"Create\\\"},\\r\\n { \\\"value\\\":\\\"Delete\\\"},\\r\\n { \\\"value\\\":\\\"Update\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, SourceIP, SourceHostName, SourceMACAddress, InfobloxLeaseOp, InfobloxLifetime, InfobloxLeaseUUID, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DHCP Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"DNS & DHCP Overview\"},\"name\":\"DNS Query/Response Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Filters \\r\\n---\\r\\n\\r\\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\\r\\n\\r\\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \\r\\n\\r\\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters).\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\" or InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"All Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"All Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redPurple\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Application Filter Hits\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Category Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CatFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {CatFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Category Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Application Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AppFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {AppFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Application Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}}]},\"name\":\"Overview\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Filters\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9f55f1ff-f771-485f-82a9-52a9f42251cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FilterTypeParam\",\"label\":\"Filter Type\",\"type\":2,\"isRequired\":true,\"value\":\"CAT_\",\"typeSettings\":{\"additionalResourceOptions\":[],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"CAT_\\\", \\\"label\\\":\\\"Category Filters\\\" },\\r\\n { \\\"value\\\":\\\"APP_\\\", \\\"label\\\":\\\"Application Filters\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":172800000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 15 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Filters by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Filter in the chart below to further drilldown the filter.\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Filter \",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"InfobloxDomainCat\",\"exportParameterName\":\"filter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Filter \",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat\\r\\n| sort by TimeGenerated desc, SourceIP desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {filter}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by SourceIP\\r\\n| top 10 by count_ desc\\r\\n\",\"size\":2,\"title\":\"Top IPs for {filter}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top IPs for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 10 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {filter} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"74\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {filter} by Time\",\"styleSettings\":{\"margin\":\"0 0 0 1%\"}}]},\"name\":\"Category Filter By Type\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Source IP\"},\"name\":\"text - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Source IP in the chart below to further drilldown the IP.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Source IP\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip_cat\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Source IP\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP\\r\\n| sort by TimeGenerated desc, InfobloxDomainCat desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\",\"size\":2,\"title\":\"Top Queries for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 10 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters for {ip_cat} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Filters for {ip_cat} by Time\"}]},\"name\":\"Category Filter by IP\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Filters\"},\"name\":\"Category Filters\"}],\"fallbackResourceIds\":[],\"styleSettings\":{\"spacingStyle\":\"none\"},\"fromTemplateId\":\"sentinel-InfobloxCDCB1TDWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox CDC BloxOne DDI & Threat Defense Workbook\\r\\n\\r\\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \\r\\n\\r\\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\nSupported BloxOne Cloud Source log types:\\r\\n* Threat Defense Query/Response Log\\r\\n* Threat Defense Threat Feeds Hits Log\\r\\n* DDI Query/Response Log\\r\\n* DDI DHCP Lease Log\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS & DHCP Overview\",\"subTarget\":\"DNS & DHCP Overview\",\"style\":\"link\"},{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Overview\",\"subTarget\":\"Security Overview\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Device\",\"subTarget\":\"Events by Device\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Domain\",\"subTarget\":\"Events by Domain\",\"style\":\"link\"},{\"id\":\"2e942b67-07c4-4579-ac5b-f43c5b01c51c\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Filters\",\"subTarget\":\"Filters\",\"style\":\"link\"}]},\"name\":\"links - 16\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9878ee10-a66a-4438-afdd-29789d76bd61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":14400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\\r\\n\\r\\n---\\r\\n\",\"style\":\"info\"},\"customWidth\":\"70\",\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"0 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Device\\r\\n---\\r\\n#### Get a closer look into where threat data is originating. \\r\\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"12793c1f-b77e-4319-99f6-b6b4230d9cfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19099936-395c-4ac9-a462-097e6c1fe50c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"2d6b86ef-4bd8-4afd-be72-83f7cb365585\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8e48699a-6c2e-42b2-bcd8-15cfce54fe4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"f57d037a-57c8-4b7b-93fd-8f6215d1c9c2\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Device in the chart below to further drilldown the device.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Hit Count by Device\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Device\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {ip} - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Feed Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Threat Class Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Class Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"group\":\"ThreatLevel\",\"createOtherGroup\":\"\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"label\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"label\":\"\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"label\":\"\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"label\":\"\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Level Trend for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Action Trend for {ip}\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Queries for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"60%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Queries for {ip}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {ip} by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"80\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Queries for {ip} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Events for {ip} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Total Events for {ip} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Device\"},\"name\":\"Events by Device\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Destination Domain\\r\\n---\\r\\n#### Get a closer look into what is being queried. \\r\\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d2856d9-b23c-4779-916d-abef2e4c50e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a5663eb6-1030-421e-a60a-6af9f4af3f99\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"5cbd5c34-3703-4835-aa3b-228504310c1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3c67b4c6-8cf3-4c75-87ea-4bca83dee296\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"730927d0-a8ce-461d-b20b-fe9cda17c486\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Queries by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Query in the chart below to further drilldown the query.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Hit Count by Query/Domain\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestinationDnsDomain\",\"exportParameterName\":\"domain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Query/Domain\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {domain}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {domain} - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Devices Querying {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Devices Querying {domain}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Devices Querying {domain} by Time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Devices Querying {domain} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Events for {domain} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {domain} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Domain\"},\"name\":\"Events by Domain\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne Threat Defense Security Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne Threat Defense security data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1eedd218-57c0-43e3-a306-a716380b05e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Threat Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(ThreatClass)\",\"size\":3,\"title\":\"Unique Threat Classes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_ThreatClass\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Security Hits (All Actions)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Security Hits (All Actions)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Allowed + Logged Hits (PASSTHRU)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Allowed + Logged Hits (PASSTHRU)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Block\\\" or SimplifiedDeviceAction == \\\"NXDOMAIN\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Blocked Hits (NXDOMAIN)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Blocked Hits (NXDOMAIN)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Redirect\\\" or SimplifiedDeviceAction == \\\"REDIRECT\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Redirects (REDIRECT)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Redirects (REDIRECT)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| where ThreatLevel == \\\"High\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total High Threat Level Hits Not Blocked\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total High Threat Level Hits Not Blocked\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName !has_cs \\\"CAT_\\\" and InfobloxRPZ !has_cs \\\"CAT_\\\" and InfobloxB1FeedName !has_cs \\\"APP_\\\" and InfobloxRPZ !has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Non-Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"coldHot\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Non-Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"yellow\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Application Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\",\"size\":3,\"title\":\"Security Hits over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"60\",\"name\":\"Security Hits over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 50 by count_ desc\",\"size\":2,\"title\":\"Top Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"65\",\"name\":\"Top Indicators\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ desc\",\"size\":3,\"title\":\"Top Impacted IPs\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"35\",\"name\":\"Top Impacted IPs\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Threat Level\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\\\"N/A\\\",1, 0,\\\"Info\\\",2, 0,\\\"Low\\\",3, 0,\\\"Medium\\\",4, 0,\\\"High\\\",5]\\r\\n|union\\r\\n(\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatLevel_count = case(ThreatLevel == \\\"High\\\", 5, ThreatLevel==\\\"Medium\\\", 4, ThreatLevel==\\\"Low\\\", 3, ThreatLevel==\\\"Info\\\", 2, 1)\\r\\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\\r\\n)\\r\\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\\r\\n| sort by ThreatLevel_count asc\",\"size\":0,\"title\":\"Hit Count by Threat Level\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"graph\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"status_count\",\"sortOrderField\":1,\"size\":\"auto\"},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"nodeIdField\":\"Count\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"ThreatLevel\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\"},{\"operator\":\"Default\",\"representation\":\"gray\"}]},\"hivesMargin\":5}},\"customWidth\":\"30\",\"name\":\"Hit Count by Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"70\",\"name\":\"Threat Level Trend\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Feed\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n\\r\\n//| summarize c = count() by InfobloxB1FeedName\\r\\n//| summarize c = sum(c) by InfobloxB1FeedName = tolower(InfobloxB1FeedName)\\r\\n\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Hit Count by Feed\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Feed\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"0\",\"label\":\"N/A\",\"color\":\"green\"},{\"seriesName\":\"1\",\"label\":\"Low/Info\",\"color\":\"blue\"},{\"seriesName\":\"8\",\"label\":\"High\",\"color\":\"red\"},{\"seriesName\":\"5\",\"label\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"70\",\"name\":\"Feed Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Class\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| order by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hit Count by Class\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Class\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Class Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"name\":\"Class Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Action\"},\"name\":\"text - 8 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SimplifiedDeviceAction\\r\\n| top 10 by count_ desc\",\"size\":0,\"title\":\"Hit Count By Action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"30\",\"name\":\"Hit Count By Action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"70\",\"name\":\"Action Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"showPin\":false,\"name\":\"RPZ Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Security Overview\"},\"name\":\"Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne DNS Query/Response & DHCP Leases Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Queries (Domains)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Queries (Domains)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode\",\"size\":0,\"title\":\"DNS Queries over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DNS Queries over Time - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"New DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"New DHCP Leases (Unique IPs)\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false,\"size\":\"full\"}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Updated DHCP Leases \",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Updated DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Released DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Released DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| summarize avg(toint(column_ifexists(\\\"InfobloxLifetime\\\", \\\"\\\")))\",\"size\":3,\"title\":\"Average Lease Lifespan (seconds)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"avg_InfobloxLifetime\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Average Lease Lifespan (seconds)\"}]},\"customWidth\":\"40\",\"name\":\"Totals - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"title\":\"DHCP Leases over Time\",\"color\":\"magenta\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DHCP Leases over Time\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DNS Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Top Requested Domains\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Top Requested Domains\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"title\":\"Response Codes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Response Codes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxB1ConnectionType\",\"size\":3,\"title\":\"Queries by Connection Type\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]}\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"\",\"label\":\"unknown\",\"color\":\"orange\"}]}},\"name\":\"Queries by Connection Type\"}]},\"customWidth\":\"30\",\"name\":\"group - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 25 by count_ desc\",\"size\":2,\"title\":\"Top Source IPs by DNS Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"40\",\"name\":\"Top Source IPs by DNS Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DNS Events\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DHCP Events\"},\"name\":\"text - 8 - Copy - Copy - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b71068b1-a89d-4605-8440-802f89726143\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPTypeParam\",\"label\":\"DHCP Operation\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n\\r\\n { \\\"value\\\":\\\"Create\\\"},\\r\\n { \\\"value\\\":\\\"Delete\\\"},\\r\\n { \\\"value\\\":\\\"Update\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, SourceIP, SourceHostName, SourceMACAddress, InfobloxLeaseOp, InfobloxLifetime, InfobloxLeaseUUID, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DHCP Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"DNS & DHCP Overview\"},\"name\":\"DNS Query/Response Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Filters \\r\\n---\\r\\n\\r\\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\\r\\n\\r\\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \\r\\n\\r\\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters).\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\" or InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"All Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"All Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redPurple\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Application Filter Hits\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Category Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CatFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {CatFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Category Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Application Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AppFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {AppFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Application Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}}]},\"name\":\"Overview\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Filters\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9f55f1ff-f771-485f-82a9-52a9f42251cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FilterTypeParam\",\"label\":\"Filter Type\",\"type\":2,\"isRequired\":true,\"value\":\"CAT_\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"CAT_\\\", \\\"label\\\":\\\"Category Filters\\\" },\\r\\n { \\\"value\\\":\\\"APP_\\\", \\\"label\\\":\\\"Application Filters\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":172800000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 15 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Filters by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Filter in the chart below to further drilldown the filter.\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Filter \",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"InfobloxDomainCat\",\"exportParameterName\":\"filter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Filter \",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat\\r\\n| sort by TimeGenerated desc, SourceIP desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {filter}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by SourceIP\\r\\n| top 10 by count_ desc\\r\\n\",\"size\":2,\"title\":\"Top IPs for {filter}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top IPs for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 10 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {filter} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"74\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {filter} by Time\",\"styleSettings\":{\"margin\":\"0 0 0 1%\"}}]},\"name\":\"Category Filter By Type\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Source IP\"},\"name\":\"text - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Source IP in the chart below to further drilldown the IP.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Source IP\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip_cat\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Source IP\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP\\r\\n| sort by TimeGenerated desc, InfobloxDomainCat desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\",\"size\":2,\"title\":\"Top Queries for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 10 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters for {ip_cat} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Filters for {ip_cat} by Time\"}]},\"name\":\"Category Filter by IP\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Filters\"},\"name\":\"Category Filters\"}],\"styleSettings\":{\"spacingStyle\":\"none\"},\"fromTemplateId\":\"sentinel-InfobloxCDCB1TDWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" From 151eac3798f1bea20203953686b38ae79e859f07 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Thu, 24 Aug 2023 18:09:29 +0530 Subject: [PATCH 45/47] Necessity changes --- .../Infoblox-DataExfiltrationAttack.yaml | 2 +- ...eatLevelQueriesFromSingleHostDetected.yaml | 2 +- ...blox-ManyNXDOMAINDNSResponsesDetected.yaml | 2 +- .../Data/Solution_Infoblox.json | 2 +- .../Package/3.0.0.zip | Bin 41837 -> 41891 bytes .../Package/createUiDefinition.json | 8 +- .../Package/mainTemplate.json | 344 +++++++++--------- .../Parsers/InfobloxCDC.txt | 54 --- .../Parsers/InfobloxCDC.yaml | 6 +- .../ReleaseNotes.md | 28 +- 10 files changed, 198 insertions(+), 250 deletions(-) delete mode 100644 Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml index ebc59144725..ce3b8952331 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-DataExfiltrationAttack.yaml @@ -1,7 +1,7 @@ id: 8db2b374-0337-49bd-94c9-cfbf8e5d83ad name: Infoblox - Data Exfiltration Attack description: | - 'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml index 1f0385658a7..0cb1ce7de95 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyHighThreatLevelQueriesFromSingleHostDetected.yaml @@ -1,7 +1,7 @@ id: 3822b794-fa89-4420-aad6-0e1a2307f419 name: Infoblox - Many High Threat Level Queries From Single Host Detected description: | - 'At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml index 24c35aa5c0f..f9913745361 100644 --- a/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Analytic Rules/Infoblox-ManyNXDOMAINDNSResponsesDetected.yaml @@ -1,7 +1,7 @@ id: b2f34315-9065-488e-88d0-a171d2b0da8e name: Infoblox - Many NXDOMAIN DNS Responses Detected description: | - 'Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).' + 'Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).' severity: Medium status: Available requiredDataConnectors: diff --git a/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json b/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json index cc5c81b387f..b17c8c29e76 100644 --- a/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json +++ b/Solutions/Infoblox Cloud Data Connector/Data/Solution_Infoblox.json @@ -20,7 +20,7 @@ "Data Connectors/InfobloxCloudDataConnector.json" ], "Parsers": [ - "Parsers/InfobloxCDC.txt" + "Parsers/InfobloxCDC.yaml" ], "Playbooks": [ "Playbooks/Infoblox-Import-AISCOMM-Weekly/azuredeploy.json", diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index 51d2a830578d6155b0483315ed90cca91742e90a..40ac21f12c99be35ccc581bb606826266c489952 100644 GIT binary patch delta 35092 zcmV)wK$O4j#sZ_q0vk|E0|XQR000O8qmUR^;#@Gq77PFY8#@317nA;?8h`Cu>uwvl z75-nK??9**ONKPEy_-!CG`rB+xfpd4*LF57>>!|KC=F}Qa6)n{D`|i}OCPOI(sRhU zYDRVxTXC}6AdodAhdh_>+(_!f?|(-~=a1SCSwuSzNhdTW(GQ11*WyJqrc)NN*m(4P zs+i}?DC^V1EpOY~86=8baDO%%?kYwNd$qsECOqbb%h-FK3d4ViynkvL|Dn^jYlSop z1XH-ybM7mt<-~X+J9lM_1A}112W)~yU&a$YEgPVT>(~4} zRRJ_ksL-rm^o*(IzOD|2#(-&G@x){+|Aj|WqLu&XtdNePGjGaGn17B_%@nL?P(mmh z%Zd9O977|InHYkwfXLy2oJu|9@kEY=ynHL*(bE^xvksZ@z=SaW{d>tJJcf)h6;f#*srBXk)Ma; zOp&vg{P*AgAxBn}wSR7Mdc@r9xR`#^%^7ygF6YoF#&R}~v&r;uKV$VzJ6pR#rUCrj zqlV(6jAP~-sfO8tc0Df&dXB!6kO31BodZAQ^gNccm~gGrDoykp@TrG7qao)(+tF@t zk0eYP3V1|0ps2VeIemSSG$k1|1?as+`2$7dG-s$JVm6z3xqn8jczVRLT8fmSW;B`0 z6qkSnxtJ5*@sF*Fzy<08r96dvkc-F6`5o z7<$eK4K8SGz@&+s5Y4FaL-J>sPAMj+6AA_E#F^n+9DqpBC_x&AfiR{l_8DQZ;(mxu z0dS{)C71*#@PEz}XwH5Rvbp&x4ww>iq_HIHg!y4CVK8T!fb9eb=<>Z2)K4Kfq*xP5 z0+ukCEcWLFTWfGPl?ffiT1J*T7zes7-o*tOh!ixP!HNUi51l`$fXaHJsPIhI-=#?+ zl^F^)rDB-5paHfD>l&#T0PX>bJp!09usW=P77WPJ;C}*fB^m_QCsF}VQ>HD0FirwM zY1ZLOZS=!Z8q_1FqbZ6R+!PC(mVICyRS&OEl#Ix09tVgoWc`50=_Rn|hoE{*O0ELw z>jkDPqwaGMNpRR;ixd~rLxkTz1Fn3g2Y#xJj0U)N&-o!VVNw{dMh$NFLE(o~fioAJ`WKotFc*ah1~pz-CM$v_v|VscC_B!xLC$a(B=p z|02y<3g2|~%Y`oi!Sy=*N^H>SxEdTPVFNm00xPvcB`tbebVtu}>K!xe)egmK@FoS;|hR0qB( zA3jz^CZtbW#RZ|8BGwi=FiYS87%fKMXFNbV&nM}V86#5$Hf0?C(H#Id0sjtLniQg_ zQTMUNROfe$sS}cwb6o(nZV)gXh;OKgi-`9sXn&) zfvCA;=>-%7uwsDO)r<>41nOPJq5_EuBJ_%o&_+S(WpqQQ)^J$x3l*SptH6jRU4IA2 zt}~DBM%@55dfo*N?~`m?k39Mj^B~Obbl1oOm{DbYp!r^(%o97H!QOABpAB7 z8HzSOoH?1FbsnB|Hu?mI*|+*+sU(Kdp~Z#)NdAWirD6g1x+7Om00PLs)I71 zy~(`?q}a)|&I7%wUqtA3G%bYj+JB(2paDDK#!_?TNaj+YMx#fd0-7pePM007G+as>&m$`a8R)ZWk(JL zE;ENrJ5x|=MMYv5PX&JuQ^ul6zaxg=y?cI}Qa= zfYbB%0*jHUBMU(U?lJ+{0wjE3Kyhi^eoG;G>mUJqpYN<29=J$bN7Xep%7#k4UDe0p z!gdyrdZ)6HwzTxhYmH$x`Jh^MbrvW7SZ}BcyL>2e@axl(Myg*=G=G}ikX;>QBkJKC zDq;xb;8OAoaJTSEXjMz3JMDIQT?~O{Wk{;?o}7?1Mu$@H)*RO? z_|;7Qc8uDj=yR#a_kUIf80)QxuV&gSiF5nYC3)=jkQy%(0=Y7$X}q?~^6+1q+#8g) zTA&@eIvDJ0R{+9In_1&AGcNcW9zhTXx@`7mw-YpPI^u@D8Vzr%kE{FUVk4v7H;-Do zKi4<6E_OrT+)m-DzPX_6Yw*qWJ?ES>qEgJZSp+3Go?cw%Xn%dXFH+6aYcuIJI^0s4 zzj}uoFoW5YJGjXAuYY=d;zj;j9y~gf3ODQvPT$&-thd#($7}5S2I60fgC02N{P+?# zKis|+85zi|n@am!H(k(wXKvcE$f_(-%OY{=hU5n-+(INL?$j#V-1Eq;1p(A%MX;9a3KTLrw& zKt;L24%h`0*nhJ+dLa$5xB;o{WlFwvK=0fcpht$_>3_2!+ayE@WCyLnO2DCX%3|E7 zcG$-B9Do=~w=)lK;pUOu#Q>1TAgpmFEXZCI3%Ifp`!=xudG{$+yJ(OdPYx?2c;?c4 zX)F3}JyryH!+eP;;mP+C+*CSt5PF6XTAM|EclQ>xv$eIvrce~uTa{OcEs)l-Vg{oD z*khM8Yky$*+pw#zKBj#CMXez-02g1@W&z*dnFVD0HL)Ma2zQa32?T^zEd}ddT?r|Q zO{ofSBiY^&vip(W2HJl^QRLnl?dHYb_g+39?Y|&PK_UuC!nan8jYAy z#de$Z(M>JmhdZ;3CePj7$4`1CufyWo-qR6@tUxAKAo;m=S&Z-RJuWNq@*e4DL;tx9 z_+(x?iR)*FsFf?LiNd>;2F(w!9x#nJFupJ>@2?S-6;oXRF|C#OT2qE$(=(MZ^2QIy$&@^LlV+=9RGsOnpPfbYp~-51)8O zm*h9rtHLgUbJ*Jbxo32(i;KR=@+1GMLm$OwK$`w~Bc$EEG!y!3OZOBUn z$kf@PLZ6IMKyP^&DldOX_xR=Ls8{}6@6aWAK z2mpqV7+1!0X#0&~> zZrJaHu>Y3jOiRN(Ij@cUaKc{^-M0)QEw^|1shCUM_U+05|K^hbb1*3f>VNl#{8M3+jwtr;GhPZ(SR}*2Hn^QD^ zl8@mP9if|7ccW3P9E{Ja4x#XEdDGf&X*aFW4U9nC>n7RP;-rAnm}U5F$b1seGVhx> zOnC7kpD}Z3fa7wBjnaVrMt>(Z>*)0`xaY;BO7h40&p$SP3Iois0k|V#Xy87COT6PZ z!LF+q+UUWozG6AYZAM&UF*FnpvrFmYw8E~y7}`kBgzOEZ&Ov=mm*x@q!ZnBr&gBw! zn*19j+-O?G>-fJ`UFPZT>Xx*dOyZ7x3JOlGBftTdw-3M!JI931L`v< zF{;3&AGy1j^S0I)N{!W`q|Q!e<%B8ABrRn$ZL;FLcd*PV)>)>;l$M!cmEAI105&{o zgwTI&Fe^|scm{XFK`(@P`VH(+L6+NCf?c5{_icQAO2=pziN!f3flz}>uhUN3goL?r z;~FcoEZz6kj>R#idw&BvK2kz%NInhhJ4-pf5k1u6bzY}M1}rVKdaIN#mWp-Ctn?Dg zZ`&59x*!FCZs#{(H@&(SV*rmv{vPIy^}Kn)D1$N|#PQ4~Kg5|(HHL>ax(g;z`had= zIuR`0EO{S~(#s`m^vgxZyPm=><4_yogiVY*x=N2>N+!+>9Dk}*7~n_mPp4pj14n#| zz#`Tg)(>jy%CG29{6pCB>R0)4^qY@|ahHBWt^83;mo^&9Xe`?|Pc)XDn?Yk4jb+QI zqp|GN#u&`ma@V)fSVm(Rjb${JYpv4xF_v@pRD8^1TfzA?h~dq=uR)B@HSm(dBfI2a zxB?i$VL?|nTYuu&sO}f_^{6s`y1NN0c>=4>b##{z%N5G(?19L7#RCxyE%;OfmmDs+ zY{^xyjpOqb^ZIK;;?Q^_%^aXb?b=!ELr0;qGg34I8)4z~l`4#wXOtfD(7 zY#HZIUD{@@&?;%mXMFCZEs#KIWqs2zORVM8kJ%PTvAs75rTMmsF0* zi#m)0bAR7tPOH(~@ZWcFl!QVW7pj1DP^hC&f#S*6RUq&37|YA62D-w^^%-ONoNK*M zKD`)|WoJH1c41{PcRKxI!d(k@E!?%NyOw^i%^R2)-^Jg$#@dF`SeAJ?4iPN#vRPcW z(Mj?&xMseNG^D2co{$Fo%-8gah50P)6|aUcgn#;)er1vAUKT3))c@L#zZdU@sN3uU zZa#*Epl&;sa7t$q?2@j=!Ho!?bT^7P<_0@ado{dE0LEff#9o5)w(c;O^_KQxqf0C&-R;TF%mtp>#lTZ@9(ZcgtaMFo zYt_n;>4vhJhkxMWXmvb{1iYq5gr^&wO(cndcx4Ho|c->a% zY#F>ir)FgGu+6QB8JSr~XMaPv#w{w3D@-*Af)|QDgDEIcFt>Hr7ji#?cx>dNm*%=w z)eC=8q7s*`7NXwlgtwLKAMCy9Z{dgpq|=M3nM-<$n)GkCa}a6^|!ODjx-NqviMreRk0ssO&0K zG82$2clq`3{EN_c!Pk%^cSCkBJOQG6J>h@9rair)hHyx0j|WhBBA(4&2A!{vUAYJV zH1SBepWTdfB$zcHIH-0FDYlr31yq)`O>rQ z=KjuZ_gVXLbF0(d-rIZDezvjOZBvfF+6=clJL@5@z^Rp#^pY&e-c!l$a*5CT1blxR zB_G3o-$iUwk%oEUBuf-1Uw2J67;)vN#ToO6PBbh1nNK94=?^v~yyA2C@tjvq|7!7j z8=O@6TVbA0!_FOS9E3d!gIT4GRaOq-kyT!H zMxt#sG5y#fADkgMWE1+ZLr$jKLO%C(xw-SK)*+^NdXWvYIumSZ2xi{tTy}RlTifle zz4fj3_WssRI|#Ne+nZFTuWxT{tamm#HJCZQ&R5`K_o;?g3^PnPBVSXjAHT;N{CpWGnd&anm|qe`8h zm$Ys6@fC|Nb#CA5(@0mQn$nn84wa>$w@j5m5U%rwS1ekoaNgTmf3~^TU2g~bov^*V zyV0fA;reC!Dty-I1{-^w?fu;f3!)ppk4GQx`v0Ql?(b2z3rDC8e|TEGk7DYcZ>5(g zd~BKgUwMnB=Di6FAc5~&7WRD$#)rVAflEWXG%);wF8sqdQ6K6Yn6@UWynup%aUDc6 zGaJ`I@e*nnFXwq{nf+pa`jZHjO4m`qs=0^d3(-g!g~DS*SIb%8H#BeUO_YLIDC~9Z zS4DW{w7RrFH_I}wmz140nL5EpcjqY>={5!RKt%&}f(9xNC*p6QYM)vl;`uZY&)qqud{1$2 zCJq?HriynY9>*OC3*?IX`H}8kqwCp^{;a3g4M^Tl!fz^p7@5w=$~+#Q;O#-YJ=oCg z!RC{EFF}8`5#1cJB3k((X`S?U&8ybL36;F!7;v)MsUz3t&gnK=70Rb~IC)q|SnuY|RDAY_<|CSqP6{EKkA7AFnvY)m zi{_)f1vDSgd_?onE&|YegfGy1e2nI!3y8PLd>jX`yVeCGk4rr@NE!pOTXaT8Z0=_e zhK+w*e9~NCs)X!*MNPmDedz=zC6wb2lo~c3%;d|%cf&QWo^YEp6NxbR?t5xend(hs zz1?6Gdp;{9?Bg?TT z9mwwH#(sNeue09X-U_$c!Pfe2JJ{RU-P&KjT;B;1@Am=merId5m~WQ%V`1gaUV(pm z`7aaT+lAB-5bSqMwil8)+}geDY;`u)DpZ6%Ud?u{enzimXUamCztl)y{Bq%`d$IAU zA5q35$G3DX0aJ z#Y254@IgGw*x*M*waV9Ll)|l5-_NrSoRmg_bxIJMMR*4)}IaM|9Kg=0Qhv z3yR?ESrMqEQ*j45%5tNj?I-}}L5M0`Fs|%mSI>@u;bc_O zBFCZVTwKw)wl+7yvtx@U!-9XaWmk$I2rXHr)e+vDkhLg0ZGvy6g=eS9csVu!>A+zq zEEiW;miv{He&PgBcwV6agG?0}RUd9`ad!YOD=0VomC$yt=|4DA%DPeJxyh?Vl6h51 z;w0pso#jvnK6WAaO5TdGi$V2HsA+DlncR*BNjO>#W~={F3!uZ9CK_LGyiGa`R) z5+YB}WGL@uK;AWIj+O=nvPwMG8>xZmaoQiKBp zw(tUDW1>_QptP#)@9{*$XK4;mR-zNEoHbdglY)g|*JP;dH1 z<%EpU!c3y*LeVwTqN{r~n2h8)dUJw;>j4B;8h(CqqKi$Xh>%<;xm}F32qjTPLpk?w za_%V}@l2NRF8TPwBNiqrt z>X+BUAnN}#OUC?*qnNTkYkI-NV?cSRb3@1Md`TxMb_ozl%=97o_m;tTMwYyW)oJzdG0;%S!r|fwh@kv-8{2&|fhxm_CilP%m=j@2i zQyH#J5to});<9K_4zd7i$0u_vFfW6lP>sfv8e2N4ksG31%;TaANHJX$h?d-S+H)6t zm71ajz+6}WWwLw-)Bn5|_pe*(dVirh_b@7achO1nu8_}ka?Y~=^&2h1zW_dG-)zcn z1e!-{OMa2zcC@zTck&v1Yv+q#(YrqMgZ+D%|Ahh(1>$)PffxcNZnwntKufj<9=~H3TBd(@dl?Sju#&t8-S6RF8+$G2no?H= zV$lsd(QUw2(p?fV{fw^0^M4Ha@HY4n-QL~483t^7IEt>>{VQhti{DP8>ptD1IzfMw z{=D_mU|P2L3$MdrMEe^BZ=$f*Wuzo@aPJZ!G?!Y+Lok^KG(I6DQ~R|g+(2X)4%)QPWhkss zSWi({i<2wOsEea3-7hMJs4@>NO*P`oi2n%@j1}KO{sgLA)_+t8j+;7$GW6$B3^5Of zX7u0kF_r@v3LvY&pHXp8#f3ntp)Cd^{OcbBY95}&uYYtHRA>tL+3@a@VkByu!_xMX zdrQ$w)C@J$q}q(@Ev@m-MfV}Aj|p(mGOKoH{Xe98)X_h@rEjGak@KUN#ZG)Xh!bkC zzX}TG99wN?@_z(Gy&U6DY|1nf8jvroTu7T8W|HPS_$|?af=<8*JMI>TkmZ%ko=8Kc ze2A$%^st|7&eXktme<)u)tN)9;<)1H&!7H=U&<$zD+J;K0a-tv$mIb#M1*PRAgQR> zEh+B5aKQ=r=oVAX1)BUXQpS@vQNK&+CTH;gb~srQe1D!Vs7b*N$EfJZHYC(^P}7+~ zO~+fUfO`@f>OBehg9LcjG^H*Zkl(Oyz~jz0cd(e*G6KFo>BS?qGzhm6SwUPwxQ1qW z4OPr8Sze~hy^>~?%OuCTy2@pN-1!tdVVL6altJayS`d)K`E<(HW@y?luw8;0>r`sJ zpnmF3o_|6XKwonfro$^y~ziPK4p zW*I%?5sXTXQ3>Z=d^CqIPUj58F=^(Yf%Cc3Ndq1+ppbnqA*+7_tEJVbJh3kH7Z|mB_x<$=jJmn{Eo1e5jAL$Lqv>U4?1A?hQ<*c(4y@NYcfObL z8B_^XoYIe9SdE->wf7%VeZMG&4SzOEp_K79L+R?^m!DOuC{sg9i^#BsGQ{QEfEouP zri6OOVQ@Db^g@`0-?*9MF_vI$Xvw8E)F~Y!2;V!+}51Tc2f0|u746ZfSB@y{rUE~6fsC4TuzX!Yr& ze2YT)>i?Gh8p-pED0%&Fs$idS1@2qQ$!XN^4|Mi<;oPx?`ZWk0aZa+?syM=UACJPz zIR46l2&D%Z*YGJd4(OuG6n}geM9G-elbApK36SZ3eCUVd==~}A2bdviAH!ro`6MKN zAxFO-o{+a;kc3IrDQ06SXE+e0GaithI0|4k3H^H%lY45!R5iekRMIBcU6WN|!U;o8 zdn`2V@tdVHCOV3_^N7@|*X4)P(mb!gLiyB>D3PKavAs263O8=lR(}NgR)p6klU-Ip zQ`D~N2rEk+t#i#K)k%P}@VUQ`b6?s6T<)9l?R>S1kRAr((k59@+Ldapx7 zg`7Iy8_qTGhOBdl9feZU)*5WLUVf=;kW2+gKMzX zCbI4{yf=4?PuwvuuVXWgeID1`F?7t7ctFEs3IytJpXM7rTS<7ng7lD;=q$IHrnAJKKaw3pyov#pbvUTYKH;3nfrwDR4IFTbPLZ(rBm)jozj z=yDg$A@5Z((<{w$SDUPlQO{I!f4q#`cQIYpaU1hr7&E=NCcKTwC;t;(akIROsps01 zV*RQMzFjYmz&X3jC*UHw3V%e&C|QR5l9;#jTUaIV9gh$ zW&A!_PC_~;U0kD%>uaXhC}p0D5{rzvP}LY8V=PuX`}ugRWc*f9Hw~{fB`n zA_|TxMUI*rSE>0iuhOC^&y{}caxSYPe`;gJfD7#P0>z85-2nv-)n2(31(>L*2+y~f zV_|rs^)aMfN|<@eZ^$;stjU~4yT~q=gqG}vZa`c@DeK%F-P z2bdjj0JDIpi4X7yE;4xTe+E@IZHfmE;*Bk2Yf#KLEz5J^SW%p#I7e|lA#tu87Uf07 zJgdv5tHEYLDeu$)piNqYq-9WOqR>R4i9%DTz+=RNFU-uHHcoE=N;8$wRZ>cSI#|@s znPN=ZWMg~2C4A~-5t#s_U~|Xo6ogj+eh_xTl3lExUx{x+Q0c&_e|z|0M5l<^OF)L! zs4E{TSB}@ba8g_|Y%j#Z{T4yYTz%+W$&C*Z4Og)S{~;p%s$b>HNt3ZfPKNO)rXmN! z>DFCsV;wLSJz%+g?;+w7VmMvrW-y#ChSRl-I)>AAY6HXRVmRG;+m(?AF`O>^vhOUz zFr4n3h0~QvJtIoJe>k=2c=^g&fjN|J{_X{=aj%;ja0SHw>W20P$FpLK1v4`>Cvx^? z8r@fN8528niuN|vclR$h+QI&_ZhL!oeW$&@y}jPvU*Ejif3~-|yRp5+DsXBgcjpC0 znq^}@WhXyuFg{4TgD)lCwapgjIp9N$*lLxWaZ8tDbQ<;;e_B;$RBq*`I`_KbYapDL#iR^p8V!YytnGI{!j7?X|=GF`!$rSGWm~5j9moaK@5C>2QhPU5K}e|e;8RlM=>5%R2;_Sj#K#ck0ybQ z;P6L)0U4l;G~hlniFWjcO*I&#U{Iw;RQ%6FY64!z!+UZias|{t4M-A>NPI;^outEa z2{VKY?|NZEMmNDIMLOae3pFLLLUygP7vFWs9Xx*;#nc8Jf!PW6GH-??gRldakpMF( z9QJ8zf1;^X@`^p;rL8a|r4DRW*TR@WrZ%SW>nu(I}q0JzxA|aP@AZg#Df1#Yidl;nT?oxhSC7%*1|J0(g|1FpT zTCUHAAdyI413*S*7qeso-)};=Wy7+64=BF?DQrS$Sz0ms%xGovkanMr9nD6-B&Us0 zx}qzk4w_Sxr9(>Sv<5vw_X8>^8IiQnKK#<9lRdi0Ah(W=d0zsm-XyC;o#WFmB)2h4 zf9hp?H%g~jut$7F$2+2pe3qvbee7Y<+zYu<%wWYHWSdprOuZ`{PItO2k zA7M2dM9}kwZG+*MOY`_JC)G2wvT7`bR7b%TF{KruE(3mi!;Jdz7;C-ReGTZ*D#d+uQqle>?49 zcRgtD?QU#r@9sRi+}q%XOHQq*@`iWil4fd3sb+5f1p`B2?1fBt{|&nN92DSWh-xSHpNM3il!Jb%EJ%I zb;Y|8e-s45PniJ@ipb7-`O?9bmFsG5oez11pdv(C?qHaA$-eOxw^jGolF8kry}I(W zYU`TxZtolsv{g7^Zz+e{Z=$f*l@wkNgTYN7oBQ4y(9|`g+$)*gs>fzkPtPW708Q?KK@aYvK>TZ% z0P;f7sYF=pU-*PVzOdgd=YlxdBG1|yWrcnh?!kaqBw0z2Z7&EF%i%DBEj?VGF%|F0 zAB8pl^NB&z)8wpF_>8I@gdf^a!w<L0~3_HEuGF^BR^>JQU8mznrjOw{< zj_N6u>o?iBt3=m{@41`B_skt^w9YY{r{RdBHPr(EThL6S%&31E(HBQ!y8e(gO#D^baM#4h&791my0? zUmFp+h>4uC<~Gk{@q!IJ(Cbah6GGEl?Jq5#UAHB>tKH91h328&55A*|EfAbF?v7ri zKQ#GFu~pU}tkHj-@?wN9ERUCpe$^Cr(!F&tO&-q@6^*y_F!6mnO5Y|*H;CbNq*hen zE?j>XPDyeO$i1;%G|Ni64yc6r;}3{0?YY1BZY)i25#s_cJkTzIZ~UL*8-FbWPHT^z z_U36dzl#Hr+2G=#vxrwBfEtS1-{#JPZGU=EI)VKUolJi-weM<|ooNp)n#H=p=$ION zqGUHTR~?-_Syl7;kj^YKUDaxxzzWI9qnwLtzEr%NCks_POXaBIp^CQvDjxLI$!RUm zQtc?|d)p7HAzG!f&BFoz+xU<3(q+ZsbCXy15~j?_Enm2lcq*Z%&b5y8okF#n#d`66 z*1~CI?uUO+RoAj)0aSX8N^j~{b5>o8v+$7WYDx*w5^C#dG>Uh3MxOI-_esVgs(Y({?%UhA^$A@aPG3sinyYT82b-Q<_K z%4e&1tIPdX7yq-M@p|3u67$yF7L9kiCUvBXce@tzZkPVJu*Q8VMX4RA?8(z!$wwka@mTMNe|B1m!Atpr|OPpH5TXdOz-m zyf)Yh&%)b5k5(o)0v2Y}4|{DzV|lf4cJzNQx+%czD@NR(lg>?e%LAfG1hMOAbaQvf zpu^tD?PW~~P(~}{`%7C^m8{YFFV}7Zy3Y>Rc$IAPfge}-jf0b6q3}$ zm!6X)s(@>=@Llh?3wb_&qeBg+#L4oLbc6dC$}CS-zG$oHh+&2*l^TYDsO@5 zG(~`&*yvCWrd?f5xm6vdCo8Qd*_^JP3h=y?&L=HV`iY#`_LCN&O6q7iq0>KFE(|^7 zIPPw+YM-poq#61p+G9E-BdXj{`bvKzNHc(6X&5nq2|f7RAF}GdhxacG%=-)J#n&-i zG0gk(A`-bS;M>*Y+x0I*sr3b2MjYgi*=I0ROjHEmi%Fv77iIu}PL&*m11jpmK0pb+ zIK8L*e7pML613URUwAg*BcjSmbzU)5$G5?Cm`Fl3`2_dBpsc^T{tIF1X4-#if!+u) z3rX5A%_LU($B_OReWU99=*BcsZ2A2{WPsHdzeuFUAuI8UmiW1H@bhJO_};52~DMefha1;qh5(3_N@mo$=v|FiB@Xluo;M< zLIirWL`|j@NnG@b{=bfvtjEOI0HQbUGT58fXc=%Oo(9q`axpLH2D z`-@EZRdg8N-o||?y{YD>Z;%y~e0wA$oTlH9bbW{9NKq<#fZLB$Dd~SmT9)5HpYH1~ znmH_fRov0lk4ky9|5Vy_zEY|E_lhMi^ZZjUbkZd&elG|eS^B-)v~@+{M?*QQj8Myn zi8^IknL_UtY&g1{bwsr+`}Yb-y(EBW(_R;K6ezIK?rZujYCjpq-MdZ|fyIm^I-@bl zdh9T=l;AhXUg>fgM{$1?bV_wU$!IJqj$7^ZZLQ*%DU3=_0&zLz<6SS5)t?T+4$N47 zG?oDQSZZvgiDV?VWtMzFE>M#X{k#}l`W(vpG?^~HJk0+2#C4>o#%fT0S6bvrh4w4w zpRX~f$F#td3I3Ax%%tcR6EqiZDDmxGE{$**BO8MHJlbnl~X!RUD`xflc(;2O)K!Vk36 zQR~G}uaZM{!UTRGb_UKJ0xgp89!CA^7Qn6#;ywV|gR=%8)B&L+jR`s}(N_zYkiNRUvH2b?^*0O?SY&rg4!DyG%bry10G@Rcr?WUYMA zQqqFjoPd>8t?5zN7t=9mbGtzm5roSKZ8c#ZxD6PAAChUZu(5hqM{t>3f;c55N6)9Q6sTgBKAU^Wj}TqJ1Sf zKWd*4k6wRenaArFAuGUfSwFOM$0p{@Fru~r%F_3;^2hGE?n?OGlqR5$?U0P;cOUNh~ z-GMAxI`~GdQ6NQI-%vnEd}!MORNAsZ5Go}65( zm8GjdV>9VmS{lLq{f@C?OUJi#cNl4!(AO4rZrI{8S9rFu{cK-v7}DQ%c6VIc0>L}F ze-{h}a7gYurC0De$yOMW(Fi7BPXG~D;$TADJ=gb5l*qhMY|9pM!N3{@%eR7O_?Vmt zWyXI{vEJOD;z0c#CnGil?jx05_BW4}u{L+g(uV;aq-8sV`m&%=GT+?wdY%KAe-F_R z!@grI9N$1->@g z8unh-bwODVwF}Lc+t8XQCiiNIZeJIx z$GH>9j*)Vss?BLQ33ocq6IGzURh#cI`CDybP5p?zI#*wv)0!{(>x@f&%)?2$=T1Ye zm-o)Ayr-2%n1AbtianaVCsb4sA*+ZK zR@$l`+P$dA*o)H+oow>*#s0d^{iq&#a97>i`1*VaIP5f{OB@c}x@x2up6TS^^z`ia zkDn&*jhu`h(lh`%Pvr!L03Cmq=(xN@$EBJD9hd01M8~Brxs!>GOP<_EjK5Iz95dY` z*M>&!=>6$z4xHzZasBFq8$|bwE`l1~UQQj;5*wOFbn~K{*KNcn;O5n|RQw9Poa1;o zHy_Z;xv8~h+`OFn^E2Y@@i5lYgqPFU7|v;v50#x;2`tI-F_vTPOBBw1J=Xt}4X z{KEM_H`mtEVWI-Px`UufSs7vl-&YzFabxqH# zdj#DBkIOx<^?>eyEv+i!<{r?Smc;w0&{$6s?g3+C=pNAKL-&CGBf1C1at{=j;UwGx zlQ@!4zBtd{r=K8afDAmhFGSN+b*GASm~gm0uJG zfe`p**Fcxu!xSEZE(uge0>q|Ils8gf`VG5u3=^1rmX5XK%{eXY|gl(i3vidTTe?NTYzK{A23JdC>nxJY*BVFR6M2`|SoGn0;w570A!o`GDJ#q|u};{*K< zrGdi72ioLLCO$r3xu@x{z{dxV%UQ7VfX;#)tt#W@EYKUC#QWgTSWgqq0%K$7EYRjd zXMz4BItzcsauyVq;l!K;9>){oISEQV@N^QC%6rN%S#oil1iR=Yn6#7N?6_SzDtHIT zesAKtezz?y{v2*Ta%aJAVJ(t{brzI+%E~W_vp{n$cKG_u3P~A#E&bQgZwG{dT#_qT z3*aia2S-7=p`0Bby_Rn0V>*1jUUVJy$9Q${F7AIuSN8;r7x920X%XN6o=H57$hr*2 z|FnN_rs#W8e|Aj&C=Ui(`h=~0wqJ^&&{pnyX5SrM0IugND%$|!Sgx8@-@!QI`0yF+k-ySuwf@W$QUT^oW+fZz!l2-di} zyX$n`Z|2^b``tS=f2`i8_Sw~k;ym@N-|DmXKEh{~r(zJBPA8?rzm2)2>i|d;-E7Kn z!sc8(RId-uSBT_5BMOVrlkT2eVi0-Jc&1`ZHizsJ+wl6-tE(qN=A9lAO%sb@sudBv zai?L%3rXD1FFR7b?7v5AY7eTW^m)qp=I4aN+t`S^rV@1#-DMIXuK`qnxTuv;b)gB0 zMao*(L4661EC=UffD$Oz?x+3hvUF|+Qshxh>d(K41!(s|B&47IbR{A#+2fgnzY9X! zbn3q1NuX?w_2aS6C4PPbnqX80*B-x@(^tj|=ruaaZR1aW)!f?=t<|eqmJUFDONhexKq%{RgOI)i)Gv$Yuez?`Y~W<_WT8) z8i>M@elALEXx8z)Qj--jB8>19J7*=ci*8JO0t<;xT8&3=JI#nHN2-ITk2 z5aU)W)Ga=AU`|wW0-3_j(*xiYDgj(N)3*mY_IV_GOIxJo?^Encx^VCtsS>!m<=~KH z6b-mf5SPmWsJd1nK5qJ8p{J=Pl#cw$7HUgm^O4=Db#5+93!TOlyXZzL2etkE*-qFSvs=8r z_3jD0=*nFx_8G1Z{zo1{`v=C=P`5FMOe*yWdSn2>oplL0%Xh!-pS8z+irp`?Y2#z> zk1uYMZv`QD0RP9&1@p^)4hjH{MlTMxEC4{+`;(E<9~<59&zibMZ>ZzXq=~fFM#RnQ zekyP6jaT#7-*xJzFrHB=L;;6E$sAG3u+7<3hRnmaNJMjOAp-nQOky4a^zayGK^5vP zc)4u6=Tk~=M6Wx4tVWb3vb^LITqLOj&R}@5r*7kFoeZLWFoch-g#Tduxbu+ytSJtl zY%wO$>&W8)uZTG=3}gP&4-u4CLR@&2!LfZSLArACym3c530JXNL+tPTBu>2LPvTTl zfk2wuz;@GTb6te0_>S)HZ1%YE_ZA5AW?+t95;;;&3lTel(@MWwdM-HQhG8v&K@xOUBuP_|g9uBD^( zjk88vY99T820F1(AQ!~1kS_ONkJ=VKJAG)$Xlm0Q$SYKm0xukaUUd=$NLWDsAXVr$ z{?c~RGkFv~P*3}U0g2c7`?czUgL2m|HPn9;jfYGKZ_*NPQkD)z_nxLEcJ}=;slZiy zL<`c(=K)?yMnzt6Gppk>KY->jK)h2SP?tv7=2kyf4Tla@Fv+LVM!PnmZ$rvBE}c48 zevl)Fx})%r^Gn$YBMFRGUim5{S*>On=p5ar*{gBFhMxh(kc$<1&wPiCcMRE0UZyn_okt$>Gw%>&1Uh_qa0 z6_>INx*x^5;O9(#;x!L^w#3C28r1qVEq)c2=X+V8M2lyIKr5_HlPbN92`Yxe4jnS) zJhdcjaZ9+p^7{bz(*j1cNOlxvLkwI-Ilitbndp0**Nn}hT36vlz**s{;pc|*72>*# z8|M%1Z|sylUh>7jnFGx7a*0Re%AC0Z5$ig;H(4VrR;N zSavcZ&Fyw14e;}KzVo5bs|xX56QrM}YwG%4r>q`q4vp9kkS>~e8DQmHe2F>MDAO~0 z^8J$d3k$#3DzjAVE$;3-(KFeWMD!bZ3iqZ9g*wHe)is{~N1v}n?M&%Iy!uXu5Hko# z+jc~J-k)WQV)mHQ14e4A9Xu4ovju)?r2Nr_d!bR7-M$Y;GRrdPT4Y69RZY!>U)I-0 znckfl3#PWc2dqh*1Sd@ud}*YN#WeY@HJ+SA3(wJP;k`fefn#WAIF=+S*rc3%UWg8%~MgNgD&ub&eK-GPVozf-?qK5RMMN?gY zqfyj(bP?ItBpZ}Fvw_NU&X-~p+p-frVSazU`Km2g3~+^Q>Gdw#VfdDohZv}l+nQxX zeD%nQq!aGA(jGDsD6(|f#aj4Gv(ik{2Y$S#3JlEVxXw$L*L0d88Q`N8xZDA>9(rP` z*tsH4aBoiR>WUz*sXY5iFwLBg6l{&5YoskL>S)h8sO3A&aNn@)G>T5SwR*5t^v(wP z0rWGV0Jop5sar+qRpT{7ca z(=*QS9rj|1TjWGWOr-hwH8sg0p%$7nC6lfE05*BFotNMJ2JJM8EDthqyp=ivrf%rB zb?>q{4-D$h^UX^=qkP&yIvCN>pDPlwzQXzuzG#W-jzvk6B0DF<7cb?*-30nr%djNm#@1F~qh`8*&HoJ-P=%n`qS7kCiD>u>k;s{YJoBy?VI zZG_#2s9j23 zYP(tRB+9MHW39DtF=?|qmUP8V+P7TjCjPA5a+_N5OOue4GVY66h?{h~@W#jN+IUhj z8mVai(?s6Wf?YNSn& zf;x*s5z%BQuu^0n{hQ&D=|@cD7b#Il097 zkzC&!WY>b`={K?9?0?M&?dyF}JOfDcxO_eZo{SQwXii2{qd0BsE}zWB`~~5w`0%_9HciQf&v+EGUUsBdu(-!2mObcd;NbLAG7RZd}mSh z{Md1QcQz(>)-H!TeVsy`X?pd_Pn2{AH;quoEP+YBN_#%yb@}ZY)i=f2oCILb9}9QC z;Q$ze{n3#*WglqH3kou4w6cWJC`2TuX?3lIba&;cCRCMLW6j@Q=Chx0A22D{4n`YS zUn&u|gd4CM%cV4`wn%hRDYS>PeXrCnWB z;g6c#=Yg-FdlBs5W!8h4TW^o~lE-I8KuolQ?fYcc`{B$>wl#x=4yrc8sP7l+lYu}| z<4F&HS83Dg{zHpm!yMh%Od>9bMTUg+SZ_3$7(i&pZxb4L~% zyVUXurNg~UbSk58*Q2a(n*6Mg{9gg4#g`X>(aGe3rw6?v5?b=w)2QxrUIxjKibb0} zfi~%(HFH_Ob^ypVPz+Y5ID8D024hO?OaAzXhzhYOk+=+(E8sfo!2utSE)kjn z$`@8Xf)*hQqt|r?8U#3KQxdV;<(rld z8=ID;Op!dnN(0{aNnMu9)h)8(qOD2WobiLwXf^YQ>+3GjfPRf>Q$4_IyN=OrQz2Yz#LJYsB+|SE= zCrvtL(rPP5@&JnV`mQBo=aC)9&YWttA=fWQYdm4A`k;{@XyBWqf%by^ZdLq`ePc2| zJmpS!{q#i+l8v>T#0kltVZxpMLrUMnNEtcAM{AW_G&1l>hbV1jR${8XPk#8i<*iKT znM&xq$0N4o=S~Y-k^HoB+}%5vCCDLGW{yW)Ov*CpdTMax!yAzxNn(cFxirS-P+^=6~9HSQ)s!O@LHnk%@wR$GIwQA z0}wG|$#dsA>}8gnk0LtSKTYp({_q%UvGVJp zJnGHpSn_*N)p|!aI_l`2_0YThRnajh>Es8r)3dp|Z|9SZX_tex%XfR!*kEWepQ6b> zNWZsE=<+VVH^07KJpwkPS{@7YarQJD2ud3JsTi+5bY;ZrYW7U&aX;`AcD{$_FU#Bj z2){dQd#=~J#o=>Xj}7W~k^4IRJcPANb;iWtR20n8>p4>@7)t7Y+^v|^(K}NYbm1N= zji>6nDQ%xiG0&(Net=%QM`+xQb68BQyDXo(WjYn_E*fXphbc#lMfDrqR(lrx6C$`% zb<}EZG!{a9t&{K?qzD?wjQ}KG|MIT^F#f3;GcyOM=)XTUzaM`ewVJsb5c0Lk&6iFP zZ9CJs;dP()dlQsGJ^FkM680sjxV|mm`TXU*{A}MZl_(KUsHY}fHCqqDK7lA z@eB{wL?Dhl{1Q^6vc9~izc8B*T^Y0jbZAh}VdM*WUX))HGF zy?O9oIg$fOw71M&q}f&i;t+t$d|st%zpi%f?PmzD*HXkSswOl*%mUb-C7tugfUiVicbgEG> z&wo9L|0O%EDy}GNNPHS3AUa<(#oEzTxXx%r2_1SROvMtQW9a_`C}7x^V=^?B)Pi{x zEag6gS@;FAL```S%jlqH7Ot zEVY3UlyUaDhijiXz{P$X3q$jzzEzw8UZ$8s0SIapN(U8syQD5)mJiqj?bPK*-kD3#vdK)?P zk`taF_mU0LH`&{GWRD8xzi3%7ojldFKUBwITGA6cmlS4`a8=8dp&0yT*VGtx;v!WI zGSbk?uFh@+49xn3W$@!XU1e1>2ork>=OU&Jsea3D>6pIXjLfnD-A3tm03RIfbE8kJ z3`_z-U%~4sM7&(wHLy4|JR$vyd|Dd_*M>rgO?2gi@Zqi54&!Rmc zDPaPTD=Z@j!kKQ27tQ{$%|2WzurwqhH*ra9-Y6u~D+VP+h1uX@HdHN z)QryWJq)9fhSDalWDA=8epaF&exlB&ynSYnkQ^83j@=(c+MgKRR%H`brC!|8Rwcb~ zUfi}E;}`a`+NAk$TZ?r6@o^xY4~XN>jUt#3Yq2T}!-UA-P#VywFiou3d)Tq3>7i>L zk z`+;GN$Kk2l=J^2!uhQSy&*x!twezm0|HAG(KQ|IVyXLu~Sgn>v8B}nP0C1K6nU#OW z*Q?Grje8ty+-@WLf}-R>eTTSKh$4x z(LTfkdq;hAdDLLf=!m%_vQ1E@9r?pF@7KN4cz(um81wb)6bSdUo+$ZBdwclmmae!_j#*#Ps}F*tmV*J;9sLsP@RbZ zd_x6GPe^Sj5@BhCDe~p;6rg0GaSa7`UFnq2C3ElWhHTB2Y^jlN$!j*uAHOxm%b)?D zmu_m@@C=N!u3x1m<070d)E0Y+)VQ-R5&Z%1B#YlR9CyBu0;oLs zq1?;3yUav2n+c<+(~lsKHYiDF=Hgtx$Pu@$JMW%2g~tt-bVxWZJ&q#jHAw%Wr0J2v zW-wi?U}qcKczDJkkrelY{`$TdI1wuOhTEmRd_7H7l zTqo7+pbDY1!%D>$WCs9Inzilky){DGrI?t7evUGJ z-50q6;U|Onh?hC^nv(dLXcf}0GL;D>!tqbvmC$F0K+OOhx(nUp|)5c4l-D z-u;k396uK>o_Ibg(fnB*P)j1Z5WCTkIg3QJpZKxyNJSAue~AQG$esTJ_*HVeY4E;b zi$%bOD$#mk)1*+&fX@AUv3s^q9c6&<@=Uj23NLe`&DkCDdGA*e8*l9Jp=Av(KAjwo z$>g_KI*;V|v2<>8-}uh=Az<*iH0uFKzQ_47o7oJcC*)SC{a+%9Lu3 zdRcpm!F~2@yR|TYc?{jGB~Ww+Q~SV`y(zB!h!C*sjD)F5qHQ5$1gD2^D%dXi+fA)0 z13|M$ye13X6v{G#*8_uGkO@mi+``(GeO`G7lo48To_T$COcGDASt|}wF;}Ef^PoV% zfe4QmJLA`F#Nlry9M1x>p<6ya+C{xjckfgU=#L{FebLqcKKaP&N|g3^&E)|(o7sY+ zTlV@;=244sO?SZ)L-#EKsdUhm!Vq-7i~fvv4YTnKQmE$6Ec^1UzN=4s5S=Rm!6M86 zh6{aRtfWP3re7m6ypo)J`8X`~(P1D9pQC(#3Xc#jLg-GNsK)!*U87DhvoYq8(R|^z z5d^Ge|7{b1rBzTXIEC`NN8}@$n)`)D&`J)j=RwM<#@R{@Z`x+VvAyX*mX?vp9@H)< ziM9E&$$9vojyOP*F?pO-y%aazZaqy{^#pUm96epa2;?2~9S)wL^IVyQRw+w*yJLMd zO`t}#K@3%K+y8J<@Ckh{eJbrOHTL1E=a73_B3uu!Di>g;Y9%NL-;M_Q1HsksC)p_x zjkIBb3V#dQlsgjtH#Gj@|3t85FrIC6#8ex;NxDg@UmiIW1Ep2EJVO`|pB*^s zHckM|W!&^J+A<_hP&GDG z*~1DFhp{^#hbNixv5e`+Z1zwm%%ziL?&T{0hd09bVQp|S7zX!TD9j4KB&mRLU3X80 zD58Snz+$o8z>po|u5RMkGgRaDG+zz-j@ggM)qIo=Wg-lBZ&^Wa(-bL#riSYsqY9 z6TEjzJ|stB2p#Qu2cMHjoRCQL_+qhq8Yt@|HwM>83SV6B%@@P6ROAm*hnzh+F>ieC zLrI^}YR6MF*2OfCR9oN*d}wgb(^oY zCc-fto6}^9QqrHY^IA>4ML$vHVWsjnXd)Hg&lFa#@a@&dJiGS@=otYf-rkJ>WdSGy zB*r8?Jl-GFUCKdd?A@wbdloDQ0EHW$gd2Wqb!Yy{DLOy8q_>rC5zf(M|cP0X~*8W zOb7Iiq!841>QYCSeo1a2eu%-RmvfggOTAsFwD{C#n%p%FVvl#7&*G0gqUo>XhAtT; z_awoLKC(2?NGeZ}^`-!nf09PifL4)2(?}Sno-ss|;8M*G(fYySdhMGzv4t+t^2rrl zB8@E4mg#E8k0R2R95=Yqc1$jyZ92AGJ38yr#fRb4V`)IuTUv`G?Y2m64NAecFUv@tSZJn}9C&g-)H ziF!n+C&UsYfk1DC%umH{^49LLX%_Y+Pz`FtjhM}RlY5o2)^6Xqxp}zZOe+*qghL5f zPt@(i9Ee&jqeGXz+nKqQ#FZr5SBFPO$1q26H+CcKr zIDW@(JtcuuX+eNgQ2@t`dPXb$2VGGSbq6sKb#ZWffsfSvV)&Ds30P5!2t;6ePCk*q6$LL*lFUM5ryXf2g88SEe>&J>=0)K?|^3MYh-EB)~T_ z!~4pxh*6#dzEJVgh;gDt!(8H0P0xW28r?3J70S<roIsul5-85+ zmSir@$B+>E29N|pvxE@Sj@Yc4gZBsvo*Il9P@SeTqJTEG%GAkY(+o&W$>)+fv% z+=kjzqBY(vgxu&IKAT13gs>cdaCSiVaCH#N`$0keQpHuo9lzuyDdw=!($GFNs3Oy< zF)%YgHv$hhT0x@Uwh^;fp)O(<)=YOva|!+I@#Qbi7$zx`esw^)1?%(ayIn~ot#5Ov z55Se2DK`Ja5NA_~Aw^@%bJ$evUpy1~S)qv=Ir;&1QwjaeJz!HQXpW17erBQGgq+a( z8JbP`RIVWeuktYzuW|_-<>0UZ$}J@yqC;_wMdMY*nH4&6#Rut1*4@ukC#<%yv@2-%c#`bEMr-A^fjJ}YhO(@Cg4Q(8e-NrH%9W>5PmDC1I8 z0w@64-`hCt%IHZ5#*Yx~4JR5~)DHNycWNx+VT3U;K=cfB8uM=ku+hr(SKqTWu) z8G+(r0uZMVam0UxSFB0H$v-&C-Z~XjUkTRT5|Oo=I(0MOU)|+EnW)ejul!HCV+8(> zx{LYmgeUp`5Z?dMor%hS(VZk%cX25XuqG<#I3A4J>N=lOT-mq^&R9;S>Rh=58SCkZ zrJoc+zXKJowxC@!WuaF)qiJd6{42N$z}>lMS|IRg5V*xorqnn}vO*3fs9%JUY#LCc7j62f%-3NV zRfeX;l>r`0&BI7CLmPDfymOM(@Mgd>Y`0aU|c02!nuVr;=9f)Fki?_bvrS8bMhADryG|?Pbutb`{yfs{vDNRwlHDUUZ z13)I0N0^cy#;F;j<~>Zkm{Q&iZ50H;|6Yq;N`f5o{~|DWRIt@$@`x@iB; z;slVRRR2%vj2!rPSNv)6{~=Bn?f+YxKTZCMv-$znMcWEFLgND}vj$w^Xj&G>i6%h8 z@SCZdgdr$ZYDWXyRM319-O;cU+X0!nmLexpJ`Du7^i%^Z-(W|dpR<4t`Qd-d`@`Zk@A+s^#N z>Zi`QFwRJ;$u(C>Ob8i3At{Ep8rntEPMOvU(?#=RJDQb-p5fI;DVIJv=CqLjow1#5PR(yIBnoaW`|0v|O zr~hDDV~c58lZ|0o^Dp~Y4aTbmr?%>Fa3rFc{bL`of9=BzY#;vw*gnj__F)FL4>PcR znEhiPK^FgJAArC9VFvaOv;XuDHcbT6nvTM;%wtJE5F^7@HFtbn$1-oXE&jR;*6H_w zas1;(CEGcJ6MV4QdvpJqT+8#YF>M3)@A*pSwe58+cSI<1Y`w zXd%f2uXrTsY-Xg!Q()KWupFE^;a3|1sIQ94gQVCr02RbxaX0A3Rp42u*jXs)^rR-M z>FOTc>a%dG4Y&Wgtp?!Rs{GGw-8|z`;4`hH2&Xr#^f_V5It#`FCS9@q*eXlP*&cAm zOTYty?>HW?lsTOKzyA4TMS&1z@F2hFbxaI2E@D!QEU~8WNJX5|Uk;qOGyjy(w)b7JOXZ(L9c}g4kbdi`idHfYDzpCZ;_rc13|=q9Oz@t_{ZRe`3}T-0ccJ z76*qLIKITISJ9?(!Q1v);$n@X2vk9jV~Fn_WCN(v!6Ws-BYa7W{wd9+LM5r;V{~D# z%xY0Lm78kdBbIoHjtsY*D=i{vRGPQrF|2CLf}JY|xzSKGa==4wNw0xJc+QniU1sSf z$~Lc(bhCtWX&>G`^(+QKRKf>l?|RojRQ__Xa)qe0cvK;MXqG60yRfOM846&O10cYr z{7$P)b8-JZF&m_GkN(h1zA>|%A`Ro)VWh2EYO^q7@8_|s3_4U%Id+5l-(al=2J4%D zz#8^1Si}277goT7!Me%Z=VLG!tOd@ZBSak?k!Mr{g8zbba6SgK(6_%_4gHs^C;!FO zsxaa}02r*D3TTo30c&v}*}-41=Kkve_J6^e8+KsO*y}G?SN;X-gZ~b!*@N@{iwA(O z^&iEVsM5b#Kybcd?{`tC-k_w_subx^bk<3=|FKHDnf`9Br!3k@ zGmf{bF#1Vz;>SM4e`uBt8>tLTvxffptf~LdY#AWfxB`r`-|@gW>&ynm+3$ErxZuYz zV4N*(2ji@9#XmUvUuYKI)3!RCwi(J=Ou(4t1fqZjd=d7dDK^dYhBy>x0gqwD$vu&r z68fU?&83Bv1tNG)e#mWDWC%DZ&x-IuNLE7FK)aaA6g$i#zz#M-pW-)!7MIyU1`OM6 zaK#qK9WUGXjUb;yN=B+)ZQoKEUkQ_bn;HBQaYJKlbu8rqxN!3)`rmbvS!IG2)$EV~ zp`_4a3H5BsM;ntH^ZQ14Pu;8<-Bxj&916o*w_A9M1)J;^o0kC|c+Y6#itCS_vLoWn zYDq+zfM4*}vmbrCSlYEd>7!FKa? ziFf6&X>e1qKmp=xR(l9~Q!&ngY^92uv_J3Y^Bz}%u5(4b2P5p-r(=W<`4k&fq9Vec zy)#?o90~jG2C3R%Z0S z-~lB(=Bt0uDIb%{K8>h~PjWQ+lyC9Lt+SryI)aWMc2qvZ#%b@kT=(39pTL+K<2DBT zyzh3~C8O4hX=SUYe~jx>fi{z)6|*w25!-5rXlhLZK#MNw0KAjWb@2*j8TIXuZKhHv zDpLbPf5gN`zk>qoke|5<=&7W@i7*ALF-^W)%Uov9@-sVsQhl;dGoO^!_l+b>o!kg? z>08;S6v{T@HWy^D+&VnYujG9ZPVVJ^x(2068yjy+MGto~^= zGI-U0K!t7Bi~WT@e8+U>f)~8EnigX43cO%r0>qrO6XvFB#LIRBi?K!9tp|Gkh0hP`CzR6uh`TcP-OFGz72{W}tVq*t*{}RGk}7qr#$f-)M*UBHFYvcpyu!^5 zKdFpebc7VK8go|yI}>47VHSoKKi0(@98nM$gnm9)+fpX{#&SX}b^e9Cnj?wgT@;rj zU=@J%HUAp@V-?}UevN3AX&lRKc(HyJp(YzK`ioR(HJ zS4nY6UYKblO9*c*I*}ZkLg)&yq0d||S(yRi=+)yQxpvfa7`rQVQ;Y(cxfTJWs(qrN zV&JZ0!I@#i62bE48SpILu;VDzHcRyOcnnzDDC5}v?i#v1n66~FtS`*fbGVx_Fiw>( z2>aXL_jiSTQ|cABj=&Dac!RWJm&{m07^jzObGzAe_HDj(ghHE+uAn{1O+cYoeZQ|3eksYdfo zmg=#X~xXe5EN2K6X23j0r1)y8RTDe^r`j{*k#*P}6 znCwhj=X%7gwbIwUAw6Zu4XXzSP#m`KZqqDURwxszY@SQ|7=BpZ44TiF>L(h`Vw#z zls@~>raka;dZlW|q%tf;BbmA|NNb*X3wpxlph{n>F^Jzqn9wT8v*<0p#Es0r@SHcR zV)H@|`UUN(5{@e)M+cbDz7lPeHosmH2YHUk^hcisHsntuLBC;n4-d`f7zb?6I@3B? zsM5{d4+?=L`XX))^7@Ii*U7~9v$Zo|uAeT;#X704kt)*q^)8;S2XCiY}$;Ps3h zpy!Z`qWvh0^k@W|-7-`OAnPF*pg3_M z5&1<6^cySRw5GT;o;sC}FKUefr5+U1JTPu%o@7>vuIS0foDr}|racGF5Thb$tXC?K z)!d2&)X-oFt9RN=L}W7j0m*14@@O_vi4{sST*=7vAOtwJ)6I)RwSz4#BB}^+Ji00- z3>*M)+pNLT(H?yky{8!6L~^sZ^Q@9^w&_$FJQ^^dJv}zbL4zzYBzwQ%17B+E=4B$$ z%I~44L=+2GAy(qiFn@Jy9eLIq^Je$e*pe;J@`R)Mph}duBL2zos%1;IR1&!C0VxxM zq`fJkM)Elad5wx!$ri6DrP-l+Oypu^z%!st+pK-$GLR^m3d^oOb9oNpKw+jQPy~w< zyqZ<#C}$(O z@gv6h$MxdwR4Q#S0!e9#9hTj)(Jy77KavYaeRA7Q0sx7wGz{`I{J`6iPz(=9HyHz> z1^sT0PZ%eD=fr>gsW?DFtluI#j*yYvv-#1KQTFb;UBuCC8>4M6MkkXd*R9sTL;58Z z>Xo49&1 z7PNDGKka?FCivP$sY7#<>LObFzKbXmk;)BJMteZ|zMU7UKYw!4G-!Rns~viF!kEmp zVXj4?4^$dG7}>?eCKi8M#)|GCP_ZSxkfTOMdBmML6kX5rX_NA(wPHhRfe;g*jN!37 z%1V`5E*ocF2tFPul3DOg`yfB-;G}PkAP_~rAYnlNkq%Qa&axNNtT|gex1Ogu9EGI% zP)ylmXb<%|5X*z`T%A(II%fjBJ+H&}NEs6+Za6iSwnYlzu&zZSbIDc97;Wr3%a0e> z9)!%>nhQD16gsm`zUG1T^)mov=oZ#VRs+tMSoXL%)siRO@dCvo=|j(31Z5hwE$;Wg`I2uA%Z9RFE?j09Mcf1z{xPLQgk zMmDMitrP;j-bprQ2zS$tC?2c>P8E(#ldY%eq@}`Dg(LSOY6!O$6)6Fmb(0$S8=r1| zrNt7YN9f_sWV2awxZHL!Sx)W^%tZb0RIyE+!m`|+8YB9deMYs!TG{>srrmlh-_Xd& zLThS-bl?A>8}oi^6X14L5yz7Qx9r<m>7&RUvH9(x6*vB%rfpM&%i)4g z$6#F%KnT6c41T@Kg}9#wK58fDvxOkRueLuUgBx%%TZXgLfF)m;ceUjwl76$Z{bu<( zxt@3Lwa@3*#|O!ZDumQ+xJVeXnJ-%1EvescDNL?nmW{oLZvlr^Pd(!vQcQM^*k^4c zb5ffLDmjhAT;sgZ(^ub+_*y!cUqiFKdJz>2x-NjqAUcvAdc=Xm7Z%4dxL1{KOb0qe zw+i*TJpxrr2Qv?W9G-3XCg!$b`q!pjOz& z1QZ8uX}{43E$C(NeugRN**JilQnKA*{9hHqy9M{d`_7sp2Svt;S!vPFdsI46t5JQg z3n4|*bWqo0%15O+SvG4lgS+JGH43tipWdl(@9n$T_x*`8zD^IlmxSkM(B{gI9sX2( z+RHNXHZc6u=F1h^AJF#o+;!aJP(D^wlTaeR)=$f^)w-*_e!UC+Nw5RJ0hr7=;}f*M zkl@AqK>9l!c|l?$#J1I&x|s5X-|LY9WcnOxGtM%Rq2A)}`!A}sOYF;Lx_{wq6Bp8X zJk%bl%Xk6Bs_nUkka-IcU@p$VvM||gX9|NatiwOio;xE!=U)Ex8$>JDpM4gacG75N^c9bVYEkhy7$yUsno*4NTLBGd0` zpWd*WFGMvtAS=3bC}ZQfR-R!e2*d5j)UOmGwR&U3lYWi892ETLG3N3DGJunK!aRuV z?G6r*WNZRAw;IKM^Ye6Q6puA#WQ->d%$<@Qr;c!2U!T<#$7#P%?awgQBXm zHd1r_M;14(4H))8xNovR(nkI_U`Fm`Ueeqojb8x`g;_R-ui;5goTbO~cu#b^d#A9l z?59sVsqS8<`>us+99sOoXSwv0j@uaba^f5~lBRJij-EZAJL++}D_ zm1Y%qIF}Ec30`(BbQ){V0xHLfl^9mb{-e86yApC!>hMhl6AkU^SP(xF#B+LJcP#M? zr_TMP#1O-k7~|vi8%J>8Jea(6PI5F|n})iO$fFS~0j4Ob#!I&zMt0q^r#UDlp2Q(1 z6dTo)-G;gXAG#-aH>!2q)PHZ;Tr@!980)`rX$t)D%lVkSo=U|OpkbLNov^DHmS$Ru z%I4QpgBreBO?aytr!n%)ln}Ie?SPMlnxzL<}=!TT~-4D!hytbxLRqH+Qh})RG@O?zi_$z?2FmGXbY#E3ztBk zJq)~MLOx^mRdK~cNx0$K(Hn6OT9H#mPA!5d?SK67sxZB15#!J=K zCj_vc%37DFmv{%bX)VuiBZa<4gHWF(2u8h@!xIs|5US#16K;K+##&00QZU7$bx*t7 zzRxAzFH`tm0i*<5`$}6!Y9&;W)^_f>T<#vgjBxP#y?60iYu>|WRqPgTzV z0dm%eH=E6>Tn)l#y+}cncD2|HL-UznbDq+PA%+j)k;O^+HZJJQ6+Z4GS27yKbe3av zmtE!E39B3-;GUq-mzy8R6B8XuoT7c5J4$x=5) z$A6%JlOCT4e>{2zU`E?0M9Qs^X;}_Q(an{oum2;_ieOHn7SjE8N0W%7J=Jql;f@On zDQO>9FxMhUuNWrfC?Ud}_!#lRS569+m%TKql3egmB1Jn~{k$)o)rERt3z-#yW7Zg= z+^4kI09I}`uGqRAxSkW(nWM1i+dyt^>I4=X1I+iCe|Dgdze=N!JFF773dvQ$5Jei0 zN?B2~#}WLKM2mL3@Nc*_A`xFR&G3McH-wyyDm(}N<+AK!J`xL}OE~J&3OT3%k8M~& z1jk7RXJvcPTBB5eBU@xsI6$)B_Gi{V7iffQ*YCcl!>QM((rR1s+)u9vxgLsr_|=WG=3J1 zDns-NBW`j|mC7=-G{CJCv5?$}^TN}l=1!Dm@UPk5Rff!+9KOTg$Kgt{}g=2?!_a zNc~3J;V2KWe^`!8vDDO~c7^4$DVCb5%C4{+n_@ZMA1o)PSZda>>k-V|sxkC0L zk13xwvHG{auJ7;etS8r<2J_93ETj^5jzuP8MGH`j;(RMmXjf6U4Jbxoz8xr(J+W?Z zY39}dgE@geb=Biz4K!X|ReG^nh;lFiM!-+2@e&m@TlOUof zf7OCh>mBX^q@uEE1f`A;ln+bg?n=Jr)sICoR3$KwO}#XsXY~%PqiTgMFEe%)5V;0M{pdQ9NQHlChjk6)w81FVJ z>OU2=mi4IrEfm_;;==Me?@HP-zsU0BB}&O1o+kQPYkZBr|4>T-0u%rg000080Hcr? zSK?eS#1;$y02`C+qBtLhkQi6SbZGmJmH+_qq6q*I000000000103ZMW085iYqa+3i IqW}N^0Q(N=fcp-F z?-4t&TI zhg;sZw=+l-JLhaRf80}y8ut3xKAZ5E8!lt-c`6M5CGvjNGX7JiZ`TTG90;axt>@fV zQp<_)Mt1JX4B6mwrZh~1gKLXr-3e7RVg?4mh>zF=jlPU0d|Ea@6W4F}2dV;SoKT@z zzvvlL&3#=R42=QPzT%0=R{k50rbH|M;b|cqMQ7fWn=l=xf0`*+(V&D-HkK3jIXHqw z9y2inVF8iD138s?$m59|3wiNQz@w+nr>7k<cm3wR6}pN6J*{_!+EjW;)6 zNW*qFH_0o(sAfd52~)&KVnRkHQV2QY@sy0&L@GvjtPK?cTd-eCks?34ssIQgCpk|g4YS$I%av*+f7BzE+fu3&m7~dArnmyE$HkoZ zP6XJhNIon189rXdj07MjFbfls0wpAuwnu(0UPq?v3}8(fXKxPg+l74^6GP7!p}{$g z4WOFH3DJxyKO}#J>6BuEI+;)aD9#Mu;s7LqxCCJs2C|s4*k^>riu)n@1u#7YEWso| zfp@Ave|h$Ukj>54aln+ABaJ0l$IK6734=M)1mF{(O_%Q-qk0O-A;p?d60n59WU)Ud z*jlrAQ<>0FtYu`mgK?nR;$2*jfk;8onN@MH_*c%QRBXyRqo{CB*5##1B9$2mHl<>i zd7%Ne3hN!I7=Y=6CH4rIjDgi*4FoY5mIg0~e=E@-ux^nGc$zY88H8~X?2~34zSKtV zmeQaeIT=k+%;2e5;I!-m>!^BoeWGMU-tag;`$E#0}4K&!5&-B1gwUN;P*X}u2geWEjhBaz%yAKL~MHTqN^7)NaXJaYP zf6A5-a5*>JCx@wEw)ug5QP6oga2r=SIRM*?NrXV8W0{&3({4Bd%S`SKdgR}vIZNT5 zE`PajB_Oz7r(X#VIvrQzLnU%RCrn_a_Dacf9=OPKQXN66aqnfWdi}fzw8LWM>Z;3L zq~cku(a`j82Ex_}1&x7$W~&b^l&!2Uf0?Z|g;m2PgCUA>-;SK1SL;*JEp}j{zykm+2H>YWK%D23^vR5oDFaLyXaDF9z&OGFoo#7Sh@wW_ry5h8 zbFTSVuskVPLVB*yCrYMCgMRDTA6;;b?h<;9N~;s)U$Zay#AVu1m_{}Kh#{##f4+go zgVCFUl`2(cp0IifRhYFmQqd^kfKH>NsJ|tpIOfPj$GX`G7nnSe@w}861d$NDJwu+* zYoTxtGZ_#o1PB`FeppbO8{(03Z#etO)TVN(D_A@=VYep4ZqGvwd;P86+fH57?;&2B zHX{ioCU2c5kB;k>2`Qin?TWBIf0#$N3Qkyv2mOr-8a@|5KhcB_vgGsO&eqP>VC%tP zYkLC-Zqsf-QkxcMpQ*q-8G#e__LWTbA$h5d7Ie%64sW-HL_kX@Md0%4BdZ^XnoE{m zuz~2FggGYCx z4uFlGcaFpRBpcTw4}Ziw2$MVAHSz#vR9PQrzSk#tTdV!`U_h4}7TI|c3|-yKiZ(u; zI+>q#c27GSeS*X6TYa)|+UcKmEG6x|pEh9Xw+nWPw#^j_nm(c`vC<_~2W5u#HuoNo zWhYlU5A>>j5uw|yX(5c)e+G>O4cIX^mYPdPGM551BHf}xZ>MY<5~mB(h&M~|aSWp& zN%qegugJtj%|2QtQ;B!}*=l9xLw9U8+x@=loWaTcOuM5E=|H{&8j766YC64wZ z=BJ9AIYdym8eqxh?#;xe1fNGn6R_uH8@fJm``r}t8_54yOu>NMe^d>KM*(Qtgv;8jrtGwB zSu&1Wyg>1D+=2xIeR3wsssgL;+6E z<8$1MOdVNhMBpwHkS&;m4-6a?Vhf9ls0jb=AwR|naMdN_w2 zF@$n(DR~CCS9m2v)slThCxPv5{k?q|SCjTybgYM@b_!PwMg?VG*fCWPISS8|6Vuf_ z#Cga>V$W`-kl^4bo2ELagi}!`8gqt=);}J71_!}NU5C^(!_Ggb1G;ccMhQ1mNZ>x{1`{v>xqun=;TD!07 zn_CyVp>J-da8=)2Q1&(W=K7g)P8v}uX4@=+EjSi1f39-0zC9PIX6m(>^co#*Db3%# z!ws0hY|0fb^7HGT-W+?8|BeR_UrB`r_64W!Y%%LywfuMmzHcD@wK(X3bIy-0@bJT( zYmt$G%(|(x>$>TJ{yTHimPJ-&ky;jsQ#T|(u){4xa_p*B+2Ni?_N)=W-i*9YnN68s zBLta`e;=|S6?R9IZ+l!N1?|#veGw>Y)8=)FV zP8@kYxCHofvbmX4xwpT!xmngBu2)uGt=^iIXoeLMJab`siyj95trq51g24)#yj5WE z6qKE-{(zmsR{bAV+b^Uc)&fEP`QMwM5HEsz#jF@w=y*khM|Yhd{suD&u{eg8#q zf0aSWMXI%7>H9mwQpR5sMS+a)WXpjmAhe1(+>7fySPYs1UEJHt!PQXLS;c4^CaKo!e)V5{=BNMx~8Ma;6; z^erO&29fo{dXRPe3_hCG>F3n=A$bfce-AAD#EdGo*W9z+6k|W!8OEACclRDW?v=a_ zi*Nf+MkKNVnOK43Rr~U&;o1J9^1PwEC3|fUJ(mHW%xiVVepVu`T*yrn-W)XuWI#>8 zG~O@y!e)7Yjb>Rv+=4+KNO?vDKVxLydA(aV%=>p{m{qP9`TPx;;kQ6=S;GwwfA?UG zh&!5V(eVDS4-ak~UJvdJUKxwP)Ncq(H@2|y;WI0cNq!%{D(up5UbS{#w*uL^7`a&m zvYoHXPS#qA*ke3Q9Q)eZUJ{hH8z2#M}d?Q7=M=wW* zz4FH>SJyJ#uWRh3;j#7dLe9ZUf2a7PpOVnyg3#>daD@P?vSn9Rjzc!L*DGQ2;*MkB z5M?W*L3#VXtz?Sx?zu=no~GklsGyeC@Vl>|Iu8~UCDfet^%YUuT$KA#+EPL$@}hyy=f)T2{+{xL{=pAMpSGP)h>@6aWAK2mnE87+35w%iv~~003R1vttbC z7Jt^pj_i&8f1c-j2ffVf31n>U5R$c$Jp_`qIFkz#$jmuAr#?Rr7D$Fzjzp?o)4yDI2>WkY&a^b#lk?ih56Ao! z(S6G>(sFy3pNhHEZQrg8@NYf~Fb9)zpnraUz@KH%Z((y(fB6uOU?Xgi{nXv?M!s}} zWtPxh(~+Uuk=9NHp`JqbWcx>^Y=|3Za5WL8d2)&dQ1U6fq$70w`gSymm4oql)gctV zEpJ+TE$yZ?x`q*md)*}aTAUPc8nX<)4Vg~@TIPKdhY2rV<}+q44RBm8u~8b(-+$=D zW*xm62KT&}R7w6=|M|zpPho&LHUM`-3=Q0eaEW*PCfIcqLmNGq)z>WNxXp-bEQW^S zVRk8foL1Ns7(*NBnUKAK)H$fH>B2lBU%3WR!MR-GPLqG5guH>naCcT^d|e)vSH^MQ zTW?_0&DHN1tM_9Za|;`jUS`G~cz>_4F_^REZa{qjB}Nsv^dol{bKce(L#eS^l+@YD zteh}qnWUwRrcG9y_YRg>#X8H>n9?#ctg;(s3&4g)jS%{;4Q2(Z2G8JjIOv5iPrrdZ zD#&shORy`n7Hyw2;i$bhAVR&SN^#Zs|OnU!8*`EA?cR2QTm(Cz#N?55ZEVhrHX z$lt@fv7R?i7-dlAqd1<~qpS27rexyGz<;4ig#mu};baO1IB>-G2rOc~Vf~=CuKbD)#Xp1{uYQ#; zN5A=W5O?V})XE>lbZMipjK;Ek^F(9WxfwK;(O9;OIvUGPZH&R3Eq8qzjb${J(O5=f zxz;M3A7eRpPsPVPwiTRTgBae-`x?afTmvsTJhDp;hAV&}92RtSvwtO?jp}|;UymyD zr@Nc5k|(h0Tt{~qv0S0d&K`)YS3D5W(1K4zaLM74%a&XP+c-X7F|W^ue8{4qim5&P z+!GY8?0^$;kW&cv>T}5Hd%8L4bIRO<70qjlMEk0usPyg3jnbESK~fdZG?A98r-L8j z@+trCtdR?-s1xD_HGlUTl*$bCV~Du!MOyVwsmWRIQ(H%c57*NpT~B%jbW-XxtL`DS zIh7ov8pkv7fKI5+Er2>_o6v_)>u@{3?O^=vz$&_P!j^IV)TM3a3ayg1e8%Tq+5#z+ z;`T}eD9|{H;bT6EfpBM)L^OQI=JXw~Rl(22e@W%2yr{!CFn{+==Cm5!4*z`{M@cB8 zaiI!W2ZcHc6)2v3T?O(kkFmVGYM?8uT%R$P&$-qM<6_YpiW3jb)ja;}F3zFPp`68=WLigKOsNNJDD6?+IzZ&wNd< zS(wk#Uh#SeLw~5R=~ot+?p2|p&;4)x_^x<2MBQc=aPu)N1a;f7gi|_|V3%|?4z5M` zq}x%%F*n$W+UwzM0x%Y25T|8i^(94;EIMo^5d0B(3mj0z7h9(_Z;8l zF6wt_Q&505vPxdxlYTrRJnAf*^acHUndv^hC7qy8f`48jstkHPwOVL1UAm$UDw}9C z49qhgXrN}e~2QLu?v9Te{6Jk2;Z`iw4Ykltd_rJcyfwB&r)mt4s^VwvN2xeObeG6|5O! zpsoq*2^fltZ%@|~j9h}DxSX58P+U1_I!*q?P+ayFFccSt;=)i|7>cX90Sv|Ewo2zG z6qnxgV3euxwKjj6iCZnI@j4tH@0w`q%qO6h_V|{x$rTeMvwdPxVO?Wn>h!BwiA;?K z?;mLJqQN_MD`@bd!CR{ZG;B{N2vt{u9oSKoz!#1}XGcvP~&i;mS zjayV6SD0!L1TPeQ22)U?U~cQKFXVm(@i>u-UYhG#RWE-?iAr3$T8MhH6W&&`f3Wwa zzl9?bkWMeAW-jSb%1G27#nd_vMue(w7a`or{x`eg)|GEGPvPNa!VO&_Ev+ySCjBj~ zDIo#<7yT(3v4^T}Z-;P=k93Douh)(5`s|`NP}xo$_Ztg>wY*lYeO8~9?CoxQpOx@1`{@(s0bLthk!tWPB*)Ad0|HA68K3`aQya{`S$+?8 zc6YbJi{19d`qp}Tdvhaf2fOP*dpEdzez_f7Ze2cqUW4Bi)qh{d^MZ*o)4;;_HFgkv~sy~u`Hoe8!y z1T*h+F1kCNt$*$I*0c4k_V(V^PCE#;F4~(^rmt^rZLD`TIyIO%z0OzQV)(uR?uAh_ zGO&Z2KzT}5zGbF)NLC3xkUmG(+=dLq%k&3WIn|8SC_}XxmH92R3{p9FtF!y;V!N~3 z-s@aa&h0$gY41G?gZB1CC)nHShT-P(-5Q)LPD0X)u#*!l7=O$B%}UnaG2+r9%QwsN zek`oqC@yfX;!mC+-_EfHA)`v2ot3n0_VG1~FLh?$>(fYArkc{2R}Ph>p|?zxK@hI9 zhgU3Gsc?R_wf=nbS$Dl1>~+HS_U=ZPT8HZw?aT0aryFcM>um4sR#*_-_(MGUbld+I zHFtlHx?MOzoqvF*)%z%>?)g@FiNeR0$^VtNXlmY@zyK2XzGY$Gw_tn-TpGAEv`YiS zKj^|gj1%>t&VgyGQRM{`42ORfy7}_h@6g5#db79Uj=&J3Qd3!42<NFt;Thj! z^5!na`#3XrZP7qQ1GPfyucOwYf$G-^8mMTX)?#V_4OBEx(Ll9}05nkH3p7yCKyA=K z<>5s94OHz@3q(AhCgQm}$CU3WKAVXH2C=E)9f`+rN5TTR;(mUlyVvM?_M<=RsdWRA zHF=6Xt%(yVdBrhc zvyUAJe%RypM_ZF)gEx_c5K?!26hZAG6+eh4(Ql z8^HURZmV<_?_>I$xYoTk=>qjFtTZs4#mU1$!hd>C-b}@3e`r3U`RJq&qWS1&1)%xp z#lL7i+FL;L5zR+5AMGLl%}4kG&Bw=RKDvN-o6N^?0K02lF!H$6Q-h>2AiG6pbj0R< z24Ogni%*&hOqGz`uc-<6u`iwAq=a((ky69PgPDAJ_-?r7)e~-WW+D*=-+fPQDpS3Q ztbex~jDj4bL1EB9h)}lL%MVtwP{2DEo8iXZ`gS{b9_+TaFZOoZd%pNu>24T*qZNAKml)Dbe;tpm(SbXt&47Z zJ6ykPU+e^7d%N4&y9oAzjqTm78qA#DrGF`KF?`lf=gA>#c$Al~n6Z5H#*@_sC=+}SH| zFaM!$m&Q@o$eX+Mg)rDt!o%ZwHy^Hp<%i!|a^Umf*XMg+o znHlW2(Z%Bku{&)GYPt?lv$K;ic-h{nC0!a^_pP(a#~Wo|s&Zzw$t9;TE6T5RQ& z6(gHH-2D+0mycXr76(0lLq-}w!|;Y`0_UAx1Z;WMth9Z-LEiMcJO~^sRdyP-=3WlZ zmUQEul{Or1=X{+}|68*nE@em4&~ zqFYc5KZ$x1T!Ejz5uvK#Jrt-YP-jJ;mQKYT`GP`|ty22uZ~Su*Bd z9L1FVSyV3Y z-W(K85d@n#K>(rf7d@g%9+;x#rYsdzA-4!6lhCT%Uz~zy0&#zr?^_3!L-=t-*__1^ zg&EN5T)R6(&8fs2ERbrxddi+x5ub$h!4I+le~AAWr6@X4bk2_GJdxqr6mhv(B`%8= z=Zx1T8`o@IZ?hd05G=;rq3?J!{5!(nvA?q4zEU;K6wUG?c6)d~8e^yjUg2Gg>|Uw9o1 zBii36cpHViE+ZwOgL|6@p}Evj9)ig{pz#SIncA-{Ax{cogo`Smk*ekOJnCj6pOMdo^5Za4IDJdZqVnx&e06`t&PcKug&#T}XuT(Vem2BBz^{LKnm+-04y0Ll7Ofl}v*>)X$50m%u z#Aiou5EhQrE0m!IOgJ=#&=@+aVGOB0xzi!oMN@Lh70d~~Y3hs!b*XR?`I?_c>j6lq zJZ^u2&FWov#X2c*;P~vkgLzak!)C&N`H)E%A@efVWhUwhdF2L^WmWc-LS8BCv%EPO zU&yV<^0Et6S0LS3&f$M3s4HX{r%tM*L5RV66BK@+VN`vZjARaNN`}l%YS5Vu*P-G^78PkFgxcPyksC z{)~!)DlPiA|ZNp#k~Y%7wJqVJ2zLgWnPzDCh*7u%m8q2w7gq?1?mF%7>WRLl67O=1koS zXnCDoRGm4rDvm3D{`~20_@#Vexk4Z=5Rmn=MlKJ~AtFpe2T4W6Zb@BR^Q13~| zA0)uLrYUvVfc%Dq10Hw2xr4>bmJ#s%aW5XRr9rrr$O_^b!ZkG0Yp7y&$?`H~?v*sF zTqZfz)m1JF&ZkqpHp8S11KTC2u}-Dd3+kut-bv($y&E2J8+}wYsy}4TtYt+i|lm-{bqAUJ*O7?p6| z#Yc1a;&jeX9Fxf$G;lt5I%&Wo1{AUnCS>(*V70Uwl?T@wB(Lw&WifZMXb@ShC%PW` zrub`llQji#;|9IU?Z6bpGGEhchJ%@}M#Zzy)Rf{ddp(%Lly`Zjj4H(JO{wUiCj9#ZLijp&(xRHM|*& z?q4+|kBi!KiKQl^J~IiMIH}L5MdPmU(7Qq!1t7;Jnaj+0s8HsdT&#h7;DM7)JPgx= zh`4_lb;EuqY-z)N>8^i{h;J@$;LHeWfW?x~Uel2Y zyL=MVeR8wKcaMEq=6)1)l57L1-Xq8GP<{$8;W6gx+tG*#BDsHI&8hQJ;Y?P=gGX$z zz6@@ixdaFp>uK+}O{6z?CL2q^?N#x(tyo_gyEQOg#D;3lqaW++`9{Q9$M6=iBjX%QLLP=>gC6Hwzo#FS9)I1FxwgI)-; z@EbRCJjN2N4K2CUhB~2R1mSz9x!h~;;8ogbn+PyhZd^fSX_;Ld^=V+oM+V64#;1Wj zXBoz~nMU^wFNSkmr$q+T-qH16rF^ketkVN+6q{|^;?#cuiF#VSNX$dBrO|M*w3tJz!v&J8@rH5dVyl=pyQ|S>l(kgjSzU%J(Rgul{f7uaP{z zh>|z|rV92cSKz*JLL6nSXJ&F0#p8%Qu$H#t14nLfbe}EaX_9;vTluttP7jpRf!7+Ik21%G? zonkhYa)tv@I^zN9iK75!lhD6MF}bHkOjQHyNF{B8-8ESiCY&(jw8uiz9=};SW1^#& zJC8`cdR=}vEzR=^ER@gvh!QE<5!>4&OyP+ewH1GXz7^rM$z+#R&=j?+I>O3QN9#;; zNwo=Z7C!gqa_&oefXjVTzMYQ`b6n)ESv{;RETrOT>OoylNbhxssE||VdjmSrAnJc> zg!$(K5z@Am=yXy$JHr+aKGS7hAX!-i_Qef`Ei|{65q^vACb$A?t&w%7;k~(AeBzFQ zd7WZ${4>#2TwG2IW2P5ZXY5BpW2~G4H_gd%X-r%5TWyHqJylMh28y?NW*2HHj1Bs% zjuYZOKM?0Ph5KBd%!Ok1abbeh;X$O}hhg>Rkb+CIxfo!6vVfmzDcIqU(BTFMq+cW?LsSz1AAu;F@tITKR6qm*3%=cW-L% zYM;U$bh(S>koPK?>6PZWt2OIm)HBr_FC+I|OxJbX#{3t?OfRm6w=wzTzu^@(%e$C* zu1zV{ue#v-)$$0Ov&(z}&ZEolN0f|`Wymjyc}Ks6RRZ7fIC1db%1Xr|-KX89s(*vH zg$@-^#_yBmB&37V#Wm`D;sZQ_iwvH-LDfy0;=zM>V++|PDCQ?E%X8saQJkYVM{(YeI9Cpf z@}gp%)n(JwV6&iooZ!J=}`^kUK`8{6|O;8Q1y$OIS#n>${IAiN52gRldZ>|XW!3Va)YN(TP5$IR_Dql`oj4g6J zj7KpQIT%g1?rIzBe6i>N%YW^A4-uXaqv<*~gVA&`nyzKkF`BMZ8yHO&qv_V$u8cg0 z(RAULJ!ct)(RAl5nyysp8ByxJsZGbbSJn#5k#zG{FJO&(UEF{hApSQuv==y@7h5ct znW;IEvp3V=zLLwB*r8MOY-4?Q?_#4J>^<+cw|Ccf+I!pE>+QYu&40_i=g&5GH@3G} z1x~HxuDrlVvuy0A?Bs_H#z$#)@TJ7Nw%Gzb2VAHTTdk5aZs>B1PQo4otICX=Sg_d> zR!2AN0e=ZIs>O*GV&RMU=ZhBsyzKibn#`}yAhiZR341AHaZLpYqi4U@%VZB=zs~<55M$VNC8g zgMJ{>!n zjeto`8-Js8MVCq)G^Z#_hm_E14SIy`2UJorB59+2_@zrHdvu*4ZXF)+z64agNmhwE z$0uP(Zep0!i}-ewPP1T-_>zuyL>u`cPbg7#*grjIg$mH{mMr?p_K%NkmB}o|yM27dwXgH(vf%te_-)pf&PHHGst&$3 zwzumXd`ja3Q9pioSp8Hk z=6|A?@D8EqYq&0^v@XmsQI4fWKgQxPPU!>{zWgfzqomd7g$>_H2%l~4ZgroxH#eV$ z?d`p1JMCb1J!n7M-PqXP-FbfTY=a*zIklq78{U-@s=LEdj&3!MkTkAH;H4E!nrxJdRu=T3__P$06i z;}rVQ+E{x1hLt-2OV6<-!Fr5cSxYr;EKL1If@bj~1cZIMf~)IQGmM0$@ZoyDTSc?Y7@n-QdlE-C#r5$>G1QaanU}Z#w992jjPeU%(l!?Zs!l)n$^CZU+(N&Zd_irFP}Zz zpxW2YWqWTkc;4Qje_U>FZtiS!IyJN}-XV}$x>q>rM(?0|WtU-?NiIt?u8v8AzeP04 zNpX*N(uL%Prqg!HoSOJ*JsZz9_q;ctscT5NS2DX*kIkx{o;7R$HFv?F2X|5+{C_n} z0C}nCR3a+&FML8FU)b-Kb3vGFk!NjQL_h3LQlB^`iwwHv8wL7d`8s{!Vhhz;fLf8@_kXM3@>2Sw~jXPYHI_|~% zg%aV>eOSRo9Q1r6nb`)Eg@otS} z&fJ&jwc$ya0}aaEmQLrd5ua*fr*&osIG@wDN~7kc{rrh0azJ;#Z!q_PRMaAV|BaDI z=vEou!IWR#4%wx??vUL=&ISJZSs-LkIqW)#9*QT}>(aqn89Dnc=zS6E% z&vld)ww_yI=_wYJ5VJkG1r;*enwekewQIdN;5pN}(%jM%Zau8AKF$kEgO&GyK|Qz4 zK|Q5%{WcqSmFPO*J$JM4p1FgK*4enxJX^Yx5$(}{{d~jSu%E&aM{BAF0Jfl+MwwAF zpgl_Zg2wmc556$?OMa`MFMo6x1b+5B-|cz7)4{D8Zt)nd_}}j{4wCT!VR^h%^sA=0lRjG)(|_dgEK$*TOAix2 z#G~|WqI828UPo$074E|Icj1&I=YZTB>qWDywCjLMm_Po2_|l&Hi|@uV=`CVh+=U0) zCGd^^3w-0RWx#3e(bL{Mt>$-eATk?VJaiWEN(4|tar@icd9dwIFG?HO|Io=aQ~R!V z*_rm>qFJmfjEgYHZu+Hc5RbkJlDbW{k**i(r`gg9By?jy& zN_XojCkRZJt)jtsM_$jIQx9{lpX2&DcjpPIdAgUncJNZy0$u9L3niP;gV(xjdx$(Q zT?EyIoBk>Ehk4#k||4KQ63s zpGr|`$2l(4iU-{Oytls^?%aYTuW+nQTy9TV0^`*wAFmYp)vWs;`qd_|H?ntInuRU7WI)Q?*6UTJlIUitJAX5IO0r`CXQz~L79Y|(RVJ!Z z)#F2$7c_W>3Uxiy^-$MaI9<=<4%Ne|f7MdiaxV%tf#Y;we0t!E-Y3XBTdJZbIa7ji z6+BQ>l+#Zqsc*d>_d{MAY=x)c&7ems6C42xGwO%EwxY4T-Z(w{7u^)#_7x-U&q?Px zyx{@SB!7a~RW!Q3yT$P!h+wORPCchrSEU%u0!hEw8X`ANFLeF|lkCo5mIRdmEK zLltspmWug)=D+w^sOXPker8=jjp;zGe$4jaqkr-~ye44shRGV`r2rJqGPO&=Ao^!E zD4Xk>o9*=t_&=4mz;v1-z)oy*Cqjh4kX9n64P+{dpOQT<7rZYV!T+7oybqk}e|-^2h8m7%CdRjwQsa=7cuh3f)*Uyx%Vp1H;RBh&SjRVNHbZgQCz}}2kti0Fu?;Ri^en27 za1wK*M_nDtGOV0HLs^rMJ5NNLT)36X7R3~+Ew~+B)22-Qk%Xqwz(5q0VHS2yxM;%?KVG3CuVy&bkds*4xuo5f+a}pJt2dMhu0p_|tXTASuK$v#PW z%XKm3N*uD^qw}jSjwDYhtH-vmIwlz^%Il0j{Tfb-q{=CsrY>!wtAEK;cfqC=_}Xzy z=M5G1CIRE`4Dnt$ewV2AVyIWi0Xty=KM*?u=MI4uNq7&V{#6TL*9UPQfbGFq0}$!} zSsx{22+Kss8UD6m05|l888&=C{toq%x3_(E-4A>QFb*V0D9Hm(9$kQRD9M+nPZiVZ z>C+5qeHh%W^23r_T7SEkSGHdEVdd~Y+b80%K^~7tbs|}l)&9rkI#ZnJ-!N$KQL000 z>~7&O%S%aE9sL-stZI#z!Va5`Zkt;ms<0tk+Gwi@`@pxrQvA40lZDL+v;qFh^rV@* zBpbivePk|vFXr`Hs&sd~d`Z%yOu;0&Uh!J0-%q5?2%q7rjDLRk?Z4xwPhds8jOZi` zZ~GDLE6I6e`-FJ(D$6`xzX(|Y-p%@smra!RQvG+JDmicWT!HDcbsm0*oSOuxR!co(!fF?1;Q%UDIhPJ*_e|&2p8j#2gQ= z7z{0qO{KNIzG?>?UIKKCWGx-t(0yj4X<1)e*tuql&s^c@#`g0){W#Izc6N7M+X5Lq zx_=)G25{W&JEgqzsZbz}j*T;S2@j%dtw1u`-Hd^xJAaGq`9d6++GItj;Xp~e6vrpx zhP;6T492#JHMGsT4b<;(VmNl1%ur>|1v~}|h-5{Kqh+kiow96WP@g7vP??pPB$@da z6&~chz3ug?2XRU)_de*|1w$k0li<4YrtdLuQ{=oF)JfN6Gt*lBQZK4O*J3Ve@P!Ho z>5}PaHh;Lf8irR)8A;FcXn|hHY&q9cVD9fe3`bNwFt?SBrFbrsA7J^Ve!J34gvazK z8TsR>d|~yGm9>KGt(C5l3L1(}uriUMeCIggQNP1@jcP-e(N(5S>PP-cu!B=>0-7AP zW&2d+qW0jCXo+TLmn{rMZs6_*ZQ^}6y5{=wet)m`282tbI|dM?dU5>if|^;XLi|i) zo{Q|6;RU3)3qNstqtF%2P#3>KhqrKer-y8CL}T`Ps|Puad%i23hQ(vR4Xue{a@3aS z_I1{JoM4gcKq@z?+MI?nb*FC=hi0H)Q{-(bM^W;t@)zo&$#5rJe;)q z0Dm>)diepp%6rN!S#ojwft%mMxll$Bo;|KR?J^g^m+lMQlBhmSd70{D)yzHs_orB8h>?n%PTc5)pj?9CA^ zMdyx|f+t7`>Bl2-!50d=e;S6}Xvmfex_=Uzb|r$ClKxsIsMzz%dqPDO5weO%VWqA5 zq1}s$j6FZ;(8(sRUhb{y+>h$H33t`Ki?7a>fWuBAy2RlmtgFVX;hB#2PfkvM|Ma%=vd*9)38PF2|MM$bWha z8!s>u1NQ(PU#?yqb9?CCW7sCXTsdV-LG&OC-MqP6=;nPWH!pfQAHvJI`G8)|O|3oS z=H=9%pAm15hq0bXcsY%Yp_fye551iFkLcwb%gb3@hD~@m>zA+V7bIYNtfo0h)tVFV~u7+|?S@}hAH3)%Ub~1F? zT}|O@=#oHnNkF{(M0srmrhnhCOUE!F@g?E2iEf1{xfR3=@=F5?=1S0F^30-JK~Jc5 z7SP2|EP^fubTKGt;w}b!G*L=!1BZ_$@X>_pk(S$8e&)J)$VU?nZyp?bjsAq$_a|&W zpg&<-tGBrM6ZDoS@jhEL)-wrzg0V65CusAbKSBQy{Rw0F6N<}lf`9%5>v_a@K7>+F zJbehI@}9CxmRuYk!VdZnCgDT)@c$lue7}G6fm)lNpdv4}TkcO-pz=zM7eIe8zx2237<57-W{2^fBNw2FHQIXAI?YXMDz> zrm>{a?7BYi8N=gpJM285+hIqm%DA~5^d>CvK7usXGYPkYu`zTzX!D`lLH`lm4r93; zip#Juw}Z#=#CYz8QV%@c4W;s)GEA0S9CyPmx*M8yH=G`|OMiy`djKYU8{hW3ZEGnp3TVH*Z%+%IIt9zYc%fCk&<*6uar^7wC9MTQt z^yu)7bYLIR;p_FHtFS-D`-S&$H@dthV7!Q@5J`&w2k=bdkww;Ja3s+F!I`4(N&V>& z{i8e>Z0QrW_J7%aDTYE@x$l{McXSTmrLU=M1K5@8U(WjQbrg4U-*0!t50u20VtCcj zJ?eL<6rxJ9@-`s434co+L9bqt;3{5L>s`qo+`ofGGD<6g;V{{YC5_51CaJQC&@+_?+`(Wo0=f^fe{9GY78`^t`Y{JdX-^i^{ zRqGRNSM+vpzRq;fh9hTg&`tk~Tdm){hw()KFEU{~ zHoz=BMN4l^wWwoA&ZV}-@2i6`uXhn?3&wFG3FM&+7?4B>-QcT3o@hZWEkrQ!X7<8% z+NUJUzU{*=i|-6}>VkO5HM0KcKpl65pD>Ye_jx{~n9XaC619% zS6sHF4p_Q5>uz% z*|fLHM$^H;)O_oOw2v1TeiI$$Mv+F@q(NaY{QJBpbuinx0sj>Iln!gmC z2yHMENv0=!q$C{Sr>ugX*-&XL%XcDNle<>YPC>w_Cp>{e;JM?wnb~hsp5b8JXhD_ObmJ>PYIYEV2}8eJMzhRWy4Ah|9$>? z1Fm}DUN__HU&J)i!RZUnE1BgK(+DFs`TOt3&3^L7$hWF}(V;IIGKYjI;6VL|?4yzC zV_O-k*=aj%Pu(!21s;!dT9y}QV&F{ZnKG26tUw|qw$08e-9+Ai-Jyy8k8A_Up6tHLY(R_+D3L!Ok#5OjlF)8GiVVJdWPX z^t9p7NBgO(^>X(0H~p$*q+j?#e&40%2v#uY%H<@)8Gqp{> z%-$egOuSE;l%LyQ(Znt#3$(f-KjD<%I?v+CL8jgfjKMi`u?inBS&W`V3bwC34O|H1 zBP(=i@xA`J59b|z&QrzyvOrf7Fg`V z`x}%yL(}Ma43OGty;GI$+wJnlYK-Eu{O>IMgYIKY3Vz%0e4u%8ex-|*o9bKspR!iLvLOJBuk9kzM*zV=eEAP?1n1e?(Q?mA~+{_;Dm|u4v|{h}YYB@;UFDJ<`eD z3B_v-_0XtpmB=8DWRbqzgM*{b956c3rgldYgVb!P4>@eR^M(+AW8n-TT9FAnNS~?q zdp`r*RmBiVr1z5w8Af(W-3c-A8!0xPoLX_U$bRq%;FgyGsZLZ2(e+b4|Izso%cdRu zeuDZLD>45~;5fcKCg7<^1_$9J^&MM#(-G$}#DEOUB&|aT6KGzXotIdz2*lmRD~1U^ zM}X9ZD-k~13Q0+L6%xErwWogJ1ye*O9-yX)nxNrVMebF0%BZF=&TbsXDv>g?Q|SNN z(N(%hDa?SL*X+$WLj#`-lPfK-$WH(7lsu*HQ)mj5don-K^k!Z0idEe4;)95YM~znD zimtr(<&|5p=QGYLbrq$6Wn@Az??T0Un)qtkBMpD4YO)lJFGZf#&`hXuMX1do_E_6= zXHpSh#Mk#oHw%y{xZsXUvEo=-Lm56)xjP9TjVQ{#tLf5kBQRB@q9-0K3}JTWKL0>* zKToa)Xt9)6Q0Zp`?>ob|hD!-X`qh)Z zhil#%%;-3^a9?xvaM$?izRr7?C)%!ha)p%DT6 zP>*$L48KTv0mBqu9#%RJrQ!#v(53()FrXDEN#iM^zd_o$c(|uopA{g+k3j3bu zP%-Y4BC?7enC-e7DCI6Q*Dw`RYz9&9-@l@*%rQL*8irbFu7w`U*3{E4$X1fb~8F*mxo{y36lYG0C zd=Tg^VX+!Ghs7ZuLq_#hu|SxMg8S~or|rT8W#RHZ5HH(qFlVYI0I$2~QBRye_i=gcuTZfLMJ zpP@*K_rv|k+}mD!p2Cw*cCY7aGW~~Bg1_nLvP=tP1!*yJtJ+ZUcMKvf)1%~2^qDhm z+&~ot;Iz~agr|Kngg4L=#`>$@d3PD*#`P^@CM`;-c2JtvLkPyixW}~xxq0-pDBj?v zs^z{H*ttceOOJbHhweGcXPaEJ;X9c&xsRJuoEp5RaNcN?Kh{~b08^S8Anve#eAkXs zK@Kl{h0Mo-<8=flNRN(FV-6^Cs)U>;Ty!)}2L9GJMMfgwx1c5La4a^MvtPL4-CkEq z!HpYVV!-6L4!^p*ynXM%Zw{R@zesgwJf^g{eR4m%wQ7o5Xa05JnyUe`IfY5to^c&& zyj#kf)lZZ|(3x~!N1mgk%*vu)(zOgbL+0E)q`9NF*!M1y&K}-yIqbSQ>Edc{j$)3N z0Bno#2Y>QR^uZc1IGsh>`Xa`?gXC~;aa3jT-t<9tOG-4iwcy*#+iC?4)3|~qyvy8e ztn)`tTu67;t0Xw1!3*uNJ)om0`kmtOd4PQfG}$JyyET-M;zNx= z6W(j8p*;<3x{D2dJXzvA1;6|DOV2N+oCQpnk7)pkxsDmK& z3r(|`4$=1Dl)UO#hMaQEt3lyme9@w!xzdqiVCC2abrt zH%PkPF?J9cqhL#k{G~H8C~KJu(^BQb-`KzZqgg!=3%Divs{vQWZAh1U$+Ioy>?_n6 z_hzMGreUAa93-ea`X?}0QB87dma&@zQoode;JPqj8gTnLr|n?B<}O)Pdj64fVN_Y$ zmHpd&FU8m=McYK5t+Co(Iz<<{!sHL2&5X+Nscq#Adr9a#HX5R$&|7UsW-^7FNRlfV zP|m2^&~7@9|Mb!y`WM}y*XEZ3up&9t=N@M(<2R5ah2NA@pi2@)Qq z=HZxrNuZN%Qe91WCe+?3`X(8f5&`XbBVeBXcmT(syF1h80s>6Aw*yV-EzG|F^1qT& zwmR2>yE=PRQx(T_oAHmexvXZNgbfLfeId=PXby+@Nfzdj#*@~oK1H%!B)o>S_@Ue( zZZ;qO$H(^TGA*F2VsO0D=T*%K`I;-(xw!mM=qr#hV%9?P zCLnb))hti&plqobP656qGh5k61_D^*F?_x z(gqz(OAj#HpTC@h?uQCm-wqALF>57#bZ}s_v`H>4Q#?6LM&K>bL zF1#_!i%KNrA3g3D7EhDYoJV%0_S8!RSIFP#3$RKJsm{saH;Kfq+y^pLL(*AXVDZp> z)0J)05}EyhD4;$b^K-lm4%owVs0prj(0Jl|(U2QnFdD;cJ# zAZU$9MIem-O_C9O+SySyv%B^=97XTLgl?0)PLg&_c+g^cvJt+#4vTky;%f=K0hP%~5KBFK(cZqi3&yP|oULwgpR zgWpm!NX@9q+nc9i;)_sQ$S+4I1l(_XIuz`W6<7+Zf!{-Q6cw!U*iceLlBw(yUHft8 zG6uf15Mh>|julBHH)7#hyPj50IkRi3+JYI#4Pltr#h63@a_idH4VTn=<1Y@(JPvGY zPk(aWP0YDg8hT}o6gQ<7cd+A)wmC*W@y1D^C-qto0flHP%BznHwZ1Jcp&wvr&Ylbp zG3qReUJeh@RZ6@g_bJxy6FA-zwO03aPi6bm$>w5G;)rqAxUD6&?xYiZ-KU6Mk&nAg zTRyV0V$lmQe)neg0_U*Kvt83l&*<9ljb^E-tcg;=bVMMBH zRKmfx*+$3eF|CtFHoD_Glns&l3*Zl3i|L#U|1!hX9FfnR+||Tkc=r;(DsN`l&)3r5 zrOPv_|GBWg^TvmXu%+6+sLl4;jnn-TQJ^j97|7+gF?!K!bcDxdJDVEY;Vt&K6|sQ0 zOud7L#;(Ahq0@I6pFfr`_;OITsHJnM#_!HKRUAh?aNpjsyl0vwHSvtI_QcY7&|}GFcl4$7YmB1bq2^qg>D=G~HC zHIN>;YRbeEsH6Ky+VaWQF$uHyI3(a>kxe8UFVc1yc+c&+;tMMviF_(_y(AbwRCf13 z%qt}Q*@B#X_PBjUde^?0GYffm^LF{DpePxKziPqi5!smqvD{#H_(0mro4pTMndsql?LMhIAd{Zq(#>&b>+GX+1^P&6 zy1g&moSwDUL1Q1Z_6| z{5|Vk^Iqbbv5&2LlI^rxJ{a-pIWn9&t}(*KAD!@b@=UQ{l_HQ&z^l8)I)2F60(0UN z>_+%nrs1}wV%2K!>!mld>UQ3H5ZFxeD8-5QXwzk)8+jpzAQ6KMHW)6CCx{ROS1L>B zl4?L+%seB;28mj#Ku%TjbKZ&uaqwc4mk>86`$4Y{ZYi#l>U_89kw{_FEJfYW&k#Qs z+R@JMq++@6@-9ryOyACo&}jw5n%C$_`l0vpJL&q9&tD?@2Q%x!-|D<)X+S1brp3W`NlGHRlV-R#)lK7P> zSbebo0IeP24#T2@=}NXr#v9&H7E(fQkyUTPNO#r5v(Q56a)AH$w(nP;;QO8Ig8by~ zI<7zb@WagY(GBzTpc{n+t(}Tvp8zf7t`=>;z*($`dB(X5VRt4aN0m+s65%wfy2eBu z1~F98|?aM^()_@=nB>)DlOO?(5`pt7Ufb zxrLvTzyDwVPeX%tCD#-THh@Po;fz0ln!D_NgPJ&e92tDugd7lw-R}b-t-wxAgb{wj zpZlLRW2#OPGpYgaVo~Fhot}(7X6iF(8I@INgZObso#&)^XQP>z6~FcHt2FWcL0rbv#*c=+9GTd&sfrqY;lq zX*Uf ztRf8vI^Y+>Xbq9AM5QHVIKwfY;A;$$>-^@0kg`uuAVRrO1c8vEMyHl&7Km*^p0eWc z4MyitSSEYMm@^GlCXOO!B#C|@`)t6`^~6#4)B~wY?Fopm=nGaSaAzAqQTdBI=NIRV z9QrTzfB%T_FATHE^Doe=MO$QgmPT4+?k!aVzE4|Zgt5t8teFjvc<@vaJjJN66sxjz z^5~2)eN^34J5{vOu<3*+*%uh6@czA&n*N=zheL&W_)XGdLysXuM2jPKT1IJ^Wmv(& zxsA^UIPfk(0Gh3llhnJtCfErMZGA#VozIQcAA@qy~K zhydLQtE|f(i2M6d@{^tx@s)*<7JpKEpR?xR^>hBih*6!yti-7Nfgj_Hfh(I9#oI$C z&||9}yIhXTxDMhW1mmoM+b9jm8#Ra5+4UI(s5g%HMDYe1Y)4!Z5+p;x{R2+@tK~}G zcNLk)_Gi%*oUmX}F4>FZM-#KF(V5aD*$k;G@6kiQE^wmnX zT(4MR-=Z4VpoeJ3E0VcVx_PezHcr`lXLlrw+mTwT==3@jXmBb7ZF^ZKb*z@Hu zv!9;^sh|__CYbTXpdAMaVy9Fn3!%{$KUH{NGG=@v+6`UpR+SfB@^xK2=&gDf$}#!e z=p`vS5&|j4^44Dw+P;W~rr;;Zl|~RQB??Rf>&wueM=x+gWD4%_ab6iCy z80=T!n{CG3%N}le-cO){pucD1ZJt4Hj3$L*rRJ(E;gp*wBGIyv1SQJ7i19kS%ga{x zwve~QFDmPhj~g^hRi;}$H>znr(do@QE=S{p?D$=m7qZ2g=0T=DP+6crK!^4K)Amj3 z6-d&sfSXU(azY5-Shy)o-=GF#IE(jU*=V0ErhQuf9!6&YWV00~TB2}Xn9(p_jS`?G zVtLW4)I>cKOo`NjM&5n8X2xs$*8Ud%=4y^`Taf;fl`1dQ5ch4`NeT}Q!EdBUXU)c; zeq3T$p3@X4UUVIXq!FrXyc^oZH+Y#;2fT+A_9j>C{kYH1PwM2;Y>KNfFR6smVaZVN zmd@gS!o~@FoGp`v(be`Z8dOjcVGR}AiN4Rma0k;Vk}!XAlxo%p)>9vD8X*pj&~Xe` z!v{;oAVwOO^>G5LKSNpVIa}&0KU-;&R(Gj}qE%c&Y&MLa>_57r*#}QQMF6-C0jInX z)t2yK{G5s98^V596r>PGDs(#9Psnbfi1&Zc(M!=RHIk1;$gA)h07+B7KYgXmv-83*x{HH@CwmLC@rV5V85` zY2IL3k2pVn^+wg#bu3UJ(*IR+tUgZQ+UJLExFvEsc{9u`k+4sHnKYq~VW6AYY_{;$ zWbB&*FlN`|Mvq(9-S#>YOYrEfUZrg3{_jdh^lYI4)f|bVrugL|3OlU%5Rl~B3T+uL z5O6t{+t@ny%1mw{0a1hOqWwx3HY_qVS&dxAQf=lpJOLYvoE9<)gGX%X`;1XxV~9mq{P(Q57KjYHA#%S4la5V-w_UlF)1UBG%dheo>>8Zz0= zS-`5FkSYkg?W#q7srjZUMOcPeBzT#qL@eb;@Zgk3Rvuqv1%B_em?WSrD$wx*OH$FD z$%pUUD-t7f+fO{_X-TRkLgQUmAgCU9z=Wj&mwSd3+jOZYyArUA3#{jgq65vd>uYunvy5iDY19&p$>CU~5_6EktdNm!WHbYfLX ztsTnO!BrOC->^{r169ky?vDqAe^Z;uG~rfbc&9Z7q&_=1&}wkQ*VxC@74CP%4CV#_2+VsNHg?J z^s?s>I-w@CV%UMbE_errtvOICQb|`4nGQp9`y-E>Q_w`(5D|3yK7z z@HajS91?{u$qnT(s7Z>g;5$~46U}S+;sS)%6l1Y6p0}k({DIt`9Ob9mTe@o)pjlW22Zxf#_O52YC@Lg5zU@15Ob6q9)_~2c zpisDKoKqES^rn~a_Jr?qLi|YOeNyvRUi0>MJ8Lo!$%Jrwf6mTPxc}p7@)&{t!ZN5< zUdYcI#n&*F7|#A>u)MG4-GtjpA~EKpX`_h#EQ%Lzy}RC7tu$5O#YL==)8eQFVq zxoRF5cLbE7__?N41I?B zR{)!-TE$T&2W)1*G$VB;p}PuPCPmof9LIP1r7Xk>cD5)ak1~ZsBp*s_l{AuJXLi%9 zNo*hYL3SXOPj4NgypQ$v<7F`i^pKHKnE!a0)9;#@tIJ#M^Tz!tk=LonxtUD*Fp(HYA^+y^}`i+_A~Pn-c$D>e;xg5Zp?fx2^>oe zQ(Tu=uX2dAM4G=L;!0`t`H5cePtam~BHs`u1`84kWBMyt=8Vt*kEg`m91MOm~ z-+~R}Kga#hJSU(w(^Sm)a()(FXK2sr-cv%tBIOb9pOq&MHHWesF?s_x# z+#dn0m3r895FLA(tGUK=f z;Dw;k#wSweq4?Z@ytB?PAEpmtSgR8 zv7tIh=etCkR|+e@ z6@&WEPmPMap?VnM31YciFhI5yM@UTFVv5%s{OdMa&(^mdBs|P)By0Alpj>f0`kJ`G zk(A#mN`mFldG>e+ayM6)iK>SzBrv6kihuQ?gfUA>yh|A>=S0kSs>%UV5q{?(dO+o4 z1{2n}hP{bKVBP9?D>dub0zgmp1LOr58}{^1j7HKK13 zr^VwED1ac6%9in@yGWACP+i!X)G zBVkJB-Pn9B`ek^J8#8~LH-belI}C^~FA(r33=s9{Z)tdGfWgw_(_joP=jBX> z)Vy~v@&`qi7!R5rjDqHTtxoOz0!rPJf;jT#VIXh@>x@B6fla) zm&6tR4LGb&Bd5-=K^iTOTKC%F4TZ|bG0kh0KHL_O6SZ1lVpJwbjX_&P1g@;7{>lPT zSo&o@y?w`gwbchoe2EfDoPz>NTwYag-5l2P3%GI%9Jn$fNTj4B)}&sj;Q{4DA*3Xg zod1!vAZRxas1G_^32JG{r7D4oLz8$=^8M!67}H366;RV?Vh6{W6se-Zi@Ku1YCc2; z7aLnS&5}^!6!C;8OAu%#wJ0}AP1Oi~gQc_&@a7&~E)n&S?g7@u2oi!UY)YdF6rqxp;tIujOSF ztO81k-^~PCO|)bk)Aws#8)AwE-Ad!UJ44IM&_x9fSn7$b{tP>$^4F28<#%Sz7I}47%oKQ4Fb#zHvg!d_EF3`dVE{ z0m2c`N)C?g=d1Y;3GFInMj=9O(v~RsBKa(^zM10B3zH$sW19F{qpgA{AB&`XB72ar z@s%N?;Wj2NCcY$ptss-CU2uSCgL&HM)_di#8sv+kdiYuRb_6M=Ivo50F^MtPWi!+H zthtnGqk5pK#>5O)16S%gI z%&OI58&1zD(S3S!iVC_I_OoIU)NQiAG=q6FOn+%+J4eOL@bEe5fu`Rah`&Ks`q8+f zKyu`vKmxK*AeWLseR(&lEK*y{Vc{jpVPOvPVd2maobu3p2?FDMZxM9TVP^L|BwD$`_UEd?W=3Ty9*U9goBG9A^nfNfUh`KXo@sNQg{|@+SjQ%JYyF zlZn!j6?>m^WY`D8RwUdmckSN%$T}NxC5VTuNFu{VRguvPSsW5RbC70>j}+#m6g~~9 zNNS3FE)Ug>i2s*d!L^37DU+s8AaaRl{6nr;%wZ`Ixge)N%YhqBJn@S1snYza@CjrAIU}kzmN;- zUvh;={C~)W^$)qShudJIqw32|1_~!%Gm@h#UR;6p@%|}QJ4S(k6YhBjvSEN*BKBBB zRVLOClU?XOBUL;U4Nz2RfTBv{KT*|ds3!xnNj++SsK;t6k_6KvbX$D&tfr_GxYh(g?a@w4mO0zB)%7B#=nMq4 zvCd%6YSn%dKjQn#@<;D_ujh@AqJHB|8hU0{d3trXW;Y%6rARep7uT^Px@8^v)#|*4 zJk)TGH%;=5uuU$jNz`ymppzzQ_>xK9ge%^#QEc+q0cKswZ(WMgJ)dEt9E^^LAz760 z7HBtTPSo(0AMj3^Ee8~RhRN75w<;OuZC^YGshJ+tu>~jLck9B4%-`OJkj~UFTEfDy#zWR3+626-58&XvbD_-s_66kFm0U7m> zAf6E{Plia2fifE>FG~0l2xnQ4c5#&C2SKIHC_dKajWC@BFM;hqNxnmk{tsYc0s0kWyWObcHg+J5J zBo~+H=?ZHV2;AH(cFU{Gs;QKl_mD&^s*93@gQhFvw|xvN0j z0y?R~?N%@6E6h;tR%1Dn&Q!K`?_(CcWE(DdLQbY@H5DIf-Ngbg)@eV$YO} zit+kNnN<)aD+eOtKD2B>_nUhpvH@*aueH^6=v67XjgiOF77=Hm~ZL3R0^a}*6sCjhF(l0}gXo(6zQ{?w#0wfv!9 zjUnY>wZx2Oz%p@So`WsUd?kYySbEAftd>JvdV1AdRG%OSLBC`XDj`uCTrw%8*+v1# zVZwY6@v!arw;0|ENZA?m@H}nkEwDVA_z;;UO4(U^W)PuM!Ydn z2uq-X2&b}`F^u-u@bDwC!AN!tN;!w!%UKXr0)!7`wSVyejKPYT1My=En9D2~-Ln)L zKNmz@*~(~4fVWaG$j$CAZ$y9>BNlvv_ujNRIIQU%OV2P7c=&>K- zY%-$Ix+;vS8PZae&ye!p3R~j8@|3vp|HxAjh3f%M!O#Iow_(1(e{)PkA+HT}Wkl3z zWR&-Gur01eAQh-iq5ro|!2;DOSfGr81(DT9Te zj8YG(QU0SBPK)^rM@uP_rP?kB}wAQsIrf3LcrhGfY`^(TF z1O<5g)#}T9LMbFD5q&aa>+JC>c?D>#{VokX|Al}X-6LC2?!OQSxCKEVD3|P*CMehY zoIYbKD8DS>Hm+;e=tq{$kn3Vxei;Y?B8qT9xuEIfGgLvjAO;*){KEi*iXc)TfHrBf z?H78OT0>jsH7Nk)esNg>0e_EI4Tp2Ijs^ig*vN#ryAX(_qlW$60rh^d=1b5c*g7Nt z?gAX-ipGdE4fSwE6z!I-L)^jSEn$9!5dK*p56V@iWak~7WNn=b%r8S)gIg!CbOCXL z2gD8hEJzVWd}jMuFh@gE51=(H9$1qRSbJ*(ZwF_Af_?(%3Nn@OrR=)N3OFx8j?8ke zoP48l=fo)46iUF&9y;ZQ9W?NlsDw*QH`PAL9hA#UzBs1*e^qJKu9B=Bq+C3iz+tg8B4@U5%u2HUqrD8Tr@XozkW3y^_HE1WNa7_ zcc^vm+kOQn>3#(b>AqFw={%>H5-qG(r97;cwKS~PS2$8d_=#xl5dH@e1X9Ho(B?n7 z18E8*M3AOIBIQvj$<Itd+(-alXdKBZO;8Tr@SX__AA>!Qe9}M^8IYhrfeOm)tKtO_`tr%$ zU?y48C@%n7vkeiDgOAA}=z;Pd|KyGNhC86}FD}6T@lOK^sOK013IeUEaxNnEApg{- zcSABhU0}p(DpmiFe=;nC8c_JxJ`E^V^{_nz!l{SplpUTA4CETCl4slq2m#P zOwPu!aJ_2yIg}kzGfySjIzeshbnJAXVHqM0mn9fCb0Z%I6k@;{GnlT9c#dwC5|FA+ z8gvEn{|pc7Cn({2fRakHlUgDu0PmS)S%Y#wD*;VCx^I=XH0b7W_ty^ge$3@~(huKX@HLKc*Hmj zu4CCR`~W_V1zW2*YgDk#fGny*TOWhJ-3}gqYGb{vg&Cg&_f`1+ zd@4p8XVv4Jw-u6hi*bFEy`le}u@TCVAtXL$sAi5Q=fh^ewdBn-KL^&7P;Nk9S6xXQ z-|0GHvxD`Csb4MgGHmU{=Ms4O9CdPuTxc2#>=Bg_XL2*lIy%UuW~dNSAMz#hwT#q5 z6?E1ABlcO1Lw;x*mH$`MjnS4@r*(3Neb2Rl&CTHK?GJ=ZhJx3t;3q$tPu9Y$N<&Jd zJ?)n|#4&}!^o1IqG>i4`hJ6M~OQ-yP5HL?GNW*P;;XMbh@p`(oBh)@o40ID}d%uId zfGP2L)xKV6`^BFtOi}zoK_1NjJGFL2+AdyLNrVt*`5Esn$Romp(c_efDUCu4IU5`} zC0R0*x}yshPiLp+o#I47!n_LDF2UEl>%UJ6Pgj$Py+45S$N=Z6vI4WFd#;9agP~wd zPv-GWWBNGZR)>c8Ar$tjT7vUajnH^2pqA;c%|FG}&T8|R7*Wc)XOHMgl*2D^SFEgd zQrGktTg-#n+()gWFIiv9lBwObATk-47#^$dl}b7jG0&&c4rJjDrOJ<_ZUSQ|G6P1; z9=Mgqot+^sb@5z}42dn6xsT|4rmjsF%z>li5iEmBj{!4^1}Wi&y+`CPkFP?VtBb> zB50OXlH4}24xVNiC*XV-8*v zyy#8;`PTM?Hv~Ny`z)B);(MLH*`?eowsf_|e)Z>>rL>Tn0U_Z>r{rhhCr}PPZjiW$ z6Hr|D%H+Ls5Rux-=zujHq0!74gvnSXR5G+84k@~LoCy|@N|}j50@q2|ZfaYYfRU`V z^7BX$^oEY$vA{VFN7vut@ASgfy|0&5T#opKk?Rx+t?re<`<;=TP?p)60t#!t=(v?a zJgkEn=`WKCNFT)u3sOygQvojq0fT%TbGoFLNwpKf_fD?pi0;XT9^D;H{!UuaUHJ0s zR9AsGua7d_R91yFFPtOI<0E`!l$k0JxhI+4NrKY$g)AIkd9^&ERP=5u>;c zSq=}EudYen*nPyw>vd}HtedRMCEk+NpsBNWEwt0QFJC?86-{{a{MF_X%VcHZwZiw8 zP{=J~+%{W}SW*Tuay*?6urjPw9U_2MYtZH`T(2luOSH=fPZHQ83xy-o)(&d&^9530 zB<9*Q1lI@;xX6#ZH-X`pilv&jILrs8r|#XsG-GkxZiA#r9MOI#w>RR1rT#R>d{?1J zOCs9;yr$zG;i>Xr;?Iflx6PMw*fV?F9IRG16@pWzbgqg;LOt#D+Qi(`F#bjJ`2HID zt}1n19yP4f1C*W`g#E7-^L1};CnpWpKIVeGW?_H2jq%fyp@DoPp-qJscxNdGcHCQZ ze+_(UFJG2q;C^$q3&@KutCJhzE!63vlu; zMSO*yxHvWA=>Q^NDE6WnlgbBI;>{V8E*aA1TF)KgM?$N}7D%zV?6J|iqt5J2B z7vo8*<}V0!(idBy9O7DG&0~z;#_+;h;i)Y}2*X>^7RT}z&52faV2V@{r(mgUq6Y2@ z(*78YRD!pPN?wjvhqtN>@s_F$WtaGRCeZ+D$j&61fuZbJ36~juuStofv1%!bmv)|# zouO(T+5C~WG2Wn)C%+KaE9O!gpzx4Gn*Jqa{1no2x08RpH#$_GCe<1;h#++ zX-nV{%}B`LMGsW{+%Cuz{$z*cPP$Rxmzx|lIbm60pI&kE!pt8$Ae_7|9e; zTBbVPVo@>J`}stiytHhwEk*=$aB+bgX3Idz`bz2zC*(`p+G3Ga2$ydWI{DM#?O$Hw zUtBO1e?t^p{*c=wg?1~04iFiqr8of&qtX10^!3QNCi$f&>jH%WSx%G z`(_}iq4s_y`aZPb4^F-lS9w8xT=tOEE=Hjtn!3YF%U^L3wuy;`tTorJh+i5e;ZfR; zz^OjrFcgr;`1V0gI#^9IpHHHgXAPZV9Uh$i==gk3<9hQoE_sL)A$buWE;P*66So-$pYRlC!ERN0+xVa#Jy*f%_Khi`VeV#9ncnFywKNYY3zVPcQhRIGX< zy>jL~`s*!PUb&(X6`pv(2azMNVbnQkPlOjkhI-kMrMsqJmP-B;LR7`KyE}$=XZcbA zz-C2xb-J{W=9_bO;EscSBl_ZJlNwH%W4VE13qTye3i2m84&PXg%_n{}C*V9|ci^~` zDk!DQ7m^d-Xgy;8MwSALC0dN8dKftdR_Q#g;pV2EAd9pbNrFs1JxB|@6`pr!Y~p5f z;N8OFgY$89T%zTm(zX78Gr%;tX&lqzQ>*JUx`9kx?P;j2=pz{AilOof2pe?d*SawW zE4p9No3b%{Wi>|ifOfK=?K~yYBzCeuuNb!0jCS-%ZrPseXHv~k z&CO!xCm=M%6j_6I(8Yq4j7T)WKIwn8T@$^!Qk#@k^)=i$!`0+~i|!ZJ+GGWNm&J@l z^|3JyA=vm1{_WIVK_aT2t1Lij(T+JD&&WXqLT1rUQRGKG7o{+e;{P?Lrp(5hCZQg+;Z-*80D8Qii(sxP!}k|_S_)5LQf)j5r&Om{ww6+nN=sViAu&!soq zT)zD{4rXptRse)`Fv>UTY{$Y~gIEiChi6YWcValtsMf0dDVWRb%SMi{T`eDHAx}>i z=CF*F%5L~Zzmvt{>mo6DJv|&xi?FQ=!Zml5QH-qXj3xCqgl)O* zanPY3-O~6*&*pldF49Dn66l2AbH$CH&36}|!yJH={>ePLh?8YBCXo7Zr}ddPuT{t|fgp;H6xbH?GSwIiG{7YaPn^5QFT~{5rUv zNqajZ!u2xW$%tZiv#?D~u7k;)m`)Rg1bh%bRW~}}cUYd_wM$n@wmXRfE@oFX@Aj9^z6*Di>Aezj*-zOKza|-V zV-I6Tp-01V_R0RgtjWA5=H{7gkxpLYTsBE6{*&ALySX(Qhuw91w+gS%K=y*8130P$ zXWoY7Uavz9{WOiq3w@-b`t6I&E?uCD9xrB5@)9&lIo)WVB=V#jKM<2uXA?d%%wyX*oY2QsXQ2^|=iT-lyct4!snbw<6 z2?)(xC@HG@^Df_n`Bpqt9%Mq3x^`qh39P8Oo6luivCyJjOF zC*Cr1%A(kApqjfZ491-RP0ed&*h**Eob*%#z<0JWaPe zIoj3o$Y{n*v$p<*^Og2BV^X?c`HQZY!`^#>*DF5kZ$79eyNd27Mhl5P~ zM`~e54hweI0eFoKhvja#X_pKvz;7d_GwG+NWa`rNtL^6h!9Rsey3nND*dWHkJm&r= zO$OD-+9tQQd=zR+AlLA#%ku=tKpL~b4iBl zla_b>;`Nxhr1*#G{7y?A=rP59-IMbUm&%y-*zdoY5T`XUB5@%N!+#Y419DNq@TYj2)^dg9!^E z*?r*sI5YB;>AS;)qrnjbHgR+2PEi^>ueAIDG&pEaOcOn^R#Q`^NAgGqTCJ@3)x4;* zIq-(8xgj)0&(_6B`&eDTzVq(Q)|pQ$vqYB-j6rJ#IK8ZBUhv=9F%i3dZP^Z6*6wplvnHP|l)_ZLOCC2~IPeU`kocFr) ziwSPx#>2Okj(wQ{4Gu#R^sspSIc9avqTaX(_`$9|Pwv>h`j-%R&PA5113ZXX_6O~ExiJl19iL6P;84aZuU z0!;1@Jo5-!HIse}XiTDBZTJ(Gi6LsDNcRGT9f?Wr@+#aDLvNCe{5yPvV9lXd^YOxn zUJvfQ)qCI=PWb}G{}nC;(fTrdP^U|UeKa0fOfZ>buynnQqbW;D1we8}qYvnGZQy8= z`l=33nYpUeIS(E+u#i>jTN>P6^rGZC93JXx$hVT|0>6)Lm^Q|oYNLN)+`oDSvhM|4 zCSae)ui?$BQ(AFIZi0K*qBFmlREUCa!Rk%2CS3t3D9^WkeAkbX%r;ANGl~l<~F=Ar+7|q%tZt#22I~q#=z+Y7{4QmGO!dg*6b02xq4acM$wV0ycn- zor^BSQ`Iv-fSfhrO{dc;SA#HGFH#VtT`e}l(0nS`jHh&Bh!KEzWO0(djSD(+g^&A* zCmD@mI*YNo!>;n~gjJ3Za$nHsi_H(@iHQy+&YQ=a(FX_u?gM|uUzvLGIs4>9@82+F zEEg9FxMhUuNWrfC?Ud(_!#lRS569+m%TKql3egeB1Jn~{k$)o z)q{Fr3z-#yW7d}HO_rf);Jxv3M{a11ctXWD^6{wj?^?yySSDk4_} zLlkL9DrH5{9!Ky`5-r;C!oT6#h(vtNG{Zwi-Vky+s_+~Jmy5EGxGUyFmvGdl9dS?r z9(Q306F5#XI6K>e)^<|?j%<@n;RJnZ!Cr9pjFg$tqmPQ>FW zg-%_NcIa4@q#++IC*on%FsklHlzc?*fayl^O}$M&QYM~4NyE>5sBQ+P&mK}lo>H6h z()d|4stnO9jJU};RVvHS(g3&8ghk{|oEM%ZHFu&kgMZEbt}4{q z%LvA@IMPfMv=D#u4cDLvYj<^3?79ddpNZHlsU>!%9UnJo`T_?LX9Gz?mX%`lnO9}H z5oQx!+#PVAi>~(1e_*k^BR>3R3;uMJj4}S%2`vX_WBEvGetcP{nvJMqQyywbm-?j6 zie%0a5UQa^V)9OWVQ56h7$mYRChuCRPI#ZpsM*%g*!Q!K~(gXP2&OU*i#U12#j#d5ko zSk6qbob7)PmUB}q=O$Q)=rr&g*{(TAj>N(E=2sINu5s+EvtR1By|YZwCrx zPwX39nwdSoU``mkdFt`8h8oIx$c%!1>&Wh$aEcWf==IUf_r3`#qwwE4s^K^g<6z>O zlU1TA0o{{-q85KOh($6~B`}apy)>a`_YUo&YK1K?Gg@;Ao+3?Ed|O@~V7VCB=XDz$ zW;+Gd6!EQ}UP76gnl~<5dO04mS+)iBFy@I$)GuqC4Y|g6x09m&Q&DSKkNV$2p=~WL zEU)vfq%HG{EKjbKZ1FVF&syVa{QU<|O928D02BZK00<5M0%#alT_|JF2@C)L{F5T1 vI3Gc27+35w%iv~~003R12>=lQ0000000031AOHXWK9hN)BnH!>00000wNM\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Infoblox%20Cloud%20Data%20Connector/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 8, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Infoblox%20Cloud%20Data%20Connector/ReleaseNotes.md)\r \n There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Infoblox](https://www.infoblox.com/) Cloud solution allows you to easily connect your Infoblox BloxOne data with Microsoft Sentinel. By connecting your logs to Microsoft Sentinel, you can take advantage of search & correlation, alerting, and threat intelligence enrichment for each log.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n \r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n \r\n a. [Agent based logs collection from Windows and Linux machines ](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-custom-logs)\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 8, **Playbooks:** 11\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -159,7 +159,7 @@ "name": "analytic1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + "text": "Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser)." } } ] @@ -187,7 +187,7 @@ "name": "analytic3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + "text": "At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser)." } } ] @@ -215,7 +215,7 @@ "name": "analytic5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt)." + "text": "Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser)." } } ] diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index 18337b61af8..39b856f72d3 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -237,7 +237,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox CDC BloxOne DDI & Threat Defense Workbook\\r\\n\\r\\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \\r\\n\\r\\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\nSupported BloxOne Cloud Source log types:\\r\\n* Threat Defense Query/Response Log\\r\\n* Threat Defense Threat Feeds Hits Log\\r\\n* DDI Query/Response Log\\r\\n* DDI DHCP Lease Log\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS & DHCP Overview\",\"subTarget\":\"DNS & DHCP Overview\",\"style\":\"link\"},{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Overview\",\"subTarget\":\"Security Overview\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Device\",\"subTarget\":\"Events by Device\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Domain\",\"subTarget\":\"Events by Domain\",\"style\":\"link\"},{\"id\":\"2e942b67-07c4-4579-ac5b-f43c5b01c51c\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Filters\",\"subTarget\":\"Filters\",\"style\":\"link\"}]},\"name\":\"links - 16\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9878ee10-a66a-4438-afdd-29789d76bd61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":14400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\\r\\n\\r\\n---\\r\\n\",\"style\":\"info\"},\"customWidth\":\"70\",\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"0 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Device\\r\\n---\\r\\n#### Get a closer look into where threat data is originating. \\r\\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"12793c1f-b77e-4319-99f6-b6b4230d9cfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19099936-395c-4ac9-a462-097e6c1fe50c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"2d6b86ef-4bd8-4afd-be72-83f7cb365585\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8e48699a-6c2e-42b2-bcd8-15cfce54fe4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"f57d037a-57c8-4b7b-93fd-8f6215d1c9c2\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Device in the chart below to further drilldown the device.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Hit Count by Device\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Device\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {ip} - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Feed Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Threat Class Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Class Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"group\":\"ThreatLevel\",\"createOtherGroup\":\"\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"label\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"label\":\"\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"label\":\"\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"label\":\"\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Level Trend for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Action Trend for {ip}\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Queries for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"60%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Queries for {ip}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {ip} by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"80\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Queries for {ip} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Events for {ip} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Total Events for {ip} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Device\"},\"name\":\"Events by Device\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Destination Domain\\r\\n---\\r\\n#### Get a closer look into what is being queried. \\r\\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d2856d9-b23c-4779-916d-abef2e4c50e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a5663eb6-1030-421e-a60a-6af9f4af3f99\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"5cbd5c34-3703-4835-aa3b-228504310c1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3c67b4c6-8cf3-4c75-87ea-4bca83dee296\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"730927d0-a8ce-461d-b20b-fe9cda17c486\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Queries by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Query in the chart below to further drilldown the query.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Hit Count by Query/Domain\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestinationDnsDomain\",\"exportParameterName\":\"domain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Query/Domain\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {domain}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {domain} - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Devices Querying {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Devices Querying {domain}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Devices Querying {domain} by Time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Devices Querying {domain} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Events for {domain} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {domain} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Domain\"},\"name\":\"Events by Domain\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne Threat Defense Security Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne Threat Defense security data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1eedd218-57c0-43e3-a306-a716380b05e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Threat Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(ThreatClass)\",\"size\":3,\"title\":\"Unique Threat Classes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_ThreatClass\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Security Hits (All Actions)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Security Hits (All Actions)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Allowed + Logged Hits (PASSTHRU)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Allowed + Logged Hits (PASSTHRU)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Block\\\" or SimplifiedDeviceAction == \\\"NXDOMAIN\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Blocked Hits (NXDOMAIN)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Blocked Hits (NXDOMAIN)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Redirect\\\" or SimplifiedDeviceAction == \\\"REDIRECT\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Redirects (REDIRECT)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Redirects (REDIRECT)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| where ThreatLevel == \\\"High\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total High Threat Level Hits Not Blocked\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total High Threat Level Hits Not Blocked\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName !has_cs \\\"CAT_\\\" and InfobloxRPZ !has_cs \\\"CAT_\\\" and InfobloxB1FeedName !has_cs \\\"APP_\\\" and InfobloxRPZ !has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Non-Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"coldHot\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Non-Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"yellow\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Application Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\",\"size\":3,\"title\":\"Security Hits over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"60\",\"name\":\"Security Hits over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 50 by count_ desc\",\"size\":2,\"title\":\"Top Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"65\",\"name\":\"Top Indicators\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ desc\",\"size\":3,\"title\":\"Top Impacted IPs\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"35\",\"name\":\"Top Impacted IPs\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Threat Level\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\\\"N/A\\\",1, 0,\\\"Info\\\",2, 0,\\\"Low\\\",3, 0,\\\"Medium\\\",4, 0,\\\"High\\\",5]\\r\\n|union\\r\\n(\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatLevel_count = case(ThreatLevel == \\\"High\\\", 5, ThreatLevel==\\\"Medium\\\", 4, ThreatLevel==\\\"Low\\\", 3, ThreatLevel==\\\"Info\\\", 2, 1)\\r\\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\\r\\n)\\r\\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\\r\\n| sort by ThreatLevel_count asc\",\"size\":0,\"title\":\"Hit Count by Threat Level\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"graph\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"status_count\",\"sortOrderField\":1,\"size\":\"auto\"},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"nodeIdField\":\"Count\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"ThreatLevel\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\"},{\"operator\":\"Default\",\"representation\":\"gray\"}]},\"hivesMargin\":5}},\"customWidth\":\"30\",\"name\":\"Hit Count by Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"70\",\"name\":\"Threat Level Trend\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Feed\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n\\r\\n//| summarize c = count() by InfobloxB1FeedName\\r\\n//| summarize c = sum(c) by InfobloxB1FeedName = tolower(InfobloxB1FeedName)\\r\\n\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Hit Count by Feed\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Feed\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"0\",\"label\":\"N/A\",\"color\":\"green\"},{\"seriesName\":\"1\",\"label\":\"Low/Info\",\"color\":\"blue\"},{\"seriesName\":\"8\",\"label\":\"High\",\"color\":\"red\"},{\"seriesName\":\"5\",\"label\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"70\",\"name\":\"Feed Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Class\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| order by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hit Count by Class\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Class\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Class Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"name\":\"Class Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Action\"},\"name\":\"text - 8 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SimplifiedDeviceAction\\r\\n| top 10 by count_ desc\",\"size\":0,\"title\":\"Hit Count By Action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"30\",\"name\":\"Hit Count By Action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"70\",\"name\":\"Action Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"showPin\":false,\"name\":\"RPZ Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Security Overview\"},\"name\":\"Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne DNS Query/Response & DHCP Leases Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Queries (Domains)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Queries (Domains)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode\",\"size\":0,\"title\":\"DNS Queries over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DNS Queries over Time - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"New DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"New DHCP Leases (Unique IPs)\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false,\"size\":\"full\"}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Updated DHCP Leases \",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Updated DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Released DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Released DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| summarize avg(toint(column_ifexists(\\\"InfobloxLifetime\\\", \\\"\\\")))\",\"size\":3,\"title\":\"Average Lease Lifespan (seconds)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"avg_InfobloxLifetime\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Average Lease Lifespan (seconds)\"}]},\"customWidth\":\"40\",\"name\":\"Totals - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"title\":\"DHCP Leases over Time\",\"color\":\"magenta\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DHCP Leases over Time\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DNS Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Top Requested Domains\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Top Requested Domains\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"title\":\"Response Codes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Response Codes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxB1ConnectionType\",\"size\":3,\"title\":\"Queries by Connection Type\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]}\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"\",\"label\":\"unknown\",\"color\":\"orange\"}]}},\"name\":\"Queries by Connection Type\"}]},\"customWidth\":\"30\",\"name\":\"group - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 25 by count_ desc\",\"size\":2,\"title\":\"Top Source IPs by DNS Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"40\",\"name\":\"Top Source IPs by DNS Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DNS Events\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DHCP Events\"},\"name\":\"text - 8 - Copy - Copy - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b71068b1-a89d-4605-8440-802f89726143\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPTypeParam\",\"label\":\"DHCP Operation\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n\\r\\n { \\\"value\\\":\\\"Create\\\"},\\r\\n { \\\"value\\\":\\\"Delete\\\"},\\r\\n { \\\"value\\\":\\\"Update\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, SourceIP, SourceHostName, SourceMACAddress, InfobloxLeaseOp, InfobloxLifetime, InfobloxLeaseUUID, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DHCP Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"DNS & DHCP Overview\"},\"name\":\"DNS Query/Response Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Filters \\r\\n---\\r\\n\\r\\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\\r\\n\\r\\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \\r\\n\\r\\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters).\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\" or InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"All Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"All Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redPurple\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Application Filter Hits\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Category Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CatFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {CatFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Category Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Application Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AppFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {AppFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Application Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}}]},\"name\":\"Overview\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Filters\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9f55f1ff-f771-485f-82a9-52a9f42251cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FilterTypeParam\",\"label\":\"Filter Type\",\"type\":2,\"isRequired\":true,\"value\":\"CAT_\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"CAT_\\\", \\\"label\\\":\\\"Category Filters\\\" },\\r\\n { \\\"value\\\":\\\"APP_\\\", \\\"label\\\":\\\"Application Filters\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":172800000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 15 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Filters by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Filter in the chart below to further drilldown the filter.\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Filter \",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"InfobloxDomainCat\",\"exportParameterName\":\"filter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Filter \",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat\\r\\n| sort by TimeGenerated desc, SourceIP desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {filter}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by SourceIP\\r\\n| top 10 by count_ desc\\r\\n\",\"size\":2,\"title\":\"Top IPs for {filter}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top IPs for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 10 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {filter} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"74\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {filter} by Time\",\"styleSettings\":{\"margin\":\"0 0 0 1%\"}}]},\"name\":\"Category Filter By Type\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Source IP\"},\"name\":\"text - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Source IP in the chart below to further drilldown the IP.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Source IP\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip_cat\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Source IP\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP\\r\\n| sort by TimeGenerated desc, InfobloxDomainCat desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\",\"size\":2,\"title\":\"Top Queries for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 10 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters for {ip_cat} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Filters for {ip_cat} by Time\"}]},\"name\":\"Category Filter by IP\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Filters\"},\"name\":\"Category Filters\"}],\"styleSettings\":{\"spacingStyle\":\"none\"},\"fromTemplateId\":\"sentinel-InfobloxCDCB1TDWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"text - 9\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":1,\"content\":{\"json\":\"# Infoblox CDC BloxOne DDI & Threat Defense Workbook\\r\\n\\r\\n##### Get a closer look at your BloxOne DNS Query/Response logs, DHCP logs and Threat Defense security event data. \\r\\n\\r\\nThis workbook is intended to help visualize BloxOne query data as part of the Infoblox Cloud Data Connector. Drilldown your data and visualize events, trends, and anomalous changes over time.\\r\\n\\r\\nSupported BloxOne Cloud Source log types:\\r\\n* Threat Defense Query/Response Log\\r\\n* Threat Defense Threat Feeds Hits Log\\r\\n* DDI Query/Response Log\\r\\n* DDI DHCP Lease Log\\r\\n\\r\\n---\\r\\n\"},\"name\":\"text - 3\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"f2ce2fdb-104a-447f-b42b-6d11931a09ff\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"DNS & DHCP Overview\",\"subTarget\":\"DNS & DHCP Overview\",\"style\":\"link\"},{\"id\":\"46b4abc5-316b-4c75-89b7-5cf134d6dbb0\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Security Overview\",\"subTarget\":\"Security Overview\",\"style\":\"link\"},{\"id\":\"81661594-3591-4fe6-a67d-b69ae55abf67\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Device\",\"subTarget\":\"Events by Device\",\"preText\":\"IPs\",\"style\":\"link\"},{\"id\":\"46ca603b-ead0-46bd-987d-1d157b2a763a\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Events by Domain\",\"subTarget\":\"Events by Domain\",\"style\":\"link\"},{\"id\":\"2e942b67-07c4-4579-ac5b-f43c5b01c51c\",\"cellValue\":\"view\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Filters\",\"subTarget\":\"Filters\",\"style\":\"link\"}]},\"name\":\"links - 16\",\"styleSettings\":{\"margin\":\"0 0 20px 0\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9878ee10-a66a-4438-afdd-29789d76bd61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":14400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"parameters - 0\"},{\"type\":1,\"content\":{\"json\":\"#### Set a time range for which to view data using the dropdown to the left. It will be applied to all visualizations of this workbook. Note that using a large range may cause queries to timeout depending on the size of your environment. Reduce the range if this keeps occurring.\\r\\n\\r\\n---\\r\\n\",\"style\":\"info\"},\"customWidth\":\"70\",\"name\":\"text - 7\",\"styleSettings\":{\"margin\":\"0 0 10px 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Device\\r\\n---\\r\\n#### Get a closer look into where threat data is originating. \\r\\nThis section visualizes which devices are producing the most hits. Further drilldown data by source IP address. \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"12793c1f-b77e-4319-99f6-b6b4230d9cfe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"19099936-395c-4ac9-a462-097e6c1fe50c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"2d6b86ef-4bd8-4afd-be72-83f7cb365585\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"8e48699a-6c2e-42b2-bcd8-15cfce54fe4d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"f57d037a-57c8-4b7b-93fd-8f6215d1c9c2\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Device in the chart below to further drilldown the device.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 17\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Hit Count by Device\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Device\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip}\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"SourceIP\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {ip} - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where '{ip}' == SourceIP \\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Feed Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where '{ip}' == SourceIP \\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Threat Class Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Class Trend for {ip}\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"group\":\"ThreatLevel\",\"createOtherGroup\":\"\",\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"N/A\",\"label\":\"N/A\",\"color\":\"turquoise\"},{\"seriesName\":\"Info\",\"label\":\"\",\"color\":\"lightBlue\"},{\"seriesName\":\"Low\",\"label\":\"\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"label\":\"\",\"color\":\"orange\"},{\"seriesName\":\"High\",\"color\":\"red\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Threat Level Trend for {ip}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"50\",\"conditionalVisibilities\":[{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"name\":\"Action Trend for {ip}\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 9\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Queries for {ip}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"60%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"20\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Queries for {ip}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {ip} by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"customWidth\":\"80\",\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Queries for {ip} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Total Events for {ip} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1PolicyAction\",\"sortOrder\":1}]},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{ip}' == SourceIP \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Events for {ip} between {brush:label} - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"ip\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Total Events for {ip} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Device\"},\"name\":\"Events by Device\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Events by Destination Domain\\r\\n---\\r\\n#### Get a closer look into what is being queried. \\r\\nThis section visualizes where users are visiting. Further drilldown data by destination query (domain). \\r\\n\\r\\nMake sure to set all Threat Defense dropdowns below back to \\\"All\\\" when switching between Log Types.\"},\"name\":\"text - 6\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9d2856d9-b23c-4779-916d-abef2e4c50e0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"LogTypeParam\",\"label\":\"Log Type\",\"type\":2,\"isRequired\":true,\"value\":\"RPZ\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"RPZ\\\", \\\"label\\\":\\\"Threat Defense Security Hits\\\" },\\r\\n { \\\"value\\\":\\\"DNS\\\", \\\"label\\\":\\\"DNS Queries & Responses\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy2 - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a5663eb6-1030-421e-a60a-6af9f4af3f99\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"5cbd5c34-3703-4835-aa3b-228504310c1c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"3c67b4c6-8cf3-4c75-87ea-4bca83dee296\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"730927d0-a8ce-461d-b20b-fe9cda17c486\"}],\"style\":\"pills\",\"doNotRunWhenHidden\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where isnotempty(DestinationDnsDomain)\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 15 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Queries by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Query in the chart below to further drilldown the query.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Hit Count by Query/Domain\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"DestinationDnsDomain\",\"exportParameterName\":\"domain\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Query/Domain\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"}],\"showPin\":false,\"name\":\"Events for {domain}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibilities\":[{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"}],\"showPin\":false,\"name\":\"Events for {domain} - Copy\"},{\"type\":1,\"content\":{\"json\":\"#### The time graph below utilizes Time Brushing. Click and drag between two points of the graph to view events for only that window of time. By not selecting any window you can also view all events for the TimeRange selected at the top of this workbook. \\r\\n\\r\\n---\",\"style\":\"info\"},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count() by SourceIP, DeviceName, SourceMACAddress, InfobloxB1SrcOSVersion\\r\\n| sort by count_ desc\",\"size\":2,\"title\":\"Devices Querying {domain}\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Devices Querying {domain}\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\nlet timeframe = 1h;\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where isnotempty(SourceIP)\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange}\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\\r\\n\",\"size\":2,\"title\":\"Top Devices Querying {domain} by Time\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"timeBrushParameterName\":\"brush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Top Devices Querying {domain} by Time\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Events for {domain} between {brush:label}\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs '{LogTypeParam}'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| summarize count()\",\"size\":3,\"title\":\"Events Count\",\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"name\":\"Events Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where DeviceEventClassID has_cs 'RPZ'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"RPZ\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and TimeGenerated {brush} \\r\\n| where DeviceEventClassID has_cs 'DNS'\\r\\n| where '{domain}' == DestinationDnsDomain \\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"50\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"conditionalVisibility\":{\"parameterName\":\"LogTypeParam\",\"comparison\":\"isEqualTo\",\"value\":\"DNS\"},\"showPin\":false,\"name\":\"Domain RPZ Events - grid - Copy\"}]},\"conditionalVisibility\":{\"parameterName\":\"domain\",\"comparison\":\"isNotEqualTo\"},\"name\":\"Events for {domain} between {brush:label}\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Events by Domain\"},\"name\":\"Events by Domain\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne Threat Defense Security Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne Threat Defense security data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"5b2e1804-a9a6-4b86-8a6e-27fd0ab029b5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatLevelParam\",\"label\":\"Threat Level\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"N/A\\\"},\\r\\n { \\\"value\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"Low\\\"},\\r\\n { \\\"value\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"High\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\"},{\"id\":\"1bc7a1f9-d3bd-4e0f-b5ae-4dc8ba8a1463\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FeedParam\",\"label\":\"Feed\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| where isnotempty(InfobloxB1FeedName)\\r\\n| summarize by InfobloxB1FeedName\\r\\n| order by InfobloxB1FeedName asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"1eedd218-57c0-43e3-a306-a716380b05e6\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ThreatClassParam\",\"label\":\"Threat Class\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"\\\"\",\"delimiter\":\",\",\"query\":\"InfobloxCDC\\r\\n| summarize by ThreatClass\\r\\n| order by ThreatClass asc\\r\\n| project value = ThreatClass, label = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"ActionParam\",\"label\":\"Action\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"NXDOMAIN\\\", \\\"label\\\": \\\"Block\\\"},\\r\\n { \\\"value\\\":\\\"REDIRECT\\\", \\\"label\\\": \\\"Redirect\\\"},\\r\\n { \\\"value\\\":\\\"PASSTHRU\\\", \\\"label\\\": \\\"Log\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":259200000},\"timeContextFromParameter\":\"TimeRange\",\"defaultValue\":\"value::all\",\"id\":\"e36bc3c2-b85e-478c-968b-7faf79c21c49\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Impacted B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Impacted B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Threat Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Indicators\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize dcount(ThreatClass)\",\"size\":3,\"title\":\"Unique Threat Classes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_ThreatClass\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Threat Classes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n//| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Security Hits (All Actions)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Security Hits (All Actions)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Allowed + Logged Hits (PASSTHRU)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Allowed + Logged Hits (PASSTHRU)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Block\\\" or SimplifiedDeviceAction == \\\"NXDOMAIN\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Blocked Hits (NXDOMAIN)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Blocked Hits (NXDOMAIN)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Redirect\\\" or SimplifiedDeviceAction == \\\"REDIRECT\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Redirects (REDIRECT)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"red\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Redirects (REDIRECT)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1PolicyAction == \\\"Log\\\" or SimplifiedDeviceAction == \\\"PASSTHRU\\\"\\r\\n| where ThreatLevel == \\\"High\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total High Threat Level Hits Not Blocked\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":0,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total High Threat Level Hits Not Blocked\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName !has_cs \\\"CAT_\\\" and InfobloxRPZ !has_cs \\\"CAT_\\\" and InfobloxB1FeedName !has_cs \\\"APP_\\\" and InfobloxRPZ !has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Non-Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"coldHot\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Non-Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"yellow\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Application Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Hits via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Hits via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain}\",\"size\":3,\"title\":\"Security Hits over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"areachart\"},\"customWidth\":\"60\",\"name\":\"Security Hits over Time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 50 by count_ desc\",\"size\":2,\"title\":\"Top Indicators\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false},\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"65\",\"name\":\"Top Indicators\",\"styleSettings\":{\"margin\":\"0px 10px 0px 0px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 20 by count_ desc\",\"size\":3,\"title\":\"Top Impacted IPs\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"35\",\"name\":\"Top Impacted IPs\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Threat Level\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"datatable (Count:long, ThreatLevel:string, ThreatLevel_count:long) [0,\\\"N/A\\\",1, 0,\\\"Info\\\",2, 0,\\\"Low\\\",3, 0,\\\"Medium\\\",4, 0,\\\"High\\\",5]\\r\\n|union\\r\\n(\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatLevel_count = case(ThreatLevel == \\\"High\\\", 5, ThreatLevel==\\\"Medium\\\", 4, ThreatLevel==\\\"Low\\\", 3, ThreatLevel==\\\"Info\\\", 2, 1)\\r\\n| summarize Count = count() by ThreatLevel, ThreatLevel_count\\r\\n)\\r\\n| summarize Count=sum(Count) by ThreatLevel, ThreatLevel_count\\r\\n| sort by ThreatLevel_count asc\",\"size\":0,\"title\":\"Hit Count by Threat Level\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"graph\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowOrangeRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false,\"sortCriteriaField\":\"status_count\",\"sortOrderField\":1,\"size\":\"auto\"},\"graphSettings\":{\"type\":2,\"topContent\":{\"columnMatch\":\"ThreatLevel\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"Count\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"useGrouping\":false,\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"nodeIdField\":\"Count\",\"graphOrientation\":3,\"showOrientationToggles\":false,\"staticNodeSize\":100,\"colorSettings\":{\"nodeColorField\":\"ThreatLevel\",\"type\":3,\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\"},{\"operator\":\"Default\",\"representation\":\"gray\"}]},\"hivesMargin\":5}},\"customWidth\":\"30\",\"name\":\"Hit Count by Threat Level\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatLevel\",\"size\":0,\"title\":\"Threat Level Trend\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"N/A\",\"color\":\"gray\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Info\",\"color\":\"lightBlue\"}]}},\"customWidth\":\"70\",\"name\":\"Threat Level Trend\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Feed\"},\"name\":\"text - 8 - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n\\r\\n//| summarize c = count() by InfobloxB1FeedName\\r\\n//| summarize c = sum(c) by InfobloxB1FeedName = tolower(InfobloxB1FeedName)\\r\\n\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| order by count_ desc\",\"size\":0,\"title\":\"Hit Count by Feed\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Feed\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| summarize count() by InfobloxB1FeedName\\r\\n| top 10 by count_ \\r\\n| project InfobloxB1FeedName);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend InfobloxB1FeedName = case(InfobloxB1FeedName == \\\"\\\", InfobloxRPZ, InfobloxB1FeedName)\\r\\n| where InfobloxB1FeedName in ((Top))\\r\\n| project TimeGenerated, InfobloxB1FeedName\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxB1FeedName\",\"size\":0,\"title\":\"Feed Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"0\",\"label\":\"N/A\",\"color\":\"green\"},{\"seriesName\":\"1\",\"label\":\"Low/Info\",\"color\":\"blue\"},{\"seriesName\":\"8\",\"label\":\"High\",\"color\":\"red\"},{\"seriesName\":\"5\",\"label\":\"Medium\",\"color\":\"orange\"}]}},\"customWidth\":\"70\",\"name\":\"Feed Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Class\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| order by count_ desc\\r\\n\\r\\n\\r\\n\",\"size\":0,\"title\":\"Hit Count by Class\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Class\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| summarize count() by ThreatClass\\r\\n| top 10 by count_ \\r\\n| project ThreatClass);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| extend ThreatClass = case(ThreatClass == \\\"\\\", \\\"N/A\\\", ThreatClass)\\r\\n| where ThreatClass in ((Top))\\r\\n| project TimeGenerated, ThreatClass\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by ThreatClass\",\"size\":0,\"title\":\"Class Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"70\",\"name\":\"Class Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Action\"},\"name\":\"text - 8 - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| summarize count() by SimplifiedDeviceAction\\r\\n| top 10 by count_ desc\",\"size\":0,\"title\":\"Hit Count By Action\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"30\",\"name\":\"Hit Count By Action\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SimplifiedDeviceAction\",\"size\":0,\"title\":\"Action Trend\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"REDIRECT\",\"label\":\"Redirect\",\"color\":\"orange\"},{\"seriesName\":\"NXDOMAIN\",\"label\":\"Block\",\"color\":\"redBright\"},{\"seriesName\":\"PASSTHRU\",\"label\":\"Log\",\"color\":\"green\"},{\"seriesName\":\"\",\"label\":\"Unknown\",\"color\":\"turquoise\"}]}},\"customWidth\":\"70\",\"name\":\"Action Trend\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"RPZ\\\"\\r\\n| where ThreatClass in ({ThreatClassParam}) or '{ThreatClassParam:label}' == \\\"All\\\"\\r\\n| where InfobloxB1FeedName in~ ({FeedParam}) or InfobloxRPZ in~ ({FeedParam}) or'{FeedParam:label}' == \\\"All\\\"\\r\\n| where ThreatLevel in ({ThreatLevelParam}) or '{ThreatLevelParam:label}' == \\\"All\\\"\\r\\n| where SimplifiedDeviceAction in ({ActionParam}) or InfobloxB1PolicyAction has_cs \\\"{ActionParam:label}\\\" or '{ActionParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, ThreatLevel, ThreatLevel_Score, ThreatConfidence, DestinationDnsDomain, InfobloxB1FeedName, ThreatClass, ThreatProperty, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1FeedName\",\"sortOrder\":1}]},\"showPin\":false,\"name\":\"RPZ Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Security Overview\"},\"name\":\"Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## BloxOne DNS Query/Response & DHCP Leases Overview\\r\\n---\\r\\n#### Top level insight into your BloxOne DNS Query/Response and DHCP Lease data.\\r\\n\\r\\n\"},\"name\":\"text - 8\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique Devices\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Devices\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Unique B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize dcount(DestinationDnsDomain)\",\"size\":3,\"title\":\"Unique Queries (Domains)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_DestinationDnsDomain\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Unique Queries (Domains)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"remote_client\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via B1 Endpoints\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orangeRed\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via B1 Endpoints\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"nios\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via NIOS\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"blue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via NIOS\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| where InfobloxB1ConnectionType == \\\"dfp\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Total Queries via DFP\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Total Queries via DFP\"}]},\"customWidth\":\"40\",\"name\":\"Totals\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDNSRCode\",\"size\":0,\"title\":\"DNS Queries over Time\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DNS Queries over Time - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"New DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"orangeBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-CREATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"New DHCP Leases (Unique IPs)\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"pink\"}},\"showBorder\":false,\"size\":\"full\"}},\"customWidth\":\"33\",\"name\":\"New DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Updated DHCP Leases \",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"greenDark\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases \"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-UPDATE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Updated DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"magenta\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Updated DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Released DHCP Leases\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID == \\\"DHCP-LEASE-DELETE\\\"\\r\\n| summarize dcount(SourceIP)\",\"size\":3,\"title\":\"Released DHCP Leases (Unique IPs)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"dcount_SourceIP\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"green\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Released DHCP Leases (Unique IPs)\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| summarize avg(toint(column_ifexists(\\\"InfobloxLifetime\\\", \\\"\\\")))\",\"size\":3,\"title\":\"Average Lease Lifespan (seconds)\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"rowLimit\":200,\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"InfobloxThreatLevel\",\"sortOrder\":1}],\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"avg_InfobloxLifetime\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redBright\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Average Lease Lifespan (seconds)\"}]},\"customWidth\":\"40\",\"name\":\"Totals - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| make-series Hits = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxLeaseOp\",\"size\":0,\"title\":\"DHCP Leases over Time\",\"color\":\"magenta\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"DHCP Leases over Time\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DNS Events\"},\"name\":\"text - 8 - Copy - Copy - Copy\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by DestinationDnsDomain\\r\\n| order by count_ desc\",\"size\":2,\"title\":\"Top Requested Domains\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Top Requested Domains\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxDNSRCode\",\"size\":3,\"title\":\"Response Codes\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Response Codes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by InfobloxB1ConnectionType\",\"size\":3,\"title\":\"Queries by Connection Type\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"InfobloxB1FeedName\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"50%\"}},{\"columnMatch\":\"Feed\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"\",\"label\":\"unknown\",\"color\":\"orange\"}]}},\"name\":\"Queries by Connection Type\"}]},\"customWidth\":\"30\",\"name\":\"group - 14\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| summarize count() by SourceIP\\r\\n| top 25 by count_ desc\",\"size\":2,\"title\":\"Top Source IPs by DNS Queries\",\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0}},\"customWidth\":\"40\",\"name\":\"Top Source IPs by DNS Queries\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DNS\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, Activity, DestinationDnsDomain, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, InfobloxDNSQClass, InfobloxDNSQType, InfobloxDNSRCode, Protocol, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxDNSQType\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DNS Events\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## DHCP Events\"},\"name\":\"text - 8 - Copy - Copy - Copy - Copy\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b71068b1-a89d-4605-8440-802f89726143\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"DHCPTypeParam\",\"label\":\"DHCP Operation\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"value\":[\"value::all\"],\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"All\",\"showDefault\":false},\"jsonData\":\"[\\r\\n\\r\\n { \\\"value\\\":\\\"Create\\\"},\\r\\n { \\\"value\\\":\\\"Delete\\\"},\\r\\n { \\\"value\\\":\\\"Update\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 23\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} and DeviceEventClassID has_cs \\\"DHCP\\\"\\r\\n| where InfobloxLeaseOp in ({DHCPTypeParam}) or '{DHCPTypeParam:label}' == \\\"All\\\"\\r\\n| sort by TimeGenerated desc\\r\\n| project TimeGenerated, DeviceEventClassID, SourceIP, SourceHostName, SourceMACAddress, InfobloxLeaseOp, InfobloxLifetime, InfobloxLeaseUUID, AdditionalExtensionsParsedNested\\r\\n\",\"size\":2,\"showAnalytics\":true,\"timeContext\":{\"durationMs\":43200000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"ThreatLevel\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"N/A\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"ThreatLevel_Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"is Empty\",\"representation\":\"gray\",\"text\":\"N/A\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"30\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"1\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}],\"compositeBarSettings\":{\"labelText\":\"[\\\"ThreatLevel\\\"]\",\"columnSettings\":[{\"columnName\":\"ThreatLevel\",\"color\":\"orange\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"blue\"}]}}},{\"columnMatch\":\"ThreatConfidence\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"purpleBlueGreen\",\"compositeBarSettings\":{\"labelText\":\"\"}}},{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":5000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"DeviceEventClassID\",\"sortOrder\":2}]},\"showPin\":false,\"name\":\"DHCP Events\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"DNS & DHCP Overview\"},\"name\":\"DNS Query/Response Overview\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Filters \\r\\n---\\r\\n\\r\\nCategory filters are a set of content categorization rules that BloxOne Threat Defense Cloud uses to detect and filter specific internet content. Based on your configuration, specific actions such as Allow or Block will be taken on the detected content.\\r\\n\\r\\nApplication filters are a set of rules that BloxOne Threat Defense Cloud uses to detect and filter specific Internet content. The Application Classification Service (ACS) provides accessibility to applications based on their category or subcategory. Using application filters, you can set security policies based on whether you want to allow an app to access the Internet at all times, or if you want the app to use local resolution when used with BloxOne DDI appliances. \\r\\n\\r\\nSee more about filters on the official [Infoblox Documentation Portal](https://docs.infoblox.com/display/BloxOneThreatDefense/Filters).\"},\"name\":\"text - 2\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\" or InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"All Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"orange\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"All Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Category Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"yellowGreenBlue\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Category Filter Hits\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count()\",\"size\":3,\"title\":\"Application Filter Hits\",\"color\":\"orange\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"min\":-1,\"palette\":\"redPurple\"}},\"showBorder\":false}},\"customWidth\":\"33\",\"name\":\"Application Filter Hits\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Category Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CatFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"CAT_\\\" or InfobloxRPZ has_cs \\\"CAT_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {CatFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Category Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Top Application Filter Hits\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"be7263d9-229e-4875-a60a-76114659b718\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"AppFilterSorter\",\"label\":\"Sort Tiles By\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"count_ desc\\\", \\\"label\\\":\\\"Hit Count\\\", \\\"selected\\\":true },\\r\\n { \\\"value\\\":\\\"DestinationDnsDomain asc, count_ desc\\\", \\\"label\\\":\\\"Domain Name\\\" },\\r\\n { \\\"value\\\":\\\"InfobloxDomainCat asc, count_ desc\\\", \\\"label\\\":\\\"Filter Type\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Top Category Filters RPZ Hits\",\"styleSettings\":{\"margin\":\"0px 0px 0px 10px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs \\\"APP_\\\" or InfobloxRPZ has_cs \\\"APP_\\\"\\r\\n| summarize count() by DestinationDnsDomain, InfobloxDomainCat\\r\\n| sort by {AppFilterSorter}\\r\\n| take 50\\r\\n\",\"size\":3,\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"gridSettings\":{\"filter\":true},\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"subtitleContent\":{\"columnMatch\":\"InfobloxDomainCat\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"rowLimit\":50,\"sortOrderField\":1},\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"count_\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"name\":\"Tops\",\"styleSettings\":{\"margin\":\"-20px 0px 0px 0px\"}}]},\"name\":\"Top Application Filter Hits\",\"styleSettings\":{\"margin\":\"10px\"}}]},\"name\":\"Overview\",\"styleSettings\":{\"margin\":\"0px\"}},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Filters\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9f55f1ff-f771-485f-82a9-52a9f42251cc\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"FilterTypeParam\",\"label\":\"Filter Type\",\"type\":2,\"isRequired\":true,\"value\":\"CAT_\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"CAT_\\\", \\\"label\\\":\\\"Category Filters\\\" },\\r\\n { \\\"value\\\":\\\"APP_\\\", \\\"label\\\":\\\"Application Filters\\\" }\\r\\n]\",\"timeContext\":{\"durationMs\":172800000},\"timeContextFromParameter\":\"TimeRange\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6 - Copy - Copy - Copy - Copy - Copy - Copy\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 15 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":15,\"showLegend\":true}},\"name\":\"Top Filters by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Filter in the chart below to further drilldown the filter.\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by InfobloxDomainCat\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Filter \",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"InfobloxDomainCat\",\"exportParameterName\":\"filter\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Filter \",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat\\r\\n| sort by TimeGenerated desc, SourceIP desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Events for {filter}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"InfobloxB1SrcOSVersion\",\"sortOrder\":2}]},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by SourceIP\\r\\n| top 10 by count_ desc\\r\\n\",\"size\":2,\"title\":\"Top IPs for {filter}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top IPs for {filter}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| summarize count() by DestinationDnsDomain\\r\\n| top 10 by count_ \\r\\n| project DestinationDnsDomain);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{filter}' == InfobloxDomainCat \\r\\n| where DestinationDnsDomain in ((Top))\\r\\n| project TimeGenerated, DestinationDnsDomain\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by DestinationDnsDomain\\r\\n\",\"size\":2,\"title\":\"Top Queries for {filter} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"74\",\"conditionalVisibility\":{\"parameterName\":\"filter\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {filter} by Time\",\"styleSettings\":{\"margin\":\"0 0 0 1%\"}}]},\"name\":\"Category Filter By Type\"},{\"type\":1,\"content\":{\"json\":\"---\\r\\n## By Source IP\"},\"name\":\"text - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| top 15 by count_ \\r\\n| project SourceIP);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where SourceIP in ((Top))\\r\\n| project TimeGenerated, SourceIP\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by SourceIP\",\"size\":2,\"title\":\"Top Source IPs by Time\",\"color\":\"red\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"name\":\"Top Source IPs by Time\"},{\"type\":1,\"content\":{\"json\":\"#### Click on a Source IP in the chart below to further drilldown the IP.\\r\\n\\r\\n---\",\"style\":\"info\"},\"name\":\"text - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| summarize count() by SourceIP\\r\\n| sort by count_ desc\",\"size\":0,\"title\":\"Hit Count by Source IP\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"exportFieldName\":\"SourceIP\",\"exportParameterName\":\"ip_cat\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"SourceIP\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"60%\"}},{\"columnMatch\":\"count_\",\"formatter\":3,\"formatOptions\":{\"palette\":\"greenRed\",\"compositeBarSettings\":{\"labelText\":\"\"},\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"CategoryFilter\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"50%\"}}],\"filter\":true,\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Hits\"}]},\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"DestinationDnsDomain\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}}},\"customWidth\":\"30\",\"name\":\"Hit Count by Source IP\",\"styleSettings\":{\"margin\":\"0 10px 0 0\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP\\r\\n| sort by TimeGenerated desc, InfobloxDomainCat desc\\r\\n| project TimeGenerated, DestinationDnsDomain, InfobloxDomainCat, InfobloxB1PolicyAction, DeviceAction, InfobloxB1PolicyName, SourceIP, DeviceName, SourceMACAddress, SourceUserName, InfobloxB1SrcOSVersion, InfobloxB1ConnectionType, InfobloxB1Network, AdditionalExtensionsParsedNested\\r\\n\\r\\n\",\"size\":2,\"showAnalytics\":true,\"title\":\"Events for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"N/A\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Message\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"40%\"}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true}},\"customWidth\":\"70\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Events for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by DestinationDnsDomain\",\"size\":2,\"title\":\"Top Queries for {ip_cat}\",\"timeContext\":{\"durationMs\":14400000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":10}},\"customWidth\":\"25\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Queries for {ip_cat}\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let starttime = {TimeRange:start};\\r\\nlet endtime = {TimeRange:end};\\r\\n// Finding Tops \\r\\nlet Top = materialize(InfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| summarize count() by InfobloxDomainCat\\r\\n| top 10 by count_ \\r\\n| project InfobloxDomainCat);\\r\\n// Filtering datasource to Tops and Plot Time chart\\r\\nInfobloxCDC\\r\\n| where TimeGenerated {TimeRange} \\r\\n| where DeviceEventClassID has_cs \\\"RPZ\\\" \\r\\n| where InfobloxB1FeedName has_cs '{FilterTypeParam}' or InfobloxRPZ has_cs '{FilterTypeParam}'\\r\\n| where '{ip_cat}' == SourceIP \\r\\n| where InfobloxDomainCat in ((Top))\\r\\n| project TimeGenerated, InfobloxDomainCat\\r\\n| make-series Total= count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by InfobloxDomainCat\",\"size\":2,\"title\":\"Top Filters for {ip_cat} by Time\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"LogSeverity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"0\",\"representation\":\"green\",\"text\":\"N/A\"},{\"operator\":\"==\",\"thresholdValue\":\"1\",\"representation\":\"blue\",\"text\":\"Low/Info\"},{\"operator\":\"==\",\"thresholdValue\":\"5\",\"representation\":\"orange\",\"text\":\"Medium\"},{\"operator\":\"==\",\"thresholdValue\":\"8\",\"representation\":\"red\",\"text\":\"High\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}],\"compositeBarSettings\":{\"labelText\":\"\",\"columnSettings\":[{\"columnName\":\"LogSeverity\",\"color\":\"blue\"},{\"columnName\":\"DestinationDnsDomain\",\"color\":\"purple\"}]}}},{\"columnMatch\":\"Count\",\"formatter\":4,\"formatOptions\":{\"min\":0,\"palette\":\"blue\"}}],\"rowLimit\":500,\"filter\":true,\"labelSettings\":[{\"columnId\":\"LogSeverity\",\"label\":\"Threat Level\"}]},\"chartSettings\":{\"createOtherGroup\":0,\"showLegend\":true}},\"customWidth\":\"75\",\"conditionalVisibility\":{\"parameterName\":\"ip_cat\",\"comparison\":\"isNotEqualTo\"},\"showPin\":false,\"name\":\"Top Filters for {ip_cat} by Time\"}]},\"name\":\"Category Filter by IP\"}]},\"conditionalVisibility\":{\"parameterName\":\"view\",\"comparison\":\"isEqualTo\",\"value\":\"Filters\"},\"name\":\"Category Filters\"}],\"styleSettings\":{\"spacingStyle\":\"none\"},\"fromTemplateId\":\"sentinel-InfobloxCDCB1TDWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -320,7 +320,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "description": "Data exfiltration attack detected by Infoblox Threat Insight. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).", "displayName": "Infoblox - Data Exfiltration Attack", "enabled": false, "query": "let threshold = 1;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where InfobloxB1FeedName == \"Threat Insight - Data Exfiltration\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=innerunique (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where InfobloxB1FeedName == \"Threat Insight - Data Exfiltration\"\n ) on SourceIP\n", @@ -334,10 +334,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "InfobloxCloudDataConnector", "dataTypes": [ "CommonSecurityLog (InfobloxCDC)" - ] + ], + "connectorId": "InfobloxCloudDataConnector" } ], "tactics": [ @@ -349,43 +349,43 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" }, { - "columnName": "InfobloxB1SrcOSVersion", - "identifier": "OSVersion" + "identifier": "OSVersion", + "columnName": "InfobloxB1SrcOSVersion" }, { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" } - ] + ], + "entityType": "Host" }, { - "entityType": "Malware", "fieldMappings": [ { - "columnName": "InfobloxB1FeedName", - "identifier": "Name" + "identifier": "Name", + "columnName": "InfobloxB1FeedName" }, { - "columnName": "InfobloxB1FeedName", - "identifier": "Category" + "identifier": "Category", + "columnName": "InfobloxB1FeedName" } - ] + ], + "entityType": "Malware" } ], "eventGroupingSettings": { @@ -393,19 +393,19 @@ }, "customDetails": { "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1PolicyName": "InfobloxB1PolicyName", "InfobloxB1FeedName": "InfobloxB1FeedName", "InfobloxB1Action": "InfobloxB1PolicyAction", - "InfobloxB1PolicyName": "InfobloxB1PolicyName", "SourceMACAddress": "SourceMACAddress" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { "reopenClosedIncident": true, "matchingMethod": "AllEntities", - "lookbackDuration": "7d", - "enabled": true - }, - "createIncident": true + "enabled": true, + "lookbackDuration": "7d" + } } } }, @@ -487,10 +487,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "InfobloxCloudDataConnector", "dataTypes": [ "CommonSecurityLog (InfobloxCDC)" - ] + ], + "connectorId": "InfobloxCloudDataConnector" } ], "tactics": [ @@ -502,52 +502,52 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" }, { - "columnName": "InfobloxB1SrcOSVersion", - "identifier": "OSVersion" + "identifier": "OSVersion", + "columnName": "InfobloxB1SrcOSVersion" }, { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" } - ] + ], + "entityType": "Host" }, { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "DestinationDnsDomain", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "DestinationDnsDomain" } - ] + ], + "entityType": "DNS" }, { - "entityType": "Malware", "fieldMappings": [ { - "columnName": "ThreatProperty", - "identifier": "Name" + "identifier": "Name", + "columnName": "ThreatProperty" }, { - "columnName": "ThreatClass", - "identifier": "Category" + "identifier": "Category", + "columnName": "ThreatClass" } - ] + ], + "entityType": "Malware" } ], "eventGroupingSettings": { @@ -555,9 +555,9 @@ }, "customDetails": { "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1PolicyName": "InfobloxB1PolicyName", "InfobloxB1FeedName": "InfobloxB1FeedName", "InfobloxB1Action": "InfobloxB1PolicyAction", - "InfobloxB1PolicyName": "InfobloxB1PolicyName", "SourceMACAddress": "SourceMACAddress" }, "incidentConfiguration": { @@ -629,7 +629,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "description": "At least 200 high threat level queries generated by single host in 1 hour. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).", "displayName": "Infoblox - Many High Threat Level Queries From Single Host Detected", "enabled": false, "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID has_cs \"RPZ\"\n| where ThreatLevel_Score >= 80\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID has_cs \"RPZ\"\n | where ThreatLevel_Score >= 80\n ) on SourceIP\n", @@ -643,10 +643,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "InfobloxCloudDataConnector", "dataTypes": [ "CommonSecurityLog (InfobloxCDC)" - ] + ], + "connectorId": "InfobloxCloudDataConnector" } ], "tactics": [ @@ -658,30 +658,30 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" }, { - "columnName": "InfobloxB1SrcOSVersion", - "identifier": "OSVersion" + "identifier": "OSVersion", + "columnName": "InfobloxB1SrcOSVersion" }, { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -773,10 +773,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "InfobloxCloudDataConnector", "dataTypes": [ "CommonSecurityLog (InfobloxCDC)" - ] + ], + "connectorId": "InfobloxCloudDataConnector" } ], "tactics": [ @@ -788,26 +788,26 @@ ], "entityMappings": [ { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "DestinationDnsDomain", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "DestinationDnsDomain" } - ] + ], + "entityType": "DNS" }, { - "entityType": "Malware", "fieldMappings": [ { - "columnName": "ThreatProperty", - "identifier": "Name" + "identifier": "Name", + "columnName": "ThreatProperty" }, { - "columnName": "ThreatClass", - "identifier": "Category" + "identifier": "Category", + "columnName": "ThreatClass" } - ] + ], + "entityType": "Malware" } ], "eventGroupingSettings": { @@ -815,8 +815,8 @@ }, "customDetails": { "InfobloxB1Network": "InfobloxB1Network", - "InfobloxB1FeedName": "InfobloxB1FeedName", - "InfobloxB1PolicyName": "InfobloxB1PolicyName" + "InfobloxB1PolicyName": "InfobloxB1PolicyName", + "InfobloxB1FeedName": "InfobloxB1FeedName" }, "incidentConfiguration": { "createIncident": true @@ -887,7 +887,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/Infoblox%20Cloud%20Data%20Connector/Parsers/InfobloxCDC.txt).", + "description": "Detected at least 200 DNS responses for non-existent domains in 1 hour generated by single host. Queries do not need to be the same. Customize query count, scheduling, responses and more. This rule depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser).", "displayName": "Infoblox - Many NXDOMAIN DNS Responses Detected", "enabled": false, "query": "let threshold = 200;\nInfobloxCDC\n| where DeviceEventClassID == \"DNS Response\"\n| where InfobloxDNSRCode == \"NXDOMAIN\"\n| summarize count() by SourceIP\n| where count_ > threshold\n| join kind=inner (InfobloxCDC\n | where DeviceEventClassID == \"DNS Response\"\n | where InfobloxDNSRCode == \"NXDOMAIN\"\n ) on SourceIP\n", @@ -901,10 +901,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "InfobloxCloudDataConnector", "dataTypes": [ "CommonSecurityLog (InfobloxCDC)" - ] + ], + "connectorId": "InfobloxCloudDataConnector" } ], "tactics": [ @@ -916,30 +916,30 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" }, { - "columnName": "InfobloxB1SrcOSVersion", - "identifier": "OSVersion" + "identifier": "OSVersion", + "columnName": "InfobloxB1SrcOSVersion" }, { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { @@ -1031,16 +1031,16 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "CEF", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CEF" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" } ], "tactics": [ @@ -1052,35 +1052,35 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" }, { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" } - ] + ], + "entityType": "Host" }, { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "DestinationDnsDomain", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "DestinationDnsDomain" } - ] + ], + "entityType": "DNS" } ], "eventGroupingSettings": { @@ -1172,16 +1172,16 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "InfobloxCloudDataConnector", "dataTypes": [ "CommonSecurityLog (InfobloxCDC)" - ] + ], + "connectorId": "InfobloxCloudDataConnector" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" } ], "tactics": [ @@ -1193,52 +1193,52 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" }, { - "columnName": "InfobloxB1SrcOSVersion", - "identifier": "OSVersion" + "identifier": "OSVersion", + "columnName": "InfobloxB1SrcOSVersion" }, { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" } - ] + ], + "entityType": "Host" }, { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "DestinationDnsDomain", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "DestinationDnsDomain" } - ] + ], + "entityType": "DNS" }, { - "entityType": "Malware", "fieldMappings": [ { - "columnName": "ThreatProperty", - "identifier": "Name" + "identifier": "Name", + "columnName": "ThreatProperty" }, { - "columnName": "ThreatClass", - "identifier": "Category" + "identifier": "Category", + "columnName": "ThreatClass" } - ] + ], + "entityType": "Malware" } ], "eventGroupingSettings": { @@ -1246,9 +1246,9 @@ }, "customDetails": { "InfobloxB1Network": "InfobloxB1Network", + "InfobloxB1PolicyName": "InfobloxB1PolicyName", "InfobloxB1FeedName": "InfobloxB1FeedName", "InfobloxB1Action": "InfobloxB1PolicyAction", - "InfobloxB1PolicyName": "InfobloxB1PolicyName", "SourceMACAddress": "SourceMACAddress" }, "incidentConfiguration": { @@ -1334,16 +1334,16 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" } ], "tactics": [ @@ -1355,40 +1355,40 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "HostIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "HostIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "Computer" } - ] + ], + "entityType": "Host" }, { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "Url", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "Url" } - ] + ], + "entityType": "DNS" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ], "eventGroupingSettings": { @@ -1553,7 +1553,7 @@ "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." }, { - "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -1774,7 +1774,7 @@ "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." }, { - "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -1857,15 +1857,15 @@ "properties": { "eTag": "*", "displayName": "Infoblox Cloud Data Connector Data Parser", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "InfobloxCDC", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\r\n| extend AEcopy = AdditionalExtensions\r\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\r\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\r\n| mv-apply AEcopy on (\r\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\r\n)\r\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\r\n| evaluate bag_unpack(AdditionalExtensionsParsed)\r\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\r\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\r\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\r\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\r\n ThreatLevel_Score == 0,\"Info\",\r\n \"N/A\" )\r\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\r\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\r\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\r\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\r\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\r\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\r\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\r\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\r\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\r\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\r\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\r\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\r\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\r\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\r\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\r\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\r\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\n| extend AEcopy = AdditionalExtensions\n//Remove DHCP Option codes at end of DHCP logs to prevent invalid chars in fieldnames, causing errors. If you require these advanced fields, remove the following line.\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\n| mv-apply AEcopy on (\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\n)\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\n| evaluate bag_unpack(AdditionalExtensionsParsed)\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\n ThreatLevel_Score == 0,\"Info\",\n \"N/A\" )\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\n", "functionParameters": "", - "version": 1, + "version": 2, "tags": [ { "name": "description", - "value": "Infoblox Cloud Data Connector Data Parser" + "value": "" } ] } @@ -1921,15 +1921,15 @@ "properties": { "eTag": "*", "displayName": "Infoblox Cloud Data Connector Data Parser", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "InfobloxCDC", - "query": "\nCommonSecurityLog\r\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\r\n| extend AEcopy = AdditionalExtensions\r\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\r\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\r\n| mv-apply AEcopy on (\r\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\r\n)\r\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\r\n| evaluate bag_unpack(AdditionalExtensionsParsed)\r\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\r\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\r\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\r\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\r\n ThreatLevel_Score == 0,\"Info\",\r\n \"N/A\" )\r\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\r\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\r\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\r\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\r\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\r\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\r\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\r\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\r\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\r\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\r\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\r\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\r\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\r\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\r\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\r\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\r\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\r\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\r\n", + "query": "CommonSecurityLog\n| where DeviceVendor == \"Infoblox\" and DeviceProduct == \"Data Connector\"\n| extend AEcopy = AdditionalExtensions\n//Remove DHCP Option codes at end of DHCP logs to prevent invalid chars in fieldnames, causing errors. If you require these advanced fields, remove the following line.\n| extend AEcopy = trim_end(\"InfobloxDHCPOptions=;(.*?)\",AEcopy)\n| extend AEcopy = extract_all(@\"(?P[^=;]+)=(?P[^=;]+)\", dynamic([\"key\",\"value\"]), AEcopy)\n| mv-apply AEcopy on (\n summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1]))\n)\n| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested\n| evaluate bag_unpack(AdditionalExtensionsParsed)\n| extend ThreatLevel_Score = toint(column_ifexists(\"InfobloxThreatLevel\", \"\"))\n| extend ThreatLevel = case(ThreatLevel_Score>=80, \"High\",\n ThreatLevel_Score>=30 and ThreatLevel_Score<80, \"Medium\",\n ThreatLevel_Score<30 and ThreatLevel_Score>=1, \"Low\",\n ThreatLevel_Score == 0,\"Info\",\n \"N/A\" )\n| extend ThreatClass = extract(\"(.*?)_\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\n| extend ThreatProperty = extract(\"([^_]*$)\", 1, tostring(column_ifexists(\"InfobloxThreatProperty\", \"\")))\n| extend InfobloxB1FeedName = column_ifexists(\"InfobloxB1FeedName\", \"\")\n| extend InfobloxRPZ = column_ifexists(\"InfobloxRPZ\", \"\")\n| extend InfobloxB1PolicyAction = column_ifexists(\"InfobloxB1PolicyAction\", \"\")\n| extend InfobloxB1PolicyName = column_ifexists(\"InfobloxB1PolicyName\", \"\")\n| extend InfobloxDomainCat = column_ifexists(\"InfobloxDomainCat\", \"\")\n| extend InfobloxB1ConnectionType = column_ifexists(\"InfobloxB1ConnectionType\", \"\")\n| extend InfobloxB1SrcOSVersion = column_ifexists(\"InfobloxB1SrcOSVersion\", \"\")\n| extend InfobloxB1Network = column_ifexists(\"InfobloxB1Network\", \"\")\n| extend DeviceName = column_ifexists(\"DeviceName\", \"\")\n| extend SourceMACAddress = column_ifexists(\"SourceMACAddress\", \"\")\n| extend InfobloxLeaseOp = column_ifexists(\"InfobloxLeaseOp\", \"\")\n| extend InfobloxLifetime = column_ifexists(\"InfobloxLifetime\", \"\")\n| extend InfobloxLeaseUUID = column_ifexists(\"InfobloxLeaseUUID\", \"\")\n| extend InfobloxDNSRCode = column_ifexists(\"InfobloxDNSRCode\", \"\")\n| extend InfobloxDNSQClass = column_ifexists(\"InfobloxDNSQClass\", \"\")\n| extend InfobloxDNSQType = column_ifexists(\"InfobloxDNSQType\", \"\")\n| extend InfobloxThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\n| extend ThreatConfidence = toint(column_ifexists(\"InfobloxThreatConfidence\", \"\"))\n", "functionParameters": "", - "version": 1, + "version": 2, "tags": [ { "name": "description", - "value": "Infoblox Cloud Data Connector Data Parser" + "value": "" } ] } @@ -7233,7 +7233,7 @@ ], "metadata": { "title": "Infoblox Incident Enrichment Domains", - "description": "Leverages the Infoblox TIDE API to enrich Microsoft Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "description": "Leverages the Infoblox TIDE API to enrich Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", "prerequisites": [ "Infoblox TIDE API key." ], diff --git a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt b/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt deleted file mode 100644 index c0e059b84f6..00000000000 --- a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.txt +++ /dev/null @@ -1,54 +0,0 @@ -// Title: Infoblox Cloud Data Connector Parser -// Author: Infoblox -// Version: 3.0.0 -// Last Updated: 6/27/2023 -// Comment: -// -// DESCRIPTION: -// This parser takes raw Infoblox Cloud Data Connector (CDC) logs from a Syslog (CEF) stream and parses the logs into a normalized schema. -// -// USAGE: -// 1. Open Log Analytics/Microsoft Sentinel Logs blade. Copy the query below and paste into the Logs query window. -// 2. Click the Save button above the query. A pane will appear on the right, select "as Function" from the drop down. Enter the Function Name as InfobloxCDC. -// 3. Kusto Functions can typically take up to 15 minutes to activate. You can then use Function Alias for other queries. -// -// REFERENCES: -// Using functions in Azure monitor log queries: https://docs.microsoft.com/azure/azure-monitor/log-query/functions -// -CommonSecurityLog -| where DeviceVendor == "Infoblox" and DeviceProduct == "Data Connector" -| extend AEcopy = AdditionalExtensions -//Remove DHCP Option codes at end of DHCP logs to prevent invalid chars in fieldnames, causing errors. If you require these advanced fields, remove the following line. -| extend AEcopy = trim_end("InfobloxDHCPOptions=;(.*?)",AEcopy) -| extend AEcopy = extract_all(@"(?P[^=;]+)=(?P[^=;]+)", dynamic(["key","value"]), AEcopy) -| mv-apply AEcopy on ( - summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1])) -) -| extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested -| evaluate bag_unpack(AdditionalExtensionsParsed) -| extend ThreatLevel_Score = toint(column_ifexists("InfobloxThreatLevel", "")) -| extend ThreatLevel = case(ThreatLevel_Score>=80, "High", - ThreatLevel_Score>=30 and ThreatLevel_Score<80, "Medium", - ThreatLevel_Score<30 and ThreatLevel_Score>=1, "Low", - ThreatLevel_Score == 0,"Info", - "N/A" ) -| extend ThreatClass = extract("(.*?)_", 1, tostring(column_ifexists("InfobloxThreatProperty", ""))) -| extend ThreatProperty = extract("([^_]*$)", 1, tostring(column_ifexists("InfobloxThreatProperty", ""))) -| extend InfobloxB1FeedName = column_ifexists("InfobloxB1FeedName", "") -| extend InfobloxRPZ = column_ifexists("InfobloxRPZ", "") -| extend InfobloxB1PolicyAction = column_ifexists("InfobloxB1PolicyAction", "") -| extend InfobloxB1PolicyName = column_ifexists("InfobloxB1PolicyName", "") -| extend InfobloxDomainCat = column_ifexists("InfobloxDomainCat", "") -| extend InfobloxB1ConnectionType = column_ifexists("InfobloxB1ConnectionType", "") -| extend InfobloxB1SrcOSVersion = column_ifexists("InfobloxB1SrcOSVersion", "") -| extend InfobloxB1Network = column_ifexists("InfobloxB1Network", "") -| extend DeviceName = column_ifexists("DeviceName", "") -| extend SourceMACAddress = column_ifexists("SourceMACAddress", "") -| extend InfobloxLeaseOp = column_ifexists("InfobloxLeaseOp", "") -| extend InfobloxLifetime = column_ifexists("InfobloxLifetime", "") -| extend InfobloxLeaseUUID = column_ifexists("InfobloxLeaseUUID", "") -| extend InfobloxDNSRCode = column_ifexists("InfobloxDNSRCode", "") -| extend InfobloxDNSQClass = column_ifexists("InfobloxDNSQClass", "") -| extend InfobloxDNSQType = column_ifexists("InfobloxDNSQType", "") -| extend InfobloxThreatConfidence = toint(column_ifexists("InfobloxThreatConfidence", "")) -| extend ThreatConfidence = toint(column_ifexists("InfobloxThreatConfidence", "")) diff --git a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml b/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml index 147eceea09e..0ca20c60e5b 100644 --- a/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml +++ b/Solutions/Infoblox Cloud Data Connector/Parsers/InfobloxCDC.yaml @@ -14,7 +14,7 @@ FunctionQuery: | | extend AEcopy = trim_end("InfobloxDHCPOptions=;(.*?)",AEcopy) | extend AEcopy = extract_all(@"(?P[^=;]+)=(?P[^=;]+)", dynamic(["key","value"]), AEcopy) | mv-apply AEcopy on ( - summarize AdditionalExtensionsParsedNested = make_bag(pack(tostring(AEcopy[0]), AEcopy[1])) + summarize AdditionalExtensionsParsedNested = make_bag(bag_pack(tostring(AEcopy[0]), AEcopy[1])) ) | extend AdditionalExtensionsParsed = AdditionalExtensionsParsedNested | evaluate bag_unpack(AdditionalExtensionsParsed) @@ -41,4 +41,6 @@ FunctionQuery: | | extend InfobloxLeaseUUID = column_ifexists("InfobloxLeaseUUID", "") | extend InfobloxDNSRCode = column_ifexists("InfobloxDNSRCode", "") | extend InfobloxDNSQClass = column_ifexists("InfobloxDNSQClass", "") - | extend InfobloxDNSQType = column_ifexists("InfobloxDNSQType", "") \ No newline at end of file + | extend InfobloxDNSQType = column_ifexists("InfobloxDNSQType", "") + | extend InfobloxThreatConfidence = toint(column_ifexists("InfobloxThreatConfidence", "")) + | extend ThreatConfidence = toint(column_ifexists("InfobloxThreatConfidence", "")) \ No newline at end of file diff --git a/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md b/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md index dbeb0ffea02..8b886d69cf5 100644 --- a/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md +++ b/Solutions/Infoblox Cloud Data Connector/ReleaseNotes.md @@ -1,14 +1,14 @@ -| **Version** | **Date Modified** | **Change History** | -|-------------|--------------------------------|---------------------------------------------| -| 3.0.0 | Aug 2023 | Bug fixes -| | | Documentation updates -| | | Update Infoblox logo -| | | **Analytic Rules** Optimization updates. 5 new rules -| | | **Playbooks** 11 new playbooks -| 2.0.1-2.0.10 | May 2022-June 2023 | Bug fixes -| | | Documentation updates -| 1.0.0-1.1.0 | April 2021-Oct 2021 | Initial solution release | -| | | **Data Connector** New custom data connector for the Infoblox CDC -| | | **Analytic Rules** 3 new rules -| | | **Parser** 1 new parser -| | | **Workbook** 1 new workbook +| **Version** | **Date Modified** | **Change History** | +|---------------|--------------------------------|---------------------------------------------| +| 3.0.0 | Aug 2023 | Bug fixes +| | | Documentation updates +| | | Update Infoblox logo +| | | **Analytic Rules** Optimization updates. 5 new rules +| | | **Playbooks** 11 new playbooks +| 2.0.1-2.0.10 | May 2022-June 2023 | Bug fixes +| | | Documentation updates +| 1.0.0-1.1.0 | April 2021-Oct 2021 | Initial solution release | +| | | **Data Connector** New custom data connector for the Infoblox CDC +| | | **Analytic Rules** 3 new rules +| | | **Parser** 1 new parser +| | | **Workbook** 1 new workbook From 09a0b3b57daaca8488383a69a09ba8202eb1c296 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Thu, 24 Aug 2023 19:23:52 +0530 Subject: [PATCH 46/47] sentinel to microsoft sentinel --- .../Package/3.0.0.zip | Bin 41891 -> 41895 bytes .../Package/mainTemplate.json | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index 40ac21f12c99be35ccc581bb606826266c489952..7d66242efd59fda6ae9fbd2c962eb0da47a3f1ca 100644 GIT binary patch delta 16887 zcma*PWmFvRy6uZgf_rdxcXxMd+}#Q86z&!@!Ce}6C&8WI?v~&d0zs17`LBEKKI^Q# z$2}irKiyUD=H$7>Y zP*4aZ&6X&LAfSq(l)X)Ruv7_$l+Ws0dL;Ht4*$DQP1R|+6qJWUPL$_TDo>MDCBc1G zjWBokDNF`Qn&{ExPXKHo9JxCaKI4xh= zeG7AGq6J)SSqpfpD^c$@RloUp&Gs6Yhvguf($l(tn~~4w#*2g${us<7|DHR1El!uI~Nu} ztVnRfn2P+;hWIJwn%-8SvH74>MFyMP#AG0xYdA22dSSUltDTQ$=p2~9%^8V0Lvr*K z!e-Yc7##AEAP7;RpO#I;A~j#1S0TG=bv^|(%rYF!pP4cCdDo?z#{7>Vcf#|RQkDUj z8JIZ^=j>E8n9;GWlqvAX(N$Nh@u6AsiO5vl(3HM`$yOW5S|OqmAEUESYyU4gF~nIf z%o%_#ND$D5jmKgXr;gR;|C0S~8@uCcnjznbMRBAaRhM6u5jsaqdFe;7Dzb)a zUxPQAusdir&tBtC$$pN=glcPu)Ll~_DdwV-7)~&1C+wt~;XAJ^MAxSlvam3zdx40ljk%w2 zwL=*rKCVu5BFv6&HM+>Z^BeR{a{bmIuz(sJl=N1TTgyHf?UM}36{`npP;I6}pG;^I zN#$#ad+bE%Lx1~sLT^KZmy-pb^Eh-rKwmS${uOB=ZV=2gC*kLUI`_R9pGB zWSo3_)%?Q3*j7a&{qVa&?ar~dHr-mptd^dQs;ChiHaJ~k<({X7C^2r@a|xyi$Xvj@ zfJ+xcm9w~=m%vGeX`V7N)b{Xr&9bd<)E<9IE_rYqrAv9>F}`^zJ$Q_Od+EelMOt(6 zUNaYQ!rLTd1~+JDd{F9UB7(w3asY@BEYjDaRzG+5mey)y=Zlu*SjwgZQcYCZ5@!3p zNAt&fj*T4|gk@BWx*jWmg~c=mILsBqW{Y;c6cG3$qyE5@>ti)}d*3F|m{g|nHK5hx zwi+JRBzUrj9XUK$)6;Wvs8X8L40(M1&9VDnV^%1R6@zjv!A_D-ZKVh`se-Njr)WnM zx;EpRJl%&Xe0SP1n@J~U_65#hM!f@MzOv9(X?`dY>j634+@5s7Na1`CKyiMe#jq4{ z!^&wDg!Rr`E0e_c31^7#ZMygd^u=S}vbp6N=54|=Qzo2|?VuS7<65uK+h>wZ? zbWTbtc7{jVIEBI>Br#lOY!gVFTuI}`#(L72b~WwguH+MkY5gk12yFVhD?aCjR-zOO zyXBO^&cw{1uvXr8h=asP%hFrN)JwE%jWbL7vn^mB0}0Cs94(2ZYHkCEmk_GkZiAfI z*t(f)JwUc?pVX4dwcsZ=m}&D`si({4*!#i_d-&Xh9i}W8xixvS>CZ1jqD{1aJlfzi0Y?spL< zeIPhT;K3wQm`RyE>b=2P6OHpAhXBr)5@CG~@ey0?*SR<88BspDOs}H#PKoHD^OV^B z=oE@#;{hEB^-g!Lw5!9fjoWL-Cc~nS@x?~p;?U#V#YhcIfcO;fO29}qxZwP_Ts~*v z`jllQ|Ar*F5_ad@;chR-_*E{j`RvJN#d!&z?1B)#_hzonxopk!^q8LIm=&|eZ}mtw zw0<#FCdaqNaJxk0=kcfQv}ts|>gsvXyxQl-*_UJQ8=TM^nNY8T2NOXD{a0DnwcRtP z^WQ}NE_8FQz;0XOM$q64kIiZ!3z5ft)Ojyv1yPO0fQtMq|BaQ)YnNCUsoa}ySp}N5 z&YfB}t82_@f~jx|2ge45OfHzWuSk!!`Y(;)n2!hl+Nq^hV;6F4r0m3z`$sb;w-Cm;?e_tIklBsW? zKb+^e`O}LaY;_^dAIuuxQT!kfsr>Ur_ZiARcV-3n{zCq`BKp2=1E`OlI`D2ULYz8y z*t#fk_t<&}E;MSN3`YO(Ds=t`)#>0^6})60Jgxs4$0cUARL`4d;^@$e!$Z24At$1? z4QFb-4EQIWJeo~^E6ToKDtm1$yU4Kq<eHo6L-4 zW4uRTs69%>rwO38a!4%EAl3_Mt5LAEtUS&h)2<;121&@cG%2mU0P6opN2I7%+NiP_`ZaN6wK`M2Px!^x-huWHq4n z$KxolYWQujcnd^z36zws7#BEz&>61x$digui=ktRs2z&uSWxVYMnRn*9p{$j?GUx<#q_ zjZ~ep3;cS@Ugo>`FG9lPZCR3@N{-N^Y(K};4UlPYDyB1NPkgb{GBGjWSX6L4Q-5{r zT%4N3e?C+H;lsFU7WOn8NuOH2yDVsES!No1#MAe-dv2>%H}7*cIPjMREI1G#0v^EV zIxqh5=z5_3yRrvIL~W~d#AM^xsg43PQA0+2_U-i2^j@bl&wr9qfRjswrv_IgQNaF$?e4y2BK)DRo1xI_K#Kx;? zu_#`D1pMY#?XeW&b+v<%2MAd3{%BBttvM=bD(c}iTroHktyOfZ2L?6k=st-Ob8yvm ziGEPh#ob9v)cWvR!!(uLutP#jio}*w7iUopMr&NyLl2+0j1kUQnzbky8!+Zf%g9$N z*!|s_NI3=?FTGL|Bh?%(&6bm)Rg(FWLfOznn?I?Okuhmq4vvd3ivsTASOd7ecWKzj zFnUkME*VzA7gUbSr}8@fTo2HCxTEjj-G0MClCF55&}vdEm-ckfcbiq_2-8gHY>z#o zQvS|4)=&nQf~4csA+g?y-&O&rZ;Fjys;xPl-8axT_M{R$ znKsJpB5^_P^dWxavae02_6Bu!t(0neNUI`A@I$N3<#+c4Y}7lAvgdap21rta4um;r zvkjIpd8!`mDgphk*2KW@bGgb6pEKDG3~VcUk{Y^LPr%A=U4r0?tu$;7=yN&9B1~Luv|qy!_LVUr7dfmn@l>Ub_sF9Z!nvll`P3`eiFu-+3dCRK;^>#p<4Gwz}+8k;eq-yXFL3-*>nD;wM`Q^#>6 zN)4JSI>E83XLhOTIm~KYItyT(1^Q0VywJ3D5onnMS<=fiC*KRL+O$d0LE60-7%^b@50pV{yb>O>uk7XJngPZo$q%p z!pWJ_LV90pG=6>f%=EC^=eM`f!8oGL8508Kr!c$xP{TlXLifXd!}t9^0wRuMj>%aC>;$w=hrMzM$4j2j=;kw7h;$IFT zb*uHwqC+vK3jexY2oF;|9Wu0537$|m?{Au#!L3UbP?B7$|4Mu#BmqB; zgBB?@=c>61?Uac3X=^ZO%mme2AM-07fI{igPom)r)nE|FPtJ5P4E?1}3NU-9)BRIi zXSzeFKOKw3Dq_ty8z#aCTkv%>1u+85r9H>OcE+O)QX~H{9>hIN=w1<}6U;1lvl+By z{rb}}Ze|U%_*TS#@EVJU&_dVx#lS))FlXNj!&_#&M4(RC<*TEP1hfY&w*BBBx9*sJ6-qk=p7yaV+m%uwT7Z5|^9ABPWn zFu#aLnbV02f&P#7*2(ucHRB!pjwSSYvqM$r29_gS@igJiDVf1y{I6RwR|=>wI$s2% zyv{>+!VhVs1HRA{iG=)wT89;tIbDT)Tf-E740o&JvI#s};(Sj091RRwk0Q9*?Y$L6 zXYwLc{R-rDBe6VrVWGlA%N(krN`#y7qQDf;n%83L9g$uzI1<&OOS$V%&pxqNl#8-+5T+90a}?g%gaquD&<|Tx z6n0QkQP8{Vl&6R55rTl9jDeu2n}&#HVy;blk|{~h%OhN?TUNw6zr#Ug;xkTFQDRA| zQ*~5Dv_|T)Fw*eNc)RoG4}_12IE)9REJd6q@|6jW*o+6b_9qK+pU<9Bb_Bz`7TpXu zP7hd-@7)$hHOL+q!k#*^@x;mGMAk}Z7SrC^oByzSX!04%&yojw=KA}bF%D{w|?t{gHSKVcnI&rs*Sfe>LX+_wFMxe*--pWJy-H)oHpodP9B*vy6rN_?JOCaYux4OC zmubh`FwC!A(DvDVE7_EWqT|7FE9*J69466%a1+1m`wbf)`Hr9#b>w0M-O1x*1IWdy z8>yi);ppxBE}-V66zgQw!(@p@b|YP)SebJO@MTDR(&{xq$efkwoLY=air$J>4ICY7 zGUz$^D9)ecD44ti@01-n8<%Tf)19xR`jrDihE;;9+f0vA6+XSOG66G9tqpq5K6boi ztx#Hovx3Sq&sa{cZCPI~#&4^@} zYPXpf?fg2|O(_>Q7V9&sz!u@(`Y5t58=Sz73#NBUPTE&JZ#<+>31xSuJxR0VBxr!5npL`%GTq9_<~YZugV`5Ai(%#LQV z0{Ty2<@ZsP>G3Xgl5KXdxfOX#7SLl~{=}9mqj`UC#tSWi;y1U;G2NJ}$tlaJ+(3PH z_G{c%4%x=pD>eRL4NUPI7ril3EWgIa>XhVzde=3a27>}mJ^j-E>71VPB>#jvZ=0^< z`X{+U@mb$Ue_2&WjC5<`ipkC-MNEZ0NV}5weF|~SN_+U+D>QSvdwrZrmVc2sk8No! zj@|IK7}u<+fz^CRki~~jAD*eNQ<1ya%BH*pKgsQJwHEdsY5?$AbZ>~D@8$(HcZD@1 zbH?F{Y^4gYhVRY%Prfb{`rEe=?)uy7yQYYI@+69d_GEiqgXzmU_CVN6Q&38PPG@`V zCCp`;)a-4fKf_=K5U{hqQD$S0-;+A!a^teOS zigqBUGe@kfU;?#f2jx`PZ=N1gmML2eJ|n`R@$d99%?p4IGaG$mXj-Ey47k6=R2 z453kCZ?}R=AKSCDuWNt)R4;xtUxkG*HLY3*<4g;oUVd@8%daPSjNuSB{Y!|wKCJ_ zDL3hM8H{LL3Tj1bY)KO=MVV;}49!?dYHTsrFwS$wIk?1lZD=grXlgKcBCaqk8@jC4 z_%{|{O7lGHQEwphtZ*M86~~c-k%~_nJFV8=hE)Qx6CT%b4>B&n=nMM7VU@fxtYMW{ za2mBT`MGLv8Z3vB7$9fAaW;Za@Knv(wB2_FbO}=yu3mdo&EzrQ+IWJX5wA-2rvy_i zf*^#FuV(48f0)~L*)z8(W59-Q;Vz(C5W!gMuyu*k$s!G3y4>GMFEthse<=n6V)9N? zX3+p~A#qE@NAB3wstn}Bq{gNMXHRl(u#|TgFXB2e2-z8JW#o9|Sp0kunSjp@il4nn zhzAZeWQ`rl$WS`ZC`X;HUOpzzL8UUWgxBPQI+2gFlS_-6cB=Ez^$&JMPKydbzVHd( zZ1s0O3Y7`T8P-PD#En`cSf>Y-$-2~wqs9P{R8S9Pk?7?*{pmPl1Iss(e_KM=oh5U= zIAOKaMAEd1a|14@mcwY&TBuPOr0$bA*B(+Oc`I};QKbIv9x3LuXWREVY_q7cw5Bh^_ZuY}GqR_7KvFU8_kLdhs`%+z}Wt>FP#aN!r&>KfoPPl$<; zA?z)#{Z>AqQ*uaZx`~q1;lQ^tC-I;t^X8NET#}GrZetSiei7k@xUjaf=#bPBFm*=S z3MpsD9MSJ9U#|fnXL0{&`LXBFh6JvA zg!#~+2~?Ozh5sIDV*FmD5Ry26O-u$yj6^$HdRPXM zzns9;5OYHj6RhPCh9P`$B7mx6DORmhsZ7(Qju305T^!LMs+X@!?B?a=TjysSZ*%bV zC!l$^rU{i_hgTvymHmrG#okiRet6wI)_FwAz1NLdpS@iJRcxfYNk zfP)ykF<^NLFknGB7_dv}kmo91_Bj+zxI^Mgv_s-N)I;Kt5d@Wyhcd(#h5i6W6hY-W z?ug6IgMD2R?BN+GV&RAY9;SPYqFrOzhu)QDTlHsO*F+_$l1C-rg%@ zpBNLWNGgN?hUXkHqOd5m(Z_^sbwgRK9pO-)v{Naz8zo_!(Hn*1P)~G*d_!I`i^5Z} zW3OZbf=VFp?jwM*NVJVUBrb!Z9Uc;RPEa|lVv9vkDZA7xir^5djE=IXsh@nImx)D8 z+sS0id{Fs5ugbE}g$ltzi=YxCtu9C!l>GeDQ1DiQ?TImkGF1*bw#!)0s?<$>F%EO( z0tBK{mKmNU5vbR5?KE$G8V;6?SUk7<;6wyASpd?hBpE47DJ8+9CTSUMlD>j00V|&-Ngf0fz(y|N+^MRl?f!;_x0}69^s5LuO34mv~iLc~}Nw!oA9|i#d z02YLN0S(ExQBplKryn+~bOAuG) zz&a;^BY6LDr3X3lDO>{4|Kv)U|IwA^8hOBf*s`G#V$1(OS28>NyDJ+iA+B`8+979V z94JnLk7qoy)nqL{UU-cZc>>i%MZ@cq9ms!<#n4?+Fv%sab1)E3iY0o9Qn3fbjX=(l zMj$Ooqb2U8GUupk0}Ne=b9I+eFm!RT_Q80m_---PrxFDFUFIAtHpF&W21$ z_fkcX+ZqXVSl;eJJMUEm8oNvaM!6N{Mx1@{F=WyD-J`?K&&yIC$~s2BA01$m4zA-T zOdFobICh{qaj?dP53SiiHUvvX=+e$}M35G#*})0cT&MLHh7ITsM}6F4xPD}BL_=>x zX#g^Z6RihaclLc56Z!QUq?&UCB$x(DD96lijW7*(?Ip2L4T7hY_cwY<+5x+bnG^o! z8%^nE{Nqk1>+j@N&Xh@#y%2BoDndq|Sic8Vte*jU$8)ZT$uRL=6%Aj;xEuAB=9ZoH zL3Elj({m&R|8i{bNU$vN@;{FCHeE=kLSx!*phT-46-_(gju|9mNSA`ZZ$uhx5N7m(6jy2!55u)yWg-5bj5sd zGKzjfwf4vp`N4@j6;(Fy$5)HD+?FRS`wd;K;1_NHcOYha&pVaOnZs&=CsJW~+YRV?(|q;cDQ&?YhA zHG#i+ZIp72*Qu|ZK`s|Gq%V^TN*1AAu*R_E(IidQ?U8l&Ncf0$hH2Z%;ErjVK|bSv zdV1(YIpaWqzhC1psTAB#&q^>{#<_Nda2=sxbY2Uv2IAlk=|eVXswKz>QO68@ER4Tcz&kfgJOB%LKLmPO4!N!JKTI*S?y?0@MPGBY6} zgq+TX%zu)u;lE8fi<)D|qW_h201xE|qeKD--}9YEZ%lo*wM^jB$PLJcXjGTwKq$7D z#HT~Rk_3B5m!~cC5xgE4QxE?0QCDJQM3?7+!Xu(Kdti;Cj&UDMSqJ_q%V%!{%Hys| zt}-ZIhSh4-Ubf82EQ2dipjBF#;?Fj=J^cs{h^bnqFF(C%DQWm13d6hv^bQnLF7#_2 zQPpguf@iYgo(hH9{^hsY_}2si@IQXr?1lIZ1vI2Cg91wKrCBh>kb?LvO1FpG-6QZL z+5x82U%yFZEDo!~lT2-za`Gyld?W{}q|trD*3f?2i6H|rG`W2{V%JZ=k}-by`VHB# zW!2F5k$?q=DRwxc94T@mVN8%ZSiu=7>gVSssGk#yXHiZlYmX^DU51eefVv0;NBj(N zw7j!KXKtuVpa(k)6)^dLA+waNP9*0Hp$p#2_0>(ggG%ZR z@ZO1ex|OtsmkUD14R;aeWvco+GN#Fn3I5_rK?sj%kU`30ayM_(ldp_q&}OT~Vw#A7 zq)2B9o~)WTTRc5DV;pQPWYx&94-(T&CNHim*UuSI2n?qOH%Ar6RaWL#R`LmtWxDC& z`riIT9w=VVvOqM4@P#=9Hq13tAX?DQYI_%ED50nAEUBk01(7^byn(#Q5CtO|2}TaLtNttfNUao(F6`w3pk7-&nY2m?h9cNE0n-TIs{#s{fj}on0|7F{fj|D z{xXP!8s-li2{jS#Ol4Pz*#&vOQR5r-vFTcKK?k|nzX&p`6;}8!1Sy0d2-3e0L<(#s z{}(}ki@OMle;7m_7w#{E4E|-1sJ{#{IAXR+fbtK6EI}9q?!RRa*;%dsBjO4x{ww0X zSN#Y3&My30!~y>XzexW7W5k8!|7XNWsQq6=-0Z@?N1TM(--sjclbF?l6UhTiXBX^3 zQYt6~n15nN2&=pu<8YH2X}EYq@`ISi&p{E%FT1>}Wf~*>jby$9wq!mbmSn!9%a##5;a^U_&4rnz9 za_m;|lELIdkOMc_Af&?cn;uGs)_0_^Jj&H731Lz1hK2o1F60KS-erBV(-!Fx#6|n6 zno(6|CFGx}H5qm3ZY}LIi$$sh6pQv!>J`_(;w6W9o+wid!#wwL73Y^O=gQN~%F3J0 z@Lk+97Cxut>ea7E-q}ISsm`!tj@j;TLNX0na6!iuyZNKyS2J4*8}QWR-poG(I<0^jT}Q?UMJ z3jFXr3-+2~2vczXWs38~e=)_sA;r6XRmioF2yZAAJH)97lHCRBusj`FZo!cW&bGNw zvkJ5|L?qT$#xa%5q1^j5ZQy3Hc*Nx$=9oRDb}kfDApOMrG@@!Sr?0tmL&vfS^o&q zvVklG6;b~118Vb7V^s;WX8*1X8Fun=(O^&sY^f#;f4k9`3 zg>4Yx*E8j67O#Sk?b>=;R-5OkGENnB8rV!TnP@(e6`2r^M)PKVgkxr{9*vdEOe1=a zKVR4l^~@iz=Y?r(EL{?Rjksk<3^YXQUYIl~nx~dz z!C8>0%8(Y)(!&p1+rlo+irf!bbaLa z#}%N@+?@WNnLQ{57!&n)+7Rm|z298D9e2!`tT^WD4Rr7LG?X?P(&?J~E8RI$bDP#N z+NfCI=U5e=i%8=e-ckE$7a(F0;ZXQYklG6_?vP9mr|trSKMDKzq#iak;WA(^{;n(s zLsdP$9z8ght@kCPlk3Ek9B4F2z588XLh-s748z5m_`$ONQ*j1!1 zmBD&fk3Kh*$=o`UPDjn}1hgG$LX2YB6*%!0|Z}_E~wXc z-OM~ui3^mAgYn3DOoJYd96L}sV%KR@+q}Wyhc;NwNVEKn{<%%2+Q9olq$_UZiKY&< zsHj!!Smajf15tbYI;?GbtZCeR(UWXpWimOn;{GJ8^CUi>Z8la%Hy=x^>G1&asJpgu8$&@u&g<2 z6G^T@nK>UyV`?AM&heLeQJUmsukM|TUaiq-wCP~$qR+=;aRGD!N*q$rL>TGg`g(82 zFX=y12&|lm*7$M`r;dg&&}sP`kSGgy4^?5KeX7wv4^K&^J7vFDlGyQM^Q=Uh*L=L{ zF0}2?tyM!%OC~&-k(1H$nf%_;P@A@|o;=v2P+Xhy3+@~4#+Op=RcMA>T;~udj*5Uy z-OLS+pG=cXZEa0aP7lIs-^m?1mJ{8g3w6epWnE}GhMlbSMRdBYRi>7oe2^|CZiU#s zs4@&WF8Qt&sSua+HPy5kmX^Wv&6(;`2zXwGN;)aQq{;!*dYM~Pgv``ejeAwH+IsRX zx@?o<)`h;ei5PF~3ALAE@ZMG-Xx(VX^X|xVr)a(rDV`H23>Uu|<4!3T9Ot2063>Ro z`#on(p%TviRlXVWn`EZ#qQ3k>Ay^j9KwgW&`S4vLp5}BdlICk=OUh{y67_>dD7R_^ za0>vLG>by+ETs&ZdTeo!fu+w@%u?DIglUdHuZ`%cgQ~ieY?Ri4@Kp>B@M<0pW^`+w2oWH(&43T0yqC;IP-(8L^pm-c z)Xt%8PpB&mkoysNh_{44kFU$=phxOrtnBC=d;4}=@XJr{SAVSw9=<hY7*Nvhh$i{zgYs=8UUTfUtd3 z)of7hFHJscG-w^-!Rpeh@u`KpZU&oA;`dnZQ0zs2tBKC0`ctsrUyove6!8fs#HH~f zCMupz*JX0Q2%w5&oGJ3E)6Li(Fwe6t?znlPl}?_K(A{wp2giqyNs`_d9=mfX-E(9a z-c;W{1+;MN1{EKDIvX~-*4L3*1txzyj2zlF)(%{P&O!De+&xBx3JV+aUt-={W!Jna zC|t&}kiWxvEf92f?i;r7-DvEFT>4?QSo`!bIh^#hT&?>~r8=>nm;e-2+0*0x;SDOq ztdf#Npou%0UpM+o?oymr!1^eZ22t$G}&Ru-n^+ zE-6m0XoAH&LMQ}^>hw};CiG zd-SU(_>_n%ZD%?OvD$(m62?xfCX^M8Jq2gJ^STt@vAB_-b#@-+E-rYRhDOC;B7}6$ zwFf$6OdI$Q2=IPS+FX^|LICklOY~rcT2cJU`%+>w^TN_?dA;0CO&|N}oN6mD{hK0w z&^%hdhS)E=I7MAbar)OI1J2AgP-qI8L;mQS6ZQ3!(LvAmT-0abLh0l8;y(2FKQ#=j zIQpGZ=jOe*lA1O?iS`X5>Rm)1`&1 zz`VO7ZvyNa$zMT^nb8z^b{iN@Ak==muwe4<(HqN&g=9}Q#Jp$Rt~{4=Mdb?Oz{i+2 z=dbp%(u|nQ5%M(UQ$XS<6xe-Q*UL-igCg2mEIB&$^Z?_n_K~9YX@~C;FX=GM`)$cs6g)9yLGfq`D}L)&ZfJho}dsR_ceH28+7 zd@Hy?x+sLA0r3W?-}?FWdm=wh**Bsz-C^7e4fS{fKB}d5v4^bGJM%}IeHpwc*Qi68 zb)-SQGXS#8TYfvj;?c(VmKtl254(VuJ&^0BWNObrT~sBM-V{?9H5KxCj;bg-Q>lpN zkWVZ%D4hnc#qQ^+{x)~q+b-aLg+lkca>UH3A zPuz2fwc&_WcbL{^I8CD7mGU{%=-ZK|-(27@pndldt{gH%r#S=kw=TH+DEX zqI5*zWYn<%8d)#)SGX@~&SwEg$(;oYoV~2CzrXqY>G@h;q9iEeoW5xSu*=h%-mc-r*?+hHG? ziQDUbpjr}C;+s-Uk0N#Zxg&%0hukmKmLmS?Jk8#0NBK{!iAxtw+X+-tU7M8EKfc27 zIbFIqJ1MwSX8UZ@3j6x10>zjY))nGS#NY%QQNflq;u{7s6Xz@E%dF@^<%nJ7<+O>s z5(`K6_zzF}&5r}FsbT5yHaG=O>A*Hs!Js}(NpzTiwGQKDPMQ^sHyy%*C3=)%3Ca|k zR8^XbO}SqVK~^-xD-1^!FKI@b&G!?z4_-#w3S@th3H?p--*d7671&BAIkv$^UVdep zmrLw#p0~DpCwW%NxHuH`oiW0@ZjC$FitmpHf*&Zq-|>Hak#Oz$cHPjAy{C*6$Zp7M zh8>CyUOUc+NxDAUJ*wA^zrZf%`OI&sx%Bg*Kl!dK>vNq1f@9m}-N7c>z12~LCCO)# zTU{>IPm`!&hxc~MfR!OpPfJa#WzlQ%bAr+pg=7qTWUM=im{i!y-UG8s^P$jB>UCpJ zcB)_FSp{vwM9pP}@2;vGD0IiE@C&?Q_gF37g=5pp4 znOX|LA0r@ZVXO)sJAJG+aUb!KHIT}=4$6*6u%9{iYy88Ty`;eRhf#3;;^~pTtTaVy zey_D)GSvU85pZ(e=>bmYNL1QnL!H*ciG2ra7Ohs2BqUP-g$l!t%j*yrqaa;&X+`|Q z&Mh?x-K+5U^Fih3b5*Pu5a}7NiOWrWp$euAnG;iXqfEX!NoGy2_M-Ymy5#qgq&y3~ zp@RkC{o18sZNIB4=~|&8#a!nHhAg5CY!(?UiYae_QQ%lp14>*B&G|QBN{+d&%;&pz z$P5Icjr_d%leDIfE3LcMjjjgc)1(iaHT1L}V+G_x?N?U*_LX*5!H6|4l&1LE`Xu=P z`wOI3!Gqa)n`sS>_=^5f1icWqUn_bS!gtQBcEMVyEsvm2AW{*qE3Qslr>OMZbdxAS zcD>6Y;K-vx(;nxHGxfSZn_(l-td7CC+H*x|^*+-kJS)(9M_`wt;4)zp-f-an#+JEv z7&>X&j+DPEVUu>kTbP_WF+&-Pe|;4RM$Yk$;(g0+%il6`D!X>Gm9aV{tdvI*GZAp_ zR=IMZv90bHf3fd!*7>l7ln%n(!oxDs2~G`;0IlXxbnoupp|nJTakCTucXC>p>2E>~6J*I|Pu9Q8(cXhd@;N;~RUV|m4rUb9%kA79 z-N3obxC+1U{7Q-|%>sNd*%qgBg20mOUPa%Vy7$vYn2xmmmn&LmYC z>M{l!o!{I$0|LJd$!sZOQ`(+-N|~Q&iUWNNU%B_2$M7k=hCRM%l5%*-m$At@cn7Zk zNZr?w^c1hYg2Mdp!af+Qtp{6#FBF-w0i^ z>15RCCG=i|u7OL=e6Brob8``ynIGZf71xD01&|?2;iE_6f}2_$MiIwNp3zinmrV6Y z7mIh{ySMY+S(>uXCVLN>$`wg~1muhMGHJaw8c2;No%MdP0@qy~nslQf0x1bdLz$WQ zS=cID1tr%uR{lOrwAGBQBVc4=>ie9W%nbocoUPh5$ZEIrDwM1YC|baj7xJu8oKH#4 z#J(wXAOJm3DT)^ReDS3ERlZ$L#(=F>RJ!*~RGSZR!4{o?Qmty*&;Es(5ES(tS9bF- zmodZI&OXGD!GfX_`&(p%!gL-$KfP<({J9$ClaPqfXxCn=EwmnjG78xH=u%CiR!AK6);yp%dwKUe@XVa=$%4aB9mmeKwW|_QA$bUH)CdmE6UfNn0&ufCrReY%ah%?A{}$r>fkzSYx?{o2jM6T=5)!G=(#{_S;N= zZ`j=>EHXwF_Ung>?C`^mO^-=={dXma7$xQWM0>tz#%*wgg6))kmi-=)=Q5;PqOKPA zu7L5*&X&Gfoe=7A4u!rv%_VWX@<<$BA;Iu3ox<6=VizLygn>XIK%G9oVrzGPsumi- z0|qz+kB$;L(4SFoy?Lso>h=hGXH&Q$$G7uLTbVEboK;3)n<~GIaYPpZsI8guV{tX1W`$p_TX(S~g|HoY%((Foj5Kv1Xw|Rj2 Fe*p40UQz%6 delta 16814 zcma*PWmH_vzx|23TX1)Ghu{R)#@*c^Xc`Uf?rx2HfDkOfAz0(?9vlJzrt>^A_rK=e z-(52=cGp=|wfdZfz4rH0b-GXGFihz%44S$UEF2yb6ciFvX;KrK0vg8WBtqRGFT3Z& z3@E7Uk`_xeL;x_G-;_`Tq&pjdtVY~CH#*RHppq9SfnO;{GZGfyLG(Fj7CVRijFQY9 zmfq?Yx7>c}?3^1?my?w04i%{>8%04uZEZ?exU~*_>2$j=monDgpNRqEPI^_2M}>I7 zDt!?PPwcyfH^tmX7VYQ7)|K8dA-xcN)De6(`Rd40%@<&kS}YvdmwR+pS$Sr{z7Rq1 zpQCT~f((im>@BtkSZO@z(MGhh4R#&JAM+cWL49cQdrt{5ByEG6y}+Lj56?wxqLS&L{YhUHc0zIAEc)$fFqHK&Ovy z&3i6Wv0sG`rYR3sQTGK0rQoJI6v3pPCMcZ9ZNAmVZ}PW;bosi%Swy)E=83WCzkJMl zzZZz=mC=%qV-Gp^{R;-p*?kwl!50MjorUBQCh?qOkNvfW9lvX&>9j z*&^YkoLf;A*2mS%PTK-=z;&N1!_DQD+^r*{LKb;ynB3tw}%O-Ecryizz zue1*Yq)$CR4D`Byj{ z9c(Rg^T-OK_`WnLZiFl{Z{s04{g@LwH2k1?Aur(m{v32RMwY5G9a%&8$K^75Y{YOS z;?SyZyftFgn76r8@%6pI={eczlpQ#2y|)P{rVMt=Ozn30s_E3AsXK8hodHI#P8p}f z4?J!^gS$X@@P8{Yi0pCKpaiHTviypmNRf1;cHjcj8m|cAUMQ|)z$_c zP=rE7-|kTl?d2g*L!v3S!CA1oD&#cfHE3SA8;Uily;3S|gE;6oo=0O^W1ZxxQRIZ^ z@K$A1!hIZc$=3CGJ%a%FbW7H~By9rBz%$SBb4&-#X`5St#ezVB@Q+H8LYmr#6!4ic zM?9sz65}r8&1!|$JPs>xl@U5BQ`L=Sy}`-Px5u8>BwuUyp9epJA0+TYS2>U7?)tpJ%j0JqKI~xq9Fq`%cLO+))wcs&s3$6w3d&!7E z@2d?aXMOd;`k~dw%CkrSUNd^zUp^)VG{5d1y{udz?**yoioV|z6sLj)mcj8$@#h-* z$YAEecR~WI)nZ6)9 ztl-Bdi;}C$;FuID(etA|2^n3WvfeDF7o)Fn3bbnRc5kqKMtE(0zNlsN$Lc-wT38m_ za{?h28sl-b&Xph{6cm-X)TnnXS8EMGv`1$mLdGOGYS;h-6;FBe#@hjaVQK-!wEpGwmZ0@Jvo85QC2BPWV~+f)2N1$iAr+iP-m%M# zBg9yi%L<=@DvRPqk^c9Zy!>!_TmP@@8`VELglo+GhUDg4dgUb+S+6AX8tz%tHnWYY z$B6+odz9;S9^Eu;H7-oR@lZ9iDaJl&_)IaDi5ah7+X@XTME&9{)ze@j3Cb`<2zirZ2$hcT+H z(H{r%l<;fId(N!! z)|cwWuZ12S&45i{nzpu%*Gw(;=}EN51Iv-uj(H}V1J%c!Z9Z_xYvd-it_Oyo4W{8j z;ie6HPbM7@1vic=Z=uUcVbx6;1O7T?==4?Yx6&z1D~xsdHrXL{@6T0(-J8PJk#G~q zs9Ck^Pi(uZD}R)beT;#%i*219jhL?qjEkK+JSA(1kr@I&>avr`f~Ja-$gWPN*#q9M z-s5eyfju-QeVJV=fsdNHZ`h_MUEk)t4ex$bb`8n827(+7?e8Btg%o2umEar;JbweW zSlX;+=nIZA9_$i({3;%-Zf@33K&_ZIr{Y4qy{*QgvSxuAX6uhVnF$6uy)%aVkHRF~ zZ=VZR6>dp@Uz~S+HXA+TiTLfthm3lt0$jfzBRHnH;o|VBie?-3UZ@ogClCDIubkI6 zywDbP=N~UipzXgc>s&~+%B&oDgj;?G2X$90Udi&k_cKT(^cJ6*q zEWkFeKt55j<3j&d&}%X9Ra6f1#$=duHMs*zj2=C@Anm-_P@KkGCjAGCapZuR5y zQ1p-lEo}-L?B7}fSC4v{wn^jy2bV@jpbVVoo)#1>IlycLfb0|`G;fl1r0mRTT_V@mJDSTnrFY8BR_wD4wd$R3* za_m|=;b!4yz}%2P&|?MW=IwT_I0*~nC2-F6-B+Hs3fK0H>-ZMK-Q1oOmt1c@_l+~5 zC2oJmr5~T&n@veKcCsh1<+aL&R=eT-Ju3wy^5QW$!Um4n@;kJ1&ILTbx$c7kTMCj` zfl)Wf@tpxy&zLP* zcB!39o*C8OyvtQTuL>Be7jbmmoHy37hhMO5+t!E51ZNgF^qh!u3~L{Nbr!G%&^&3< zq98z~ zl&(YX{%bPqD#~v=y`v&Gl=;gp+rcyaeVD@%4Ox4K7z~WL9A`$NBl{{_77{f z9_6=E&EgwxKRm6$FpNp=hQ}NKg-hUJJO@kbm62_{3SpL%b0HXZ9abL`Ztac;`M|?r z?$5+7+kWQ84|_yB8DU5Fc?!0Vg!Ip{Uihz3DHE-w) z`f@X7MUv)c>fA>~a)#bVImF!JWbd6bCSLGI*P89@skZa6CLY&@nar)UD2JS{MyVXb zc!FC8FyhKbp&4QdFwCjRX&(g6`$uF76FgmK*RY6_`H1JCqz`M><+OFpK5R#2+k@|- zjk-XOE>3wdXST-XpTb`*wk{=n-Ms*KJOJ;gd<-C=wvYT?b?s*Y5?O+aln`_5naIkpgwoU%nN_oxLZ5_E8w{I1fiKs9 zreBcSUho9DP4t}p!~u@!Xj55>Z;Cbj;Q%LTh%jmQQ~n`4SWJnJV$boXD#Lf2Z?@%A zwq?HjF}9_Bh`#&|Jd>AB^Li8o@jJ_m|MhYtT@Vix&Wk3Vl4`Rpiok`+cue3<2 zJb2u5qVHvF9pV`;U!k9IBJ=2iuLYc3b~o^O%4b^U*<~d%um6Oamm(zAnOn*W|4b%* z=9Sa!yn=ecvHQrfA>jP<&Hnk3fUqjaEztjQd%gR_TWr4y3B)rP|&du-5z=>(Z+!P5PJo$Q`ka6&}fKZ@Nd{y8PcC-63hG>;TFO8XKj?QrFR zUi=IZlm9?}m%kaD2v{6I?P2)^b6$lR`9%pBGy6mfIQT>|^f7Ed9gv(Iv%&DfLF`(q z>Du*?C_G4Z*(uB%e@}aCb#)Z!q~C-DhgzR*=HNEkD1EA(e~|*EAM%Yhy3;XC-yTD&I(;% z&trhxXO~R{1*Tu`NgA~d9u(<-;7_SG9vL_G(K~XtLc@hCPiP$&G7;${smc{d)Zi4c zNq~x%fqZKCij`kZQ;tqsj@)Qn%7#5VYF%@J0v70b<+j$7(AZS>=0$!wKGN+{Yq_^r zi$CWICGZn3g=au0hRp>>$it9V@R1Ermd7=#IoswlL1sOu-jJh0r65l&qU-9A_k*cz zZpE#N=vQAdFBkTNXXB*zx22cab=p&0fOk;C(2TFE)@wcQB4yvb{XC9*P}6z6xk<&Y z*;BwrHLSMmRITnGBnFMZg^GVr4lrlmJpG6`?0WuNCVu+8Nr}aY?5E0$vQD*XU}wM; zu_|jytVSSJ1J;*xoyYx;UHvQ3ma-+UTP}MaC}@3zVZF-vdn_e&T1lemGESh-wrD8k z7UDfVD3P^qy6vC2evTh0?UHd>`8|ea*d+ghhQ3z`pT%OmlACLM>+zX@Tvpl#?&I5b z@Kl_nI9{s$!QLDWt7Wgy#Rut7b6}sZ7fV1820>>O)Y#{xfTKX32Y_nT6zdUYZmLjtfoTTJ3Z*7Wz2_OncnJR~VXU@+Z9G;K(so?ImR94;5~V zq%ogT2QbVWTSv~wFQo4s8pmUN+aE2l+)*#09AJaNJA=^r_8b^cK4dW6AAvnj@4R20 z2u2-L)7*}kx9Gp#XpNuYUdZnxcKQegn;~Eiq$SknHG{n_*$Pt+HW@dvkt7fpenRgd)Saw$N8p0Y`6v-#u_peG2e-tS!5{z?DDo1m#TneY@ zx-Jup@4Qy{XUVI?E%7vIy#ZN@R!&wKua+_7d!R|E7~ftHpa|Atgk8_IkvpS1!>$I8 zvstW_J`RqQ^wt@FE;Umb`k_xEdmK)$8Z=GJQ=rdE6)zFOhc+2mLMzjM+YQgxE6D)M_y#d_&(+bJ2m}PyCA}p7V40NNFlZt4C$RB zYwLx`Il_fz@g1x1p-3gEUD$X`Uh%+~c~0@i?Qek%=W93;e2;vsBRUwwP#AG%s_2ri zX8dSSiv$`Bi}drOEVIDbtLWI1WQRT8Ztp)QN4vueRq@@l^FtaW^3H3OAJCmi)2$5o zM8)D#)(#~Z6V$#rKgZAaxt6IDJ=h_qUr9+>8|A7KHGEJi6n`>ajQq2JU0a$k7o$P( zQK2faR6OD7iyHR)Ft`=!N$_NpoUORP=mTmgLw9Bm$^BOul*wN}@sg?MlTw}UHJ|Fq zC70s1nzH86NDq@xn@==U!OT}^OL>bQfImu4w~gPn9Po&_FlE}$>|0bSSg`pgmcPvx zX=4nMTwNFx&Jbp8b+~y!KOg)^<`Rq>Iku@4Bw|z&FrTiAW2C$$Yh-kTu_YpYAKUvm zh}m|Mixiac3BQFIsPv~}F`Xq3-b!FdSL6B$XBu$+BzgscqAbJ^yOy#xQjAUXU_91q8Ps8 z@2^+f_jLb8+l2jl)Vn{%PDnZGrV67oL1%SP$$q}@^VA97q)qdxspp*B}XaySQ)GFJU*sJuzJ@svAYdYYo~px3LXrhm=-fugC&) z3#-8JNCw%V&3tG@&3Fg7k!^<@M6Opu=(2K3#iRNqHK~puE+ub&%u#1JN;dC{>OUpT zcRNp0w!NXe@F!1K@FMv~{l`OR*aFv<;nnK0eqMOMj~0n^nD!{)8lHzRXN64I2N^Tz zuW50Q*S*L5yE2~**Ofk5YTAm5B6VVce?sv!{Y-I9!lGzeq9xjav*3>+nt&r({ym~R zJunq&6H4e16FJjCWS(K37MM>3%R*zDq0ABiBH{+kdrlI=@tL)t#@IyWYlqrI7khY3 z;waq#ZKRne<4OkCt5s&rf9^@0q(}rs96vk#RLwfD`uXsq++OW`btAuZ$V?DzY#Q@7 zZ$dXX+oMHI`z=ho-Rt-Gtgdw^4_>j6mnVL+EXkJWxe+$11j4HtueC>`bYUA38hjtJ z^y;6L1eZvs^7vMqD53*V0mt}(4})Fhhb%29zUThQ1Vd7E5>z6!9~`!4*7J=l?gG=S zGd%#{)HRQaUL!=~TrROp@Z&ytE#+%8ZSE#)IQcvkHpXj$=3X>9zBX+Xy7y64_=8RmX zHvo@=X|TMT$_%o0Qu*NVV6_~Pt)YAbOdEFd?#8|Ke+Z{|#;Tu8y=`}vdQ-TOqWhDx zz-1iNW8#HA)p?8Yj;LR|VU|@xY7YkoKp(!)pySII=c*skEYFD}6QdE_gNbBBaZCnqfro$FXm06-Ifd>!Bq1yNLZ$mpv!vk6zsms@cQAq*;pMR{_{i zfV7O0?Di@-#Pt2z5*;?0`z9?P;EQZ=N8G63Py)mFYmddC;fWlw_FhBU*vb#t9Tb>Y zA|)?5%e1?tDr=^Gi?%!!RTAh|+A+f%xBH35{6 z8KYP%^2MZS!(-3}9QzVS30fYeUgqEGsbG@F0>Ej=VgV8->E=wZWcW0J1!1~hIXrFx zvZi*hW!jiLuw~LIqa4_-_X4S-9H`!fRym9-ed-@!CCo18Ue13LHMb%Ns6nO3hL_ZK zHvWFZQ!gDcWBVs(;E0DX2%(hs$+ihTvgwvUQhVKi(hjpoOg(*?+|AkP(^&}oLi#u* zC;@#Rir{5c`b;}A+y`of8Jbw6uTtT=YMrv3S6sTaQz>kd7FjcHtI+g8m7<;J7k+*L zeng8()xIyOjh^p-QfJzZQqH7pS25u$UmPtxOXEvZoN7K-Mrx#Bi-0?cw1?)x$G#{@ zSqIj#?lSL2<)0*}Q^*H>r7jk~SRp*w#Yet#UzF2OySGEW+mkXN6kG0LwW!pgugN%1 z`cV<3`(h*(8kL`8<4jC{g>F$v?Q^2HRE>!eF;*onp`Doy{1h5oWe+Vx@A8GH{hS04Bh8n=AcM2gB$f=v3kTNAX}ow^VeT(#E(ge@_U zu$aK7CU?ldzfva|mR@%v#cYfFNgLy{HnSb)t&D{UUP9O@cDSJ;2fbRFJXA$QjtL|R zg-f4DZra1nI?73HV1|pyE@_1Y2c9)n{!p>SX{?k3w}_wEM=N8_&uQu>p6g}ckkWUu z7_;tHx#d@v7PwHI*h^PciXz+tEv3ZPnQNJ6c~9(JqP)8`z(krFcb@WtERf~NQmt82 zA@&{bvmWj0=d?xM{V4yKs>&$;lcr9q71WXfxiRUBm`q8RDfGDzk&*&_S@x0w92v1X zSqO5=h_UTS&1*UPjdBob!CQi~>ANEf8RDufT)np~L6j%eb+Lp3L*BqDPM0`SEkXf= z-669;**DhqM)r&i>XT|iRJgyW1;SZ@t&g8f6l?73@*ukN!t0IijU2QdM!=8yo-T|| z^QT%`Dhvu8CSG!Dj&`6>hrU&OXpFo4F66QjV;Py4!Y)voj#u1>B$s3tc3X|XY`+M4 zt8e6D9*Y;sW)RBFIdvlzne$IIUon5eim$Ac^IBU|=gg3XLOWn^Zjf;l33#%G#=L7U zWxYmM%q^~y;hydu{yz0x91U<=jU^Q@?lWSc^)Kp#zgKDDM~`_#*jB@S_4>4}7P7!c z&OEo&Xii1q_YB9Sey-FMMp*SboUm#Iq6&!YK}xG=<~5WEAbu(Y5ET^yGwpW?Hd>Ay zELdAp*}9bSRIov$l6%AjdqFL9}}C2<{~V8il_#}HPYiJjv60Z5XncJDwDx_lW?i$4oE~~d7aaM{MR}*XOl7gXLLjGl0{KI z%%2ZX)5J@c=)`?-X#feEGc$j_81ehzKaQRY=D6pfF0-MCwOUob%c&s6*2Jd5$JP|P z&r$A>44?ntcWQj)J2H7^E}S4AJ`b!Ikqy_@d`ET1IQ>L2J7Gzklz^PH!s+e7k4@2* zgnFgXwolhi!|goM@m`#zY{G3!9>;m;mR(XZ!JtRQJA5vX$psCcr!mMhVr z=N0~IxtWm0Dv0G)NbNke=~{*US}qsXTqAWNmV}cP^uHP`_CFX*_8)_pYy3BZ$wCYk zpZbVku7OS9&8nxZ|31}&i?8s4<7}qEgHM#Tk(o^XNhSOXNcDOL&K)oZ_-req5U~ZT+#uaz@Ql14a$t-{+2~rDaGLp0ADbWv5Mn1uO zMi+igN4u^RWzLgLvjha!au`F0=t`Jb3rJuE<3sDUh$i9(w|yZ~feQv}$k!zf84x_2J6-HFb1dYM5X} zf)`}ttagR92}g$-nBuI$lASnrN`VB1MMO%j*pc8m_|SW(6<7ddWw|(X@b9Y9UC$ZJ zehDe3Dt3qy;eUO$)A)aUCRqDFeCDqAkIyh_{x_dR4gOD`eK-HdXYP9cZ=ZcP|Le1w zM+A30Tl7c(3?@4OF=;G4o99eN#-z@|Q^o|GCbtKGG?nyBl6wG0sXefTM;UsuZX0s4 zE;>Y1RM!qve%O&CHRRz`*N|}gM-JkUZXw7qWEcc#nQ7%g^RVN<|Ag_7ne32RVu=m+ z&c9R*Xs8=-WK6tev$+=It00z=F?J^P_O5iF2Xil^LM#tJwde8IuO4FVGD!FxtraXkjJBKK@Tmyx)KX6|@6`IAab>fI3DzWE`+nWwOUbqT?xmL~Sfi30D_8^PuH&fA zV2kUngW8E@3j`RNT%*dl_cOAmkA4yeW{BJQTO&)qP)>m$HL`lhyNXjY9#SH!5oo|> zGV+iTDZvdXkyD`mP$Ic^YF9wp$mdWw(->LE|A3hO{{b;~o&N!1JGHR?MPhl7f93x| zVz&Q*#9ID;kl0S`eD(?^6X<4bagB~`*!40fJHlN#yM2awf*ixY;7Mt-n+ z7(y^CO}CcxG*lKkY+sw~{Ae4p_jOD-BWM8_z9Q%V!TC0KNDRu6$kQ$BpsQh)($d6$ zJb9|(Dv{IOGsDLo_4J1TL)fxls$$4q6olA<*4nt{hgon=cI)Fy3eIM5PDUeIIsKah z^kp>aly%rvsbW>I8=gA-;jm@-CRcb>cSs;t!iNWtk-d|V?b()WkE`iR?NGzgBmjTI z6G4iF0DUY3?qeMkA;%S6t&>=5C<7%9xC14`I0Ge8QhM`J*VGv18e&M&dXTljKbjAO zbbCOKr6KZ!=tF{bHA6lg%q5#?^g>|^~2fL1FFjUw+6*yt4ulKrG0hn@F!L!WQ0`UM0$O?yVsYg`4F`S z?8jEBt-0M)dH8@XQ$5Wx`=vRjK<`y`@Ue!*sVCz94gH1?=)e63`Vsy@Kazh;Q6&-t z`dh60Q9~inFLDtRDe2;ZKBplP`WN~`3vl56g?_ld&_Dez^lQRP|Al^_Yas*LKh!S` zqCEOb{rrCu&FL@n^CJunnfd;O{;I#wfApWApF6bRza<*vT>rJSlvMj4i56M_2{cLA zzL4bgYAQRZ)GkkSAmp0<*J!(){~wD?$cO#^USx(A{J*0O$^UP(!C#?=7Em7@|AG9W zV8cc6N6niGDS>rk>O*>4?RO zRF$m7d@S@88#AryyvpNBd%P5OT*0!uKVe5WY97{7-z33w>(EA>NDY^HmmRX(-qajd6GyWIS;GdA-a&Ri zo*+9QRf)Q^^TWm@vSQ1nbn~gG_U5-%56wtE2HCX+?a~Cf)FyYHcSzJr_Bn0#e+C7R zd}7QhZ%};{N2Ob}l1X)*kxTL`;P19NKd~`A*Dq6-XHb}DYGpcRK zGpgtiQBkef|HU-BN(iQ{RP+BUdvQp&5abv#Tn%ZN{>8NaNNFqf?2t+SMQJ7ZDZ>dq z2FSRU^%&c#kZ}9BBDi+kG6dXKEmVQJnAaPI+g6Qtrd+G$rx?gTd4Ir{Xy8`a=*^0- z!E}lYQ$W2{Eh!=H(>J$M!GqkV6}F>Kan&kQhPd-L&TJrY_L}lFoju(h50YlsY61(` z*IqkGl`j}AS}P6DgH@ieDLs>tR4MWyK?Yk)I+FP0>w;UA2gM7(a}~g$f~@Rx%(6~x z{aS(kxW)Tbb=IIu0dV5)0&N)migCG|^T_IiWEWGW0&6DE?ne5XNJiqgG379O*Mrjv zgJ0Id#Af_Bcd?LLs&~8Ynf1PGYdgII<9tkodTcJX?CNBuT9L9icp%Ja(Uo3&$V|BTA+@ zCbi8&QyB|aPhtb+cJ3LK@~!yoB?UasF7IF0$^pn{4@w{d<1)3at=E;}$NRa)4x_iG z*zq<(Yqch8x@?EM0M3T%tJL(LYN2_zZ`bsD0(P^L+72tO6N`j!(*b_Dib(%|edGO5_<==2k{(QQ>aMquFcP;Ru zPS@d2-|Cd{N}ut<;@b#=iO^{n_XB(6p6%Y9F!W$OJcx@=dA^ICn2oEFAXoFHpCvCP!k)6zdzd8Q75V6IHQyM z^?|B}Cz<+9@*Vl7_0T5-Xm6wY<3JC*)ZeXMirH{w`@kPWcI6S!&C%0=9ynFMt?(Lt zTlL2Gr8XQ*GB8Nysj03gi?fYpixF5|{FI0Ki&WJ# z>a=ftC2r1#v#aJSIwz@W?Bz~lXfiF}1OnCQEdyayl|`f=sO z_-?7`;*sfXp?$x`qvd=>%&qsEAIDeXnc0Q?Nni=lRm_51ENMg@NU{mNhqwWZ>55I#*ZLw-tPq;l&k279u&IW(l1q0?dq`}6c+c)p9KAJ z(1AW_W*@(H-h6V`kL@N&wNu@I<+?pD^;P4JuGm|}o1=dBE02CA4d+sMasKpH@|u=d z3-$iQO5jc1hH+s**#_{(FU0bD7C^6ZN1S(c0k&g%{!CzG^B<{98KMZvLfKs;zs$y(XjFmu zZX;Hc78K!uq8gFarYKKS0mahZNf`scO?a`v9)}=qU;p_JAH|smx(wwiBb@W`BK=7Z zRG7VobqOkJ$|}34Fx!@C+*rmhK=`^C=@I@yGOo<9ol>CN)7MWvKGc5-vJ+jisRSFA z5a`SMF+Ob9+I0{4Tl+DP{=!d*7g`7IersM!Xfo9|X=+R7v+6z^l|$4RY;%bdfoqd$ z=l5XgXR~1$KWSQFbF^q*=#{q9&DivV_EDrVsTmr?aNZ%jOSf)Yr)I;yjDH*Z$2ZRF{AQJL|5Z08Ibbm_SaWshy9W28m{+Yt_UR8s`r5}E2a`?(E3}h zBqUAq2s<8OmJrTgz9NJdtWZx>jWCOMbeqVIYEK;QCzlh!3*RhSIwh5Z0N|sZmdZh~ zr}=5un&jXjn{*;y9-;kFhO#perOcgrUMh#W{H_!%mBU=Tk?csNl04wA;RI<${IQ*> z;$_PMYzkk?X!U6T`>6pW1;At%Dli#?T8U`s2IS4HUlGqHaraq5D(# zRkUXoeb~&=LlPsYeWh=a$)?Re$A|)KOz>cbKN#DMtXbfJv zomv>QD5aTxSb%QtI9<$jXz2VczpG{gL-ykGba(Z2X1lH(a-h)Dv}v!U zPxKs6P4`aCgndDMpVI&?YH^pD0$Hoy=0Jf*IpV@`GP8@x6RB~B(1b2X&8FaDO@(V5 z4wN}!_TlCVcpZ{44@9-^41S+crP(#DjzHZ^sVxrHU1Z;Zo3cNuHqvbl5q1|Ru}$_V zeoZL#q%=19C74~geQ5~y2kW{DkuNh>AC%a+7Gs*exLFzx{R@}vrx6E2*w1F-0h5Ye z0s8l`&iFnJ77dE9W!w8ODmfb&2y)>xb5`eSiXLiC(4$F5Z@~Fv#~U_+!PSIyHUOd- z_W0EIK+@YIfuNOqR|99XgT5+mnf?9rSZzC`5EBEO-J2B8k=2NP*5Im2^e_TDn3|Yo zvWKmy14ViyLo*jRchuJ3SRE2?T)_IBXhX_*vXp9(??o5$P@G8m@{3OX|w8IkLJ`|?=p zXoruKHd309v6>BsfUINQc;)1PIh)x>ig7BXRoZP{4Je*tF_Vsj1^U#P5tr-?piBzO zIc$OvN^9S~N+MmG7=B8^u=Wt+BpZte(#F?U=FGKf^;(ZB-SMeNJZTK6!iX;xo}R2; zwc$!5N6Z#hXm#71uJM=6&N3ViOV`%Xl8?#my zppI1LfW5&Icog;ZC8}TAy0yT{IiubFcN27`hk-&QL*F~qKW*mhn}1+f;fFH>NH<2P zQy|@Kw|mpfM}8xUoD`lkjK9~Yvd0Ogpf7P=^~}M(Qh-CH5|3u`+)W08NUs6L`GCL_ zX&>s5LHQQ57}3Dn(=*noiQI&b-&F_6$&A_*fs@FYIlbGc7OaZ*UmPP(?mAc<`f$40 zbolOc2Ol%8Xfemt2@@DtHqgw{Uc1J9akIX~>B;0uwr0oFcSX+0w-QO`aI_Lt&`t5q zPe4tXGQ=eG)riKbW#2!lnRf#coig&mHO2QYu1zG;=og2gVlw(H1m8g`2qWVYyr(K@ z2LAcI=yDt1NXdcqizra&gJ%u6!H%&3gGs_`~`xR$Ls z(s_*nHJ>raYmTMV&4&*#Z-Vi>Nq%Y5XxQaWNovhIe~D5scjZUa(&$*G7LVvzCbg1X zw~5umzqdiX#P=p)-_=>lWvAAkcMY%#Zfu-Whil`U<}~JwjdKdI?SF+Qp0Jt$vYutv z>Vqc43pnj~Xwg<`RT6AfSXmI97YH(V&8BU%T+mkHBy%V2aZV}1_${XoV!|bJqbUG{ zt({3jlx{j<@6wO*W}xH_x-(!7ZWw>do+KfHGeI?heT##S#k7seb)^gcGG-XRE-eKy zmtBh%Z9S1HiKugJ2OuDJ?DaUg|n*j zD}1Njc!7zjskQFRD8*sW<2T%goo&zS%6NfX#MOY_OOA$}*Q)$!Xn&w8f8=)EWBa>= zquP#b4L;{fA${XbRUir6I{UK+@KQR^n+UU;_t{#M_(#Xj(V;Cwg&mW5I^aqG{F~P5 z6ZwGU#bK**gHrFC-^Tl2H>XD_sv0D89q-U^6tn*5errqnaz|}`9lL7gOLli``_wz> zEyw2Qf`8F5x*)fmsF4e79^so5gqyvtLlbK2Vt)zG@$ExVG48npse>8G_n1)zlm2kH zlq0@qe8Y8SRQ0UXZa5&;v~jld7ReRZMQUO17-4>C=|j)$HY71jApsracOYYu7o^(B z1S~Tpu|_hNW+!4e^UDX0Me42w9`k%as~^1{-T$%_Ry@lHdo!+nQkI)-zd=8=PqkUAqWGKX zjrQGxQxErH5LxEO+2Oa+&jpzbdCKF*-!-2OvQ7PrO_(|Y_~HgWb$tBgG3kA*9H*&6 zB2!QwsO!>h*VEYu-0VSm67AvvPUl_-i8@`%2;#y}Ok|)h$!vu=wENMO(EJhh{mlZl zcn-Ip$j!?88`T=A)!Bi$6j4Rf8r&ZvI?Pmy+;Hlo0%gntVeU-em@@`Bjk)79cR}m zWZ}T1{RzC59=UZ&b2?MUm}truOF;^8R@Ic(Lu+kBLZOr+;)y9Na5Sn#h=7P<26<)M(qvV?e+iy&bf>~uqz^;B zrf&F$#ZD`H8F4kn#wnRWJCe?k1D|i6zZ~nS%CeG>;Odb#(but!5wP(rqH(HPg=4!K zG`26dFQYW0jnra1)zqnt2lX{kI=2^L&xX)s=2xJc6v}5c)`a-O=FxYr-fX`5XSq5a zEyKVbG^!Y68w(6gvz0qK4f8M)LS()-%JcdV7^TWZq?{}YESIgUp7G# zm>IqD>4^Lc%tg)FOrvG{1h7e$Puw?*NVllRw^oH9KxE~F5#S^bF_Bnr1a!xSe!(7~;em^hc+0nEIO-L$Dc_+? zVyW6T!+Bxa3;7WfDLZbX+TP;j{XP+}PLQ^vU(9JHdsCTN<_+knyE?~@7XB6k#(b6` z9`jxOoP_d$M3V@gWCwK?ZzV}i#R8APEB$`=A&=~^Tt(4P-hoa#dBNwR)98YHQ>cl@ zyQ{d-n~8EW&6fB|e-AaeYp2tbDKSg9Z1x=upNP1#zk)jpm2eUGV{p`mPg&bQ8Rps$ z^>9HE=PzMf95{{8US}ptSZaWuP|zL=Q3AP>AS3hvyPgk{X+CXBXwo;?W}XGJ(Nv!? zcanc7Jn^$1P2h`P(CBg#|M1GN^v*QiUq`MXrP?Yen#s(i7{SFQQ_QO#&$|*qg1LYl zGR^kC5_;YXcirT)VtvP|eR9#MlWAE^1%`Q=BU~Dp_U7TC2N(fOHev4{Pjy+WM2w!m$FNNjYq2zE-oi< z1f;MN57|CNNxh1tNg}m49VnxKek@tyBt?CV)?w^FsWP!XUoTz1@Ka-(LVn>8oGcKY zm%uEF_`2VGW+{$?TB0O)GKV5m1(oQmCj~dGfM9DKFl|t(9ZX|rr6nj?Xwdj>P0Z5T z=Ju$x#5a!MM+?IvGq>9;@S!hpws-m%sf)|BVyK-9H`|w zmzWk^sXlw@Ndd|YJ8p@@ORk(h_{#fk8a{Y3p1-aY;=Occ<9=?1|bSQyE(>5`$`FTAJ5Wk!K&$J~qdHOt# zNK1WWE^kmsSX4_$8P&LA)6+x^w@=h^ILRvPg}b@q+aE-N@$Q}VfQ!DugjD3A_aepn zTTavz3X_Q(r`j#p-cDoEbw`?o^S>#xTU2mtZ}wCob{82O#T9333-hY;YN?2BBynuK zudR2>lw?ah*7R_cfWPgl^HtvtCkOl_u!-4s0ygGB1_ky&<2toB2KW88jr5(nsLkKU>hx*V)qcAc@*KmK1mo>RmHuxJUr2Q-i+^PiiO1h diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index 39b856f72d3..562a8db4734 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -1553,7 +1553,7 @@ "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." }, { - "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", @@ -7233,7 +7233,7 @@ ], "metadata": { "title": "Infoblox Incident Enrichment Domains", - "description": "Leverages the Infoblox TIDE API to enrich Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", + "description": "Leverages the Infoblox TIDE API to enrich Microsoft Sentinel incidents with detailed TIDE data. This playbook can be configured to run automatically when an incident occurs (recommended) or run on demand.", "prerequisites": [ "Infoblox TIDE API key." ], From 8b6937194dcb71d8e79090c6ad6c5cec8a288468 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Thu, 24 Aug 2023 19:32:00 +0530 Subject: [PATCH 47/47] Branding update --- .../Package/3.0.0.zip | Bin 41895 -> 41892 bytes .../Package/mainTemplate.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip b/Solutions/Infoblox Cloud Data Connector/Package/3.0.0.zip index 7d66242efd59fda6ae9fbd2c962eb0da47a3f1ca..fa819f766a6470b085df2885850a15f651db21ba 100644 GIT binary patch delta 14611 zcma)@1yEdDgRKef?gS^e2X}|y(zpb7cW;8b1`jUXH16&W!QBGEf(H*0lGnMn-pu{~ znR#!hTI|!Ocb(l0U#-2?>1xm@Z0RU$oi;kgZZ5HIdWw5sas~_xcB46Zi!m^=mgI`p zVz8E^+wWSV+n}jOXEE+8N|$P&Wi753KSGs-aP~^n!%5wEWzAH#kZ0F1g2So7Ln+nx$tqmawTGA-G_BjOK`eU{JRR-`yXFV#R9jYYM&je z!fT%|y$Xykr+=RItobkTPdft>YJVtpI4vIx`*nXaojj^GBO)6a4|elSx8at5t&&1o zdr5e7m-hw6jZdr#9TlYO^+nUJ<^9ZKPfq3ay#GKG)xA6)>Agdzg;C5oPbAF<63o}Z zoJcGo?AF8^e zw0!i-2=pjdBW+$88NT<2+|@pJQEO%E8tTh$@_tTGr{`u-G(j-~&hGJhRMzU^9sJT9 z%&aWpqX&2F?|4O>FzrX&OKtlB6V`KExt1cb-Nx0JkMdU#CVgZILmy&))4R-sd0N{j z1eKF(Dn(#o3mg$|@?W|G=Zl5OSEdKQCZAYWhUcIcPNUV*pQ*;QS#K8!6SBNh!VqNg z^J+r6fH#hk8$7xX4Q~9DfQ>!zoZR(b<#%@stog*z?E8VhnBev%dA*d#^S#NhjmP2g?)7QWV>D#fC0xvO?wNZBpyU_x?m6a&_$Es$mUa)25lg zInkW<1FfQ540nVgkc8N2Vp54EQpnDU90Fv^%<+3P2a?DBQbizBR_|@YmYv7nG_Y}~ zx}B`;8u2mX@94aP+~{hhbG&zyNO#%$ZgSTj``+d1RVA};&u#E|NNoJ|PW@yG$&ZD8 z8>Iu-k=)de4Vg}SAK3N zTe4$*_Pu_e-dq>gbhul~r*fBute=G1pH~HzDAw`Y9KXm#Mf_AvTm5aImX)@YSDmiXU@KTIUbdUWC3o#W0n<1 zl$!85%R?S(kOuem&j9Td?9Z+yb5^xT#{3gi3d7EV_5Li)J9tZa2J_ZaUxHjtf+-MI zMhvOT!!+$gDwZqnY&C(Ky1yDcRZMmE*qsL2$9eYHfo_#xnl`xB_thyG=-*h6ziack zadjRBF4@~)E@`5!e~VxI3N$13KHQ&uu*5)hZ`wO z3Pn0xC(cr(UD#4evkS`mCy(C?ypm>LLT$Iy-x=0ZI=B-}f#VM7d!uT@m8(?xW;Atr z_gzNzCm`COEBuM;*@;hnC*TL`QebkesBj*((nEf_P(jM>8e@I}EalD`c#3DRQNtq0 zmoL_)VZ2pDWYoHFiwc zp;IyVy=VC|xpAUfv6&deQyfkm%?y~Vr()rOOXrPVzhHOKV#m?e8^2fUyWMpBTz_n|FB00oV(|$s92@_RZ!o(3#xA#N6=;AY zH;pLuWg31dwi%oZ%tZHkG$s}d>1w1BJ(u>cfDf~s=crvbIo;7#%vb?sU}Mz9ZHx?E9a(E;|AO0I+pc=W?&B|3*!KihjTn*I$y!VuWo7t_x_mV&+m?A}z2+`6=)x0lWLT0N=2;=l3A89AO@!!nC1+g=0 zl?2o2DSXep+cf5Wd9x9@J+h)9zvbh-aoSn;y)Vn;ZudJ0Nkgy{hH#}ac-@Y-i6-1AD9chPRWrr8T4g&QG>~dETT~a$b246F`j}aXh z5(#3S!a7rEgOXQ|(Pz`wZxa#p=bY&>^dNAY;G{rLL;eYBHm}uS;9z=VF9{z_(g|+6 z-8YuEj>8lLNm)PHwX34N3MPhF!}h)#`r>1(;cUJ{!3n)Zd{kGq&Q4QPs*8U)Y@@|M ziA3C+t3JCE)Z3?lWh845FV^r?imH@i=eimQA~yRmPW1GON-mY*eXzg!?7JZ1D*aKN zMosO|>MUgj(NdL9&p@q4OkH94AG!Y-fHLOk@z}9 z-7Av0cSkTVf5n}O&^V;zz?H0He~G$;e0b;J9w&Y(rsnP8uy%gVn)HsWj-^c`cfNW zU+GdZWF!3g4$(2Z@aGS*5Cd11ldfj1H~aL5m?Kyqo0^YoTNt!)zgoOW5<_`Oh-{qj z%kXjp?j#*P`vR@&E$cAm=f5L?dOMFqDp@f`+pAhExlk@@jS>%E?-xP@@J_(%ciOH%{>Mp<@?SUBr zn!^3vsoCQ5&rI%}S8s5cczU0sg}zrN8Q|1Dwfn=Hy$u~T*L>^xNt%5OA}^?2IrP@l z!-V#QAgLzG=OwIC!*)mnd#wR9#g|U0Q_voH+9=C#xJAG{nZ?kDY`@O14(^x-2Ix`<0Vnlz ziO{}~ffE)-nFbKDGTDdQ!I+tCFn3iKFc$;-POPsJ$4`!jJnE+Mt-d2f@8(T{vbfuw+5N^VBF7xYgJ}MD5u53QCk6;j7&wd*hirSZ3BRcHVUPSGe z&W%ay80aOyK;y6$dIt5``-G_MJcRWQz>lL@a(}+)lq(#He0&n14Q@Payz4?Z0wI`b?>0+BV! zZ;mD5luHpD%xP@Kh-QeCGGWV2<)PI9%Vn|*<#eC4xOXRimv6-5kvMyCJSM!$ySk*> zmjZ~xEe?q(^+-wu4wL6GqEHF$XhI$ZcDP>qlx_dqtvG z#edT0uEvL0kAXF3cpb18L#EgnbI83lQF7iyPR#Ktu`cCeRPelw#quGiVfCH%XJ{@IR zJ=}e6N_&jZDdeWfLzWeW!+?FB^x>CzRP- znomtE4e{+GB7hG{o>TW|Bq7oIKgzfjP<^W0hy zXyYLuN&)lTub&18!e8-J#-ak#;V@If?w-6kJH$f{bS|{(k2N`Xst)6u(qXGtpKTDI zl;V_0Th&;(-?|sTn{Z41DEqjk%5cLNSWeiKDFWHKmNBC>H8GG!{luVX`!<{E*6~QI zxQ#-YTaGENR+b)JH^ zG;h>n8pNIcqcaq&A%2*igsMQVcni+_hSC#&T_1q`a-q>xik^898KNRD$4@=Jm1ad` zEyq=)MKQQ^t~z_Vg%^A#-NvUjztMv7!Z3xFe(7K^>UnqPKgTQZZC=>O5?-rYu~7yk zMM(jWjcw3t@O6o^$BF(%_R5gUX04ssW4y#t#e;Es-qJ6SJkO5cp7qze&_itH)>=z3! z7mh(Mg3rH!=}&^_0U>@rzwD!^4`=I0k3A?FXJ>X7{^p%K6`el?7Hae#7s{0|9=$8= zpFd$VG8$(?I0)-_I42B2X8u~{!BB?n|Q#u_xoua2s& z-4R86;ilgs7S3mV{t=7eQbG1cJ*8KZ*@1{Ch6S0`nstsOL1WpXB%=&I?%lnj?xetk zvCRo5Bp1149Xp;G7`5uB%m~Si(3Z`S)0o1jcNT^SnJ_a)T-!@?|OqNMbK3_+gq{^^8q@Hxr7J$6hKQlf~8!rGhk%rQO6( zK_ZNhiy>?rj|jAlrj{8KmOj63!c+9ms@VfA3E?%Gy>LoMXWB3cFqg*U&f^Z5#@jxp*)D5{ zKRPdVwZg&-B*uu(Tte|m!&v7D1-7^xVLz+wtMzJ20KCi+J-iI>8+aKNE#q}-WLtz+ z8qFxLG%%o|rUp{kQ~TjWg@7r-si`1*f6HEsn#x`fdQ1%!bY!NJhb#_GkizqtHloE^ zN96%Rtz(MZJ*RM$pcC1llSGqh@14G@8qmTPr;cJq+rNt8(v9{7>+1|jJH5v8YIGA> z~r+aib9n9Y>IAPj|C5)?mi?0bAO zH4ND6`oVlc{=9d6`J~!2Phij+Zc%kLB`eVu3w=e`to<6#`uLIouku9yjtDRaqbUEH zcr^*-&a<)(qObr4wNo#j%W2yv$S%#0W7I+$idkdmaIoCs!kI;iBblbj0`Md42~%-C z%}K@RVX7TRv_B~mRy&IcV!I%}GSWq~|2lqqw7(+uT@xWRcH`VNC8KGmH6Og`HB}~v zuh7gsqX^FDERXG8ib$#m1%q1H%{PfxiU!)af>q2miQ~z_t_WTlR|h)u{NunNXEy9V zVGFDXja__v;`e>9rxQS{#RZL@e7`6#Gs(#SRJgh)Jn@$xOcV@Q9%LTG4{B-1K!fbr zCt{Y#)n%lC0wGHV+rYvrjr7?ES0_j3c&u>oypZ%T#1J^zPA%zKm@EvqzGm6Q@n#gS z>)7y1&~o^?fc+i;l*W~jLpd_}H)}c=YFH(7v_C66-h$&nD8O{L%5za53sdXO4 zU9xa-*@uP42yq016<@Hj#b9KF`rgPt3!#w z>)}9RaAY_!I2jwRIk_uZ8XbT&fDNae`?q)tpr=1!!!1FdUV@GUskGWBF;*C%q;+cu zvWVh5CF=g0ryqVBR`J=keEj|p@I9%%E7NZi)5+hkGGU$t}EaruLi61(a z1Q6{>s^8(Cw@D9^oMurWLV)!cLlR4e(1l+{yDl`);L=?vZjwIu4?ce&21kFe$4*Wn zhih&-R)&RJ0{btIO0cCIfB0a)d|FRFsTn#*=TjDE^_rmOtrz;D(~yJ{Djb3Nd~*`` z#BDoRNnY$o_C128%rzsGMk`ueJP&4!0oQIvH{>L|0!-XN`;Fj~4ao1P)4MtootzWI zn(8FIb>QAY#L=WZsP-A&qvl_UIu@Y7(afbG!qI$Z9KKj0aq6P* zHYr9zh+e{eaB+N1CU8-TeMo*OBlBmdq%P-?qE$n{Z@+;;mU|r{u_M&olJ$=04^~D| zsBn`Hyb&L)IP1_6O@X&F=5f#F$85VL9nBJdnm{3Qk?79)>d#d;v?`X&D-Ck82{VSL z)~Gr#CdxTX6C96s2$ae=D3wQlsFXt*DE>pGN8uEd%ELcYI%0;)=7qTZPgK@{|3M}2 zU$JC`{Eg*5sU%$bUr;IgZ&VWULa9`RQYkB|w^(ngVfCUsF}xVq(OW0qJF#?G*9Y-@ zeaw%uYXA`%kHZ_%RzVx%atqt8W5S58gs4PU+ABs^=9G6dO<|j$?LzGFb|Iv=yAUZU zqa~?p8ca8BQDkW&Z6~R}v=j(E?G8PbhROpfg+xGwe14jGECJAH$q0HPfa3l6#+SS% zxgqU0Nff$EXg(uG;saII`Z(6jZdps`BW602$m+$mqvQ$GdZX}WItflxpCNpd163#D zhuSIroRxK%*e#jKo*dMXQMy7$PVq1Gwh_9&0|G=hMV`)gG@!S9 z@Ck{t=?N=^);riLPh=oq!H&HfD4_g~%QH|u2mj)8@B+%`keTdjoguTkRU7U+L^nO! z12?~6hd2DXF~<)SZhBBY-Skj)>y`^ur|EZrb%gHJn3XME`$X~Ap&BO4X)i4>YQzV_ zUrq+({Ul%O7!q-%CY-99(UJ9*bEaa*HS|X({nB^*V9nYMU8R)}c^%Fc3-G21$%rhM z@~?tAWY(-bh`0WVr-+;r?+=U7ga66mZr#7K2!z5oWcL4nQK0G{F#aoxn3eyP#i;)U zi$iAr$s+JiX~c>817poD8T6I#zScnzX#h<(}DG`0TNkzz{JEL)61vtZ*pIi-~;pn!pi&53ViXLPF&Le~;rhsBo6%c=Z_<_<$WBg-7UO7~K) z4ZzZ)mWHn9=r+r;q4R20N__#24ezra-A3fp3eQ1wW2``BbmK|=sAUKGZk61`-c{_1 zf^#Cyf|=-U6`w5oZWZp3ezj!YCzT<6wtcBj+D?As9K^#2C2atD;PVztK4)y)pAC99 zRG<>NL6?$3H)sW3=muR%8V?A=A%||zu;b7TTA=d3+n}Qx?JFZ0n&51ugiY!H3WhfS z2!{IqH5fMjGZ+H@Eg8D${Ex}-llH$R!#}}r`hOD)8~-gBPX7sp_{03sjY5r90+ok5 z8tp%$>tl&4G2TVt4e9;ubh~vG$kFvsr>loLUH#uq=Z$7w1>K{oNO8@pq@?2iayl*@ zsMEzmo$fC|oh}~gbn#H9i-$U0{9jIol<}9-#Y3Gg{vS@K_a?gjB$VBvhUiMWu`0TD zU7+X0dG7&Y7095`w1>%WQ)LnQ02$%Key^R2b)|hrdBZ%m`T!{xwM?wj))EjN(v~&S z9@4&BJEBjhgrw2macL_p`kO*BCj8Il8$O!yj9VV(kjOWlDwAt@VQ~Sq$%X+hdEWSZ z^YS5O9lCk|OCdc-V7Ql|=F+342Bqid^51xQLGhCQ8?VkkcooGGL!ygL>RT;4(9FSd z6N8trnR3pFSPNz%=3ppZ=HS#0Vn|_F_OsGRBojHFOtanfejrV(JvC7=*nUzexSyDf zxTFloz1IC(#4MgLpc0L;1VIDfWIQCmQzISWX8SW|K!Arh3UQD3$)-Lcrv8>t1F&U4 zWs6lPs-8Ye0o^i#&pse5r{l;jLDQKn(rmbQpYrM}F%{?{R#GJvRjd|d)Y!Ev1PqrM=(fXFyqfuF@TbArhMoyD})*hEA)%wEV#vB13ddZa00YU zj2M&Uk~zIjw>0Dx5sgocXM{{o6>{g(14fK-nfENLNOVc$@wKDE|J)2CK)HivMRm$r z1#nU)U#x$Fyb_p!Xnx>m{K5)HwwYVM*)fWhPqypi+X;>g{t}PFfeA2Eg$Z-%Ag?;_gIg0;uj>7-8b0GWw zyQSSW{YTe@7yU1mhV1`OOM3ku zR0_y`1_~xa)cX}kX2^a}`2JFk8uYX(vL6&gKYQqiI-bIO*VTY1iLrVXTD)e)kY1>7 z4t{OiIHZZ}m!kxoG_wb+4BF^STaHc!?bl1^>wFl>a**y@U}b^L=fm{v*cRBaBl+~F zVw4R0sTeyI^%(FX(1y{c1#K9+8fcdvFJ8yJ@7Vbf>l}@+WvE=~rz`l5KE;@l(-CGzB4h$C`pD43)~;saEYuyS8h5 zvG)&WImsJnSM9X+X;zse>lO_5#~)?t7NpqWh5xD$MF7r^e=5YC-+(&vp9=92H8c-e zA-@H9N$R? z7#W@5uHlBhp|pM=EpXM&s=B?AVn_Jj~VQ@71gVege9_95)qA!>I+ZSafx%P2ehiup&;;f!=k zh}%Vf*Tkrrj+i)#`~2@o8`*ryLE&`>AM++dx-mICEuvIAy-oMlhnqwNi`$9)1D3hB z<-GCmjBjwFSK{swMA`-Xfd=D=i8Fw3W6Bpb->c`f&Q_~;@5i=pfzs)lC)u+N`cJuf z_q99ys3OGs&Rm4@R2!|Uqh`oCKDwCRca;O9O{@*yoLx0_1euRfQHL38yq-}Q@pc18 zeMqufXnhG$U5L%tj9d-(cD*9B6!ANmUrl9X5(en_muec1quw7(x|hM<&@RU9JnY|h_yq4J zCTREev5C&+-qe>xDiRQVJH|4EnCA3Osu~9TW2IlIgE@{`7kH}~i5A1t) z^_sIvpEC;Xe%&MT{r5T6aB3&XmZrzUw_1m=%<1^O37kYSLoq)mkH^KI<(X=j{As?| z#GF6Qxe6MlG$%GJ&y$sSMkxgEMyeTf`VR%F*UpoY*F!$p7)O;RN~HXRiyLSrhaGhr z5P9*ENSzDf2n4$Ic;XG9Ox)b{C*71~_Hz5szo5}AE4hF9?Zs1C(7}n8_b!J;Y)_){mOGR5157R|ZaM@hAr-I^!J=wFIuGitD&Q zjGU&rwei~mv7S5`G7-%9nh$$v?-plZOAjl*_XJ|JQqu!9I)}!WRlSlom5VW6kuvBc zY2C-6V&Z?zqnFet{4qX@9YDiXlwrBaa6X_tAgof{F15*EoECMwcl3^DRU>rk>Tvpb z*oy7KS-Duy4{K<)HECCLoGvHTMN2u(sLLZqMoY2pt+7_^0@8SztujU*$RTkSMQMvS z&CV5&H~Alr&}!JL^_d6*77g5e0?5$6 zdoYW4RC@=x_A>ZSa+UJH2P-r`;^^Ovhy^On15W}eD_MD>}UF&8Qb2F#_} zD85V5kJ?|trn8Or+G_d6mEND7=j(nzm~F4+5)A~}tsz=B^FLwdE-^2o|BxjbUML=( zvUdTf%ooWc$j-Iuimj0!@Y8+s--;qoE7ybmw+}2&oV&u9MiT|R2B_0`_~zCLlw;;&dFf3KfalbU}L zDY6K(PU@>>?X1)>5(E&Q9AI}>pzotr%-23YudT&g23U*rSViu1nUiIGL=>iqXe>S_ zJxxEzbM4Yq;5+n8dY*6>9tpPc8(!8~PCn0PAS0K-Sn1%pz+OaMTOX^2Z_TP^tsJ#) zt%_MQ_>Ea)tRMUhVU;Pux0)17xGBbBQ8xp)-p=;ME4VWEqf7FCaSdM9xm4L{is zAQKj`FUlvf6pe~Detu#l*p7~`)`MeCtr7+yoinFiGG)%UpF1RrLDW<%lII~+u)sbd z&qkaFFtl5jk}7BwE{J!qmfB$-lGqW>g+e<*0^VBWo@D!l{fxPE&+pMa$(zMbQct^zau}0?)p2%H>>9z;`beu^ zYTmm*x(^R26U4JoJa0RX3tDv>qS7**KD8b#<$Gx%3zaweU^970veR@ZcY2#RHqrgi%k8{vJm% z(BvpRfc>RctavOXO%gp8s{ROgZ`>J;Cjcq}xf_ooo(w%Yev(~}coI&W{^04?y=R#p zIp~6ODLqy~v1sIMT_JYp4rB?|HUTE_A$F-XiFkAqql-=2BL`&v`jYjNwMBciJGPq{ zBRMh?jmOU4kdzoFQ8}$yoM~LN9)V7}__vmP%~Y!%x{I)PD}X#imQ@(<#%;D_`_|5< z$F7+x3$A1WJ3UjEU9*T9-rw$B{EX5xwF?nqBTR8VAG$#yN)_{jH*hmdIF}`x%JD-x z&Jf$|q4Xx~%jnPcSO(`0>OKnP7uaDPT5x?-mg%XU<}vucWO_Q4eUrbjmkGi~ztSNE zb4U?*hKjXYUcJ;7J3xN<6#e>Y+zXR>nFl$iI|ALMwMoCxmCE=k#4J*A9=Sz;i={u; zrbbpCDeF_-ht8)n?gAVPNo9ZjMMphQMKxbYrB+~%m~I~xmUZv?aLeR*MVk0=kQ)8t zA{k0tn&An%lb1)jGJz~LK1gw$THu6%Qbprf5gxg$*GOq(zJ(ckUUKS2kD6SO?AkXA z(>c;I$Tf<)o#F`dU_eYUj+H)3h1;ORc|^locwy9MRU$BI@HN#f{~K{>>d2Z_AJ0ODM!* z>FR1QY_4xr*wat#8+ZFZrPg}%Y+_o_m@xLbOkH!9;yICpRzs*)rDn0m*jlQQKWp%gUPH8XVsew~O7w8MPHl&``FyCtNhTrXI z=MRIF1Ac<)wjlC+N~%&!1@5i>98@N04i+-QDyDOv;%4dc!cpT2unqNp{dC}elGAG= zivEc%R&`URAFi)o;@JSRJewA8`Y<$01t3Ny>=U27;q8hNBOlK?K5=pEGLmwz3Bhg$ zpRSkhqyjZ%Er!125L1udYxYHVt+I}AB# z$&v{?X%*!T(OSm1~h`G5rmTVcpP1c(1(7s%=fFM%+V! z8|ku4KiWv2K`_YgfTl#s8Q93gAL%l3Id#YrbC>irmn+aicHnYqD2W+;+X!mc0+nX* zia^h4TSi*+ZRM^p=ySQix>)i#!NEiCxkAg-R6Cft+ z1C~&bBy>IRshF?1`qxzGgZy!TxF&sGVXnYN`bRDP+_R{!xh$zz3B)~XOwbDk{lg`R zd$QY}wg}$_-h4flF#&cm@=n;IHeMZBVHT_U;5tbx8hr^hYO+$Rt*vdSJlapX5ewXo z3Anlxd|VjGoeDeee*ciE>jqp@J%SNs$Q``Y3EV)F_gvn%1n2NQe5$H(0rg^pI%fv8 zi$75Jbi_v)=e%%JB6omDa>j%)opnRol`?tvVf*+4w zp6@{5gwzc*M3gtmzgV^n6gT}-I3I_dIJ**`Zr{Fa9}1OZ@V27<*sydcxf}(n=s|~it$8sl#FjM$N)H)ybi*Y-K4nEKzM0+#N5YzU$5Y&WhOdwzoj&(jK8i1wR_tJ~ z^1OTMK`Kz|)*5=;m{67kll;jc!sov)+wPpZ3EJPkK3~N(^&#-5wTx!=^7rtKUuFgDAdb ziyx`{cum3QOY;fk1D5q9q9e_vB=1HS?i@}qdDqW$`}&}PrbD7{N|5y)(FeDl+v^qH zG1IAxfZ$IXz@q%BpPp5FD@woYN0>a?C6l`-5@H;oX*+}0jkO8rUEp>sDuY~K$f=R| z)kYy%{Ad2KQ%2xuzD#EvrZt`TR@51}|7%FI45e-%>TWnVM+GFblxms>5~JOl%^l16&!5wderbzxTdm2IqtXR z8ikGzf$wGIJB%qQ%Rb_}D++bpdkCt3&t}OJ^-)d7X?2TvE-NC5qv5iEIlHu5bORmX z7fQmE56C58am9ca^WwuO*i`2)i!c{|`n4%N)MO{%zHW z85QPev}o!*ocmk!+9Mw^T55zr2Ex%1kF|ZY-yMWqtoJG`?Q44`kp#o=Z@G||IM1K{ z$}9IOQJkHLlHNE^OE`8M)#OF*ZC*buRS7a%U-3Mw!k}@o|0b=>v+0>am~v4}CG2Ge zHcpht-&GGNa;-$!_UJDoN#86b_*aiW_I2tLLfhZJ?wDt_B}A1%%>7{;jy^r_c$qqL zA&exlzmRv;X6oQ?v=d*}D$qAaHU%f2nX)0XmWUKyTA%t3R-TMZa>v$53_fug___B8 zjPe?Tly}a4QMOcMEIXMBF2MS&X{e(K@C_xR(a7BeLb7L;M31S&flQR&Y8&6@OS%%V zup&Zj*gi{&Lcd_HvT=7-MDt{i5J==*?%~#2v=8oWmjL8Jnfu%i= zK`rYVX0Pcmc??#|rKb!;pUiH?c9bajC(`R`%Z|S9C5Gh*T%dJZ;vco|L(c**Gf`F< zt{r@zuj6%Ir*7;}v>bhQx&O`Y(=6&VDDhCM_fn@;S`^>vgj^BQM4hftPu)YMQiNf* zNGInerE4c1JhSFzvR>NcRjMOJ0JL-ZmOpuLag~SXAhoZY=gjD6j5@}DkS!NT_$XCc z<9lH=L0gVlaXYLqm8h0$qPeLUjcI#FPDPVSX)Ta~>Oh50J*`T1LG=&^?+8QQNyIm# zwe(gZ9lSbDr1 zSKfi%mX)rb&j7PLavOu~?ZF|^^^i;yuFVOz%}>nGkmryq-Exz_X)(dC8~o@blL(WV z#tn-Jb61p%h5qpQbB3se^hsY{WzF%Srnoy;8e~XodU_ljpZ->8qRC1FM|k#b&C%`J zs@-h@+V%#d6xT-yJ~u1Ovj8LC2`WZ&GKk4_U8bjn9$0ZCKJ}S&%>WY6?vhgZ1 zS(UPm*vaCJWcE?>bIewDWBq$86D8Cgk-N&E?m7vai0JZ~JpRV;iE1UgxR8a1EOHZC14Wo93bEs?)FZD(`owb{(ng#u_xM z#BLz*5g!CC@2CWt=?;Y6K?9nl{tQ^w7!a7>6m-qu|GKMK5$BVUd zz}-Ifz!O;aDcf9dgOc@Ix!$x&9rm2vj$nhaNAl~;0A~^=7KQ^xh?VDU=?wo&odwHKY> zVl}c{kWj7Es>qCT+Ijm-Rd>{k?;iA|F|0%_qo;gApS@8bOuIh89Vk}z_Fvjo=O(YRh8x(xQCw<(;$ZDP$1&cK&V<+}HQ8z_ z(GwtAL`!p9UDtGHYRhMi29b76_b5RH!u^X|f#Oiyo#HOV-66PBoIr7BW5um#i#s8>J1y?T0>vGQYoU~u_LqLo zz4y#}&v|ElnOS+ZJd^A{)~x5V_D;%1kt#=#8bH`MM>%AM^U_#7=~)N}Xw5d*ZRS7) z6;JSBtUK9g$l%d*T*^sp$z4*3#e?Ry#x6rp0;HS9ifV1VM|7w?TEpTE_@cIW@5z9R zRK~OK%SmwM;uB8s+FCzUtv;F5Vl;%KgVh~n+R(hWu5+o+*tlTAWAibZ2#yH@g^ z@kk+HkS_^1l93UrXNv7`epG(2%8Ri_BU8^;)-?H0zMxBPwwB~0#wR9v+8qiILaBVT zR(u@J&vUyb*=s*N)(A;F+irTC*Q+($_%1XIIX-gi%jVC;`&;2+$~=oKL2!qZT2Kpy_`x^3)PkR-t*F^j{%8z$nckN zfCF_Izqs59|9PqjyLZ?pnNjIJAUr#rWaGHQml`)lU)Yoh_8P&*!e7wZPj%?v5qG1} zNX5i?Ol7>fRPqhWk(dCvVms-#+ymFBFzwBl{bBCOYOOzB2fL8zPy!$#2RD5Uwj%Y!G zPce_1>L|pOGG!;_*~}=*=ygr^9(el@BBXWD_PQY0tMJeF;p|Gl;sf9s$#+?eBl0@3 z7m;kp$S#YkR#R_fH2n{>=B;_5ASux5F`!_()&P-^c}1uIT49)V*0s6CWpzp8dt z^8zjSzBj4A(jAqxl=AW!t{nUvqgQ-m1O+u47(Pl-^77YqNxf4uB;HC&(tGz*!!ec8 zuth~ljlrE<7jIJm#RVD{cAiI0T*OLbF3#GNjt!XerDqms6>k4-O`;zIjh9_&y`t6~ zF3V9;U{+K3lS<#v#9T0GkeNAYR{@QWvWmWqe;LGo)TLvu!0tO4w`f|0S_m1LPZM&v zUk%dxe#_b+w28$_m7%()(rQtwl>WHacavT2g49e7b|U<&Q31RF$C)Y+(@}LiIVaV> z7I9Dk>YL&cRs_FR8;E-qDS{zh$?5Hx)0JYKwmD`>J*C{&^D&>Tv)MU~IwSt+mI~ud?THZ7cs%-kG}WB9UAnJ@JS~*PGn(061@ZK zBCr%tH7^QGOc0A|BI(3;4oGhBev^@4q-^X&<}67z95{(ni50a8Hr&qta;Ctk7qH9$ zC`i%`2XcO1FCVl(i3u20dOr8I#>28{COO3-Ju=-E=^Ykz*p1oG&7qj5?fwx7mvzOq z$Ho&A|6;!b^CGId9Xvl39h1VciFNnE2e*cvCU!o(xu0c!6!wxpCmP>hMmE&5=7M=@ zBJxxNOgkrkscqO1U1zayw9817fBoFE0W>~WMZ^G2u%6KgdY^o&TfiKwdnq8agGg!I zR>~SqedML{f&7l4Up8>7=Ice;G53nlFQL9=E`c?ON_0OJCTsrHqQePkRObd6G!XXWwwrS%;GG!)Bm7UNy%~QuTZ6KFZ zi{D@YYOuiC37Qw5wkrlL@nXvQSmqY^;Fg}AI`{p-=(@(k4Q2l+>^-5#ZxKF|a%k(O zHQPV+#B{a!9v5$;#_mBA_&7kH;~x)LJ0ojsG7cd@7N_QU*J2NpdYuzV4Q*{Z#?%tF;e?H z*2iC(!bajAHOerW^(4yU$RSOKusT?UALm%SFGJ&yE>##}@V@P8mkzE|6)<>DQJ42L z-GCpUpFO4_Zu!BQ;~wHawC`7CqfqlxpV|HeC9pM6>Nu9XeesHN_5<%&j1AvpUa(1o z-I?$xm6I|LHd%_BUHwcyJt@BQO6n7S(txR$8L?+v9O=a%Mz>bq>~jRpG>IQK3y~3; zCxcegVr@B@Py*NC*J8(XU|@IM(h6l&u8^MUO8Z9=mbeV+I1%n!xjA>;WklB`k`Eh$ zA!8OezQ*`7Bmg$OTR)W!7@@%=ScI12d>HXlot)M8I>SFDb(UN7#?x^GFD31SXCoxp zkqc)=Q_-WK{Q7fT+^2%tAT8Q&;~@gWA3R@$@lw$`35#zxYlfp*SGYa-$LT> zgP46!091X`5DF%#wH=7C6$8q_$1Q|U5vDp{YxCLZgn9jVLPaFK%3Y7$$c(?Ww@$tx zsu}MPaVcfZpB<`tZUWej@Fy@uf>X0XUx_?zC|s)GAQ^lTi}pDS--_I4mJj;GR4f^G zkFbg?rEs#0{H%r}@(|_5z-=A)X-o7m>0`{G-6)#7X6o?``Jl;?QeNWh z!y6UH;G*mBkr=Ia>*0V2L^G%T;Xdk0VRwiVSKZU>BsG@U3n2JW+UZp?TUyTwA zP%sgb^3ajgP0F)xPqw5A`SpO(>X99_D&o8cN%~1tRh(3s=2{(H8KaZ-Qvzf7db}O{ z@g4a?5)u0zHCHjfXQ2#9bRlHlBX&AoQ2KcKn7Snv;REw9;XT=ViFxM%8`Yut&KB|5 zkwYR)qa?Xf$^=V)=4Act_4g*f!Gdh%;vXAIumH;tSiJw@%pwCuF1`dwdQSKrrKgO6 zL5*m%+~Rz_je%X< zpZhM)x6NT^BMUj>AuW42l=xlJ?iyZpk>V}bWXwIlVdi31kK>lu_lwAR(S z;j{61CidM0YML{=cnU9N7`m;D=rvI@8X<}J=~``wJ5F)qEh|Oxl2lhrqe&|MHx*y$ z!&83=LQb|eEQHixsIIb4r{pbyqTvy3?h;dHoU=>iT}m+*v&}Mzi78iCWn&NB{L(5= zooNg})J)@+b_C!EYax=y+#vp`a@59cU!{3T*O`P+R{mKs(^9|9!fflunPF;$wE3$( zt4cyik&X9~yNaQSJj77el;mB_v&MZojc^|43$w5%ex`wSzOMPgGG|Q)s-AA7~lGX+B_@EE~_N1U^E?VM zOz|bA)$_l$vfH0Zb1K&slvB(MtTT=*LUZ+%nLBGpSDoeL)laT7wyD~5RWARasw!A#kl08-BrQh2_CxsZ4Eqpw5Yyeed^JAH`^J4WWkBVFN$N4uDw+kM;#FguzB zyabFNq3Um<=`#}C>SWs-k@G6^IcyNeKK+TSP{;K>Y9&tD>>yW2Fnnhfcs#RM6zJ4Oz8&af?4Bz5!J8ru(VP2e1*tFl&Lt(Po;JXo&py0CJx#Cb*&>!tdgQGS)|ckfDN*W`(7M`)jNOPl@=Muevg_~`MsXG6 z>%vsIDB$eo;g846zagu0^NX;!EV#0z8E6ei+icS~dgWvRiLzV}tEjI3l2F$#n!UM0 z&+z^Pl*6PNYbIMV5jFd`h*ckb4RBR!-(x67DDz@9d`Ap-LEh-LSZ3N1g>BfS%8xr& zebEo*1M|iyiX}4YcF<3C{TA%8fSTc26 zt_f@`#FrQRX~ejO*7HT+0HY+H7K%}F(%AWW^;rZ&al-2={=0%(=<@|*i3o_0!pjH< z0g6toLP4GuiVoMlEFK6PFwRZ(0hOUypSkqQg^c(>cpeii z^~gfdN@uJx6#sCxZS!Pp(#JwgpP`&1wxB}^R*~zHrc)#vK6QD%kY8*prui%Z+0KM2GvS7l-*B{w!Dg1u>dp>nek|+p9WsM`o^QmXHzLA968~i zqy5591(KMOX=i3f*{DZFaIyzUF=T{|np4Py^w1YeU97U6jKkNn0yE`jr7Ydq3TLp1 z*NaV5P0K{r(86jZyhgo+8jV55KAAK9Ax)}h;&(E|+Ar=fVo#dp0WCZ{K`z?SAspes zwhabas1O}3l#PzoIp<_vNKTpqBNnQG5$mjs5sQV1sPk+*K?FtqjusnHrxm{YSGRCY z!i59ZG+cC|y5-acOSBNgTyt#!@v|}l0X6K*QkN_vEJPhI_=NL-;8yn_zj<0^fY`W80?2Qs^p<+w{rWXOJ zY#mF#je}IaHH!^|a&iAawS`)#XHLBSesvqg3p%TP8LUn$FWKsYzc3lNVaUAtiI zjaaRdCDtDm4wEbm&zs6i`nZG_!P!e1BpdXpwed$II*F0t%hH16-S+G6Z#vGFi;&)R z=vG=sz4B3Z#4D01;>8Hgk$+g2h*}yoG9GD@!ut)Q6PMXTPD+7Bjl{Uvdf5ik{yIjf zp%g%%BwNWRk3jq6N`_F!mA;;U!4vhWl^HgoLs72`N$M675?&QyA8&K^4^h3dD;hgRH`L|LO-^2XIBhbqH4~WtA?V#p!|v3!8q)nnUHQi9B+=;YO*Pl^c{B>46{fDNPAd_E+tfUO@H7JNnq8P;$hAcH6_HcO#7 z199rlv0=K#Dd$F61eDC39Oj&RkT>~Nwnc6XXwG_M5WMud5P49_&wEp`8yW6L_Eh>b zCB(QcbEDT~9?GzI{4eJq5R1CP@GO;Ry^(vTb@StJsA3fC%=Vot1=M08gF%*^zKmWL zI%<)AEEJnc&gS0BLH)e5Q%ZgGIyQ9`AnJ@wRXw3Eqee9WkWDMEUH-63#qM0|gcU{RC;?XQFDPVK%iRqIWjnuPYb4G^S@gS4} zB&O@6YVPj6lq91ju%9~UzN|Q0czP@O2&#*YK{Y7fQ~nr-XSk?hkw;tSY$BZ; zNAW9K!%5l<1eP@e>B*Wc3M`g`qpwWx4B;j;Tuj9?BqrE}lBAJ(#8#ikknKX93IC-- z!d(EG1>YfupU;7hvYutCk~cLn+Q>rPMUKA9Dol=9Wb8^`I2(y}p@;BEtG5r%TlW`b zg7kIl0pB{H79ISDkNEb2lkq&&NrN?R!nn;QieUr_;untIBVx=L&CagK)&{LV@a#c< zc6zB<-bf2n}K< zkh^OmHT|IN#;l3Jv$duSE0J;6%|7E_=kx)g-rGL!lYY8_WF2^p=K#yBJDwTdL5IacD zmNLmj|!#*_pH5%p8zl|32pGLzy{l{oS*8i)~JdFO+Xd*TL7!B9u ze;Q4s=C9F+w`g%sYjzq`xBJUa5Oh2FyrMVa$ErcD$z#5^2l2(GXG1{Ebzl{3Bpec!pFD!%9(*y#=w6e zdp3ECX(oA#*00x#edil0F7o@Jh_UKAR{p~-d>^={Ak|5wbr%B3aH0zQ>nXgyo{H^) zdrHR;?kS(Yo{COP>N06fnZn<8#@)r`HN^KK<~0lv>QS++%PCV0=~*NgruMHcZvv>r z+c=rtYw($LxsA--i0O@*ZYcCDvTfHE%u<~)pIE-as#)9^*ri_>GRb79U8{h8E{yLg z5&vz`xam1)pOpBNC{n#LO1~oH+E>A*lm{9zR>%XTNHQ`QsqL@mWa21i?`Y)V`RR0^!KL012 zQWa*kFH<5p<_;(Cp+T`#tE?3#mo23Y@1&487kdXv z=ok6{-2;Z2wKVAG?D)qb@wR`tt2W^&kqr8eyViT*?!pEQX)9oZQhJ#d%<<&l?us_- z5%Ba1evi9{FZb77a+$DUZB(kMbxS@W_2c)nP>pn!uY@}K&pPoGK&BQq&qf^k$+$Ad zFP^?)+O{m4nm>?n#g;gq(vJYe9#rg!a(iEhMvD7I1jy>=UL|m;CziLzmYggh$pj&s zheM<8!(41{ZJ%>C)FrY);gBRN9>&~)Y(Ic|JTXN3~-xXmKGv3l+2j6sgjY>m*-7Aw{%RIF+74o_h*2hgTa0>gn`=wfww z-Ej}XxCY%hw$6AhujAu}mU%5u%y*Hd{ep&LvSUJ|1R@4+06H{qWJ~E5ihlH0kPTUH z)q$l;n#f9arjjUX`En<)LNmvqcH*xa*>*v%3{z-JAQi^BBPzj>tkCA@l6VND00I$~ z7|Ze?_P@Eu8~{pIvu)6=;Ye={M|*1>4Y(Hcv)f)on93OGgJq5M<=|4rNH9^h7^35Z zqFZAmz}vw;%F%)!*2GAFH-!Xe_=q+Bj{R<^2~7rP`7EMj#hN9v$k+x#Y2G}fi;<9{ z2A?#uSN+eeiP#1RinUI4n9US$M@Q+LMZBX;5hJ(ZLW$doJ;xaDyRNgF=%bE@ySR)t zQ0#n5M+yCHYjH=0j0^hcH^qm|Ui%T_ZQx*+?x$A=!s2)c#E9C>5-G$8tsUp;xCpJB zuTGE)vmoCPq_{HgmQ(E5`mNGB=Ue%bald>JyE>LaDilHq4h+75SZRF+o~gwP-~{C) z)w@wZ#U$CCLoTfT)dPGu?)fAB)dRx*_5c|z{BJ}uT9Uq5>h3bL@E$N~e$6vBU284o ztTg+#2h8e46#c6Q6v2A{#=m-i9MnqrZx1-XjiURf2PhMx{OtjQ@E$-Mopf#Pf;Bi| zwM>TnPY+mx_W+dt+5;44_5ObmS5*1$h&!tKkN!Ek@c$+pM&SRNa1jOnnQ$^%{}%~2 zyYN2~PDbl*!qN80%<7>?=3CA#IEJNG(u;E56Gj0N8qdafJ>*6j&L1!W;NA&vR>cU& zspx8%#>>ExEpR53Eg&b5Es&KRTadk>$EDMf#E=`)1IzxSg<$w$Px!VRTwZV~C+k;z z%@o9N{$x)|G>t1>g)&VbcW{)$lm(w?2A>c_ZF#=7nct!qCBc+Jb<+Z1F^-r~AQixS zz*URKr-i2xM6Jnf^}juU_-_wD)Pnbb?J6M}qyl&kAWks}tMvYAgx#Tcgb|TXzg#6F zA?4e!u$#q?*`U|EWK46?B43IQbE>Kt)#Oyeyicpitjq9dY5xo>)-0rhImu~PUcoMS zt@EWgYS`ulmZ|{0PhDWh$vOmb-5I$}e99&4x>UV9gW;PK!kGp}9&^d@L=jhL&_fZw zTQ=dFM(x*RIC%0Mj-(Zii9SxH>etMrC+*k7jL2W2*ZRy7kq_tm<*I);zdWK?AI|yJ zGlbE)e>uNcAMXqX=X}z?od5DK=aWY6*Z@2=C2-Ie_zU`Hu>S)3FZwm%Hy@&W5i}gp zr=qB~7Z@Y*4VVSQMke^$=EAKiaaS-`DILA^nOa26C~_%sk^41Stk#PVw?B<1Cvfbo4i!Ls>1^zdsFEEY;$g=Z6Zy|uA(ZUoR#X#))|46=@6_@1m|v+p^{+O0Dc z^GO+Gd1QK^i2K0PtW*kqD}=@mjD2?*W^eCP5O@6 z=nYke)=|r#h-)+pB>@j;{hIh^-l6@PYyq*p>}i9}uVh*lTEZv^g|)HQvQiu?SEC#& zfeQGW6I5*tyBI>dS|vocT17{<%El-!{tvC4!{D?g4yUz$1gAA|IIW4pX-ynXYvTV8 zt^HS66Nkf^_`hMTMek;LPLsphW@?dc-3cCPniMhOAxk2_`f)Snr+o6$_q6L(jW|)_ zi-&R@dQYQ0hdR$Lh}x2eKZ)B(%6!s8kr2cf8^!fES@&i}^mo>lIAtiviv1=n@i)X0 z;UQ+3);?d(my84tvEAblG1&r5%A1xgYhTr$J^-1In{-pVD69MpYlGG^iD7ogKq&?K zFPH?Z3+Synk*I=TnDDN}FJ`XsyBME2P{fx%|6TFOyOpj=JL$cm-2B9|$UA?|G2F~) z=SI5p`Zu0Jq|OH?p7ZJ84gJ$zbtU8}#gfp*o+fCh#Kk;u{ae#thW?$*2ZYtb=ToTA zJ&uYXp4c?Odn_jWURXHTA|t4zrR=v6&TZUPF~H=j@Gu(?{`{%gCiQ(YTf~jrVrRp# z>k50!LgK>kXIMz>W#ltPJF$b~pT826&%l~;YQqN1T~$Oqyp-Z`Hk$1h<^@jN;ZLC| zpz4Hgn3U_5;zV1a^$xC} zKYKg^1`@VrHha0$9%X-5&_MSMW}>pD=eLHM0MzFO+x@hD35_C1D}BRKxN@^S-JT8A zmc&vOcJCzpBGa2DbW{wrSrt8M*R-TR-~nI7`zFU)sQR0={Rc5zb|TiuN$WZCbW4^& zn2v2dEz8aG44EgY1`XVnSsYC7X^JfXvYWN z++4mi;R=1jl+wBM?rrbT5f$5OA7_m{@|*SLn{k)i$;w0F-eAD91rgu$yEf zme8ovv>OlwL)(`)6=U>4iQlI&BC0#b6Gq` zhCxTo??l`!MsmCo#V;t*E$Sthh-pPG5o#kU0%;L^r#U~qU7s_qZhKgH<4_i=mxPkg z3R;GIKXB>5;f-5m(rojEM(*1afH7u88Uyp1EcM?MVO$DePBe9BMMp0a#$mQH?nyb3 z))8zv5lj>BN*(7&sM9EEmGlG21ZT;@ew*AcT|E4338u$`Xruc=h%Qx_=Q4tGZA|ue z^A{L%bdd^YPV~#ERErC$ZztfrJ*)`S36~}N2UDYVPe2L^P9f#ez8yxiksbvdF$>(ag#Q8%#ns2t)X&e z=*HH}XU(WB{@ZIVew44oYoE#lmJ!+Vh{0cs>Nzi?_IhQTcq@Z|b;GPR-g}Noj<&X@ zXxHx&D@U}>9ZN|bF+~PrONwqx9mB46#*zlzb{bPlkA4{E6F1`ApETKqTo(P8i!~@q z`47n%A?TY+wlJK56 zk?SwUl02(I)4SFO5`?yt1yXgfBunO`$s?sN#{^O<#Kr{~7Nv8L@_*0S(P>2T%qTa* zA2((>z>Jj_ilB-pCdztr;Qbd#B)ZeJ7`ji8meiAE494#|;R2db@N;D?p)K%%2`28z zRmP@k#2pVG2#mQ)xXK!1y=TrA3Nsj8%AmoX?t}cmJXcxQ-o8qP1I!fu;ZuLYdIL&= z6|Mx7Z;}(?R~i){KmJw#HLZu?P&NnGykO4j@3YN6%3Y}yGDb-d_+S;BjBiakuaE9- zfTOvXVwT>4HuDO_r+GY--J^LTOqARq6E%eXPBsTkqZtATP`G-lpUd2ySXUOL^zH3F zK(a_WPin~LY((v5uI}O+ck^sq?9;vPQ=s0tpzt5ZU*qaUrCS<*dV13&^LkwOdKBvK zYjW9VC8~t)#lh?xwg7kQ{_gnXFgcV`F#+K^(CmQ0ntgdn!YR6HHl+54uCN_0q5`BH9k>9UftQJvIJNd}6B^z?YX!@{APRa3JGw(!Ia=;nEk zig(vyJ&UAa1=4BTqh4Pz8%MEzHkCx{7A{1yOLFw;a0Vpd@hqxKj?X8C43tKecOReKJ->WJO^v$L2eZh$ zsx2I%V(%nq!v3POqXHH_t4sACiysMDi^=l|AR( z2h5|9-mGcbHT^dJrgFu?8o(bUS>51{u6VJXr3+0EzZ3K2$>KtGaQ^LqFB##r?2iza ztQfj{$2B}x5KccyL@4c1%-T{?5zV7LrO>H>yWoXVafOOB@IJN;JmaJ&&yLR-rOZ?@ zl{AU~^_({J@iBO(in|g=`0a5L2(`XT9iL+-qk}e@FXDw1tg~CKWRtNcf$EQp?!_R)>l`x*26i{3 zghR6^=3_>EqhC?W6Tr<^%kDYhfq`D>eTOUSeC}!bsR{D(bkv6Eg4Za6EYWDi1JVr$ zzl{s(cO<_ZE03rf0=9bx1SaChQDX|`UxZMzGuX))?w5uzMBB2F6k+Fi@kG|{nusZo zH7jbtfz2|MG{{;(1g*8ZdYCE<%psSqox?7e)~^Nwv&3*%1D7ByL7nzq4_@XoMrZ?} zPZj63hKOK}jCSIjGj7npW(~Q#e@(@+owroEucqYmVBj9TB$Z;Y7`m=b`wqR>+ujvQ zD}@dF1ZCoTd#`O`pIojIgXLT<1Y;PuBhkv*y(`v9=i~W1#Hj&IIsDB5=|OJ~F1{wz zCe)v#jy&nZKx>0TlYJH6Pyd0d=~SNJW+Bl6!NwZ0K4Vj(`LLZ_jZWTR{%CihN|hP_ zdn<7#mxCbMojFwB`r%NPJo1wj(Q?1(Im@=zWD%j6va3_$*)L%_y4( zd-EGcf zJ0h1H-jM8ulMEC@2>%WdS>cN)x;FQ8S552%B&CbF`H7neWeHnCg{Hi?BOX-w)5@7PP)DkI`1NK2>9F$RLg=&{Zp%1 zvE^<)c4Sh2Q~IIVQYxCQGRmBaG~TalSxGVWbpuNwLZchoV0c}#_@2*aO4R}M2{ldn#< z59;+3&Iv07KZ;oDF5aK_r`(ojf2@;1b7@<@-CM`Kdwo!8OZCy>#*kn0!z50`{+*-x zYg3AzmYO)*;-}`HiE5X0vazUd<2;r}EafW! zxfXTTM9Uqm7_V^1eHMTXqtAw}=vY!;xkm=kALhJ8(orKG)@XhyM7*Uk@?)8pC2XhR zu>Hiz%-wAiQr9DqDgjJBr(0;&X=;=c-u`SZsI*7CAcz4@Ki!pZQ!8MEWF zPA_O;N0Qn)H_o&XQQQk;s~D})WO0Q`1RNwDVj<_?SQYv5i`M|IgJVh+EiIJz4|ciwG7##(&T&_qoKV8iQU@868(V7 zOZi&yV%0qGceZSbOhPUNJ-R7h(a}R)9R%rDxZvO9skzqv3LkG@V6u@(HHruoOfp+O zd}-abYjigmpQZ-B^VP62zmF4D4tM(U2RWT%Jc;ei*4t0( z@FrCDkD?icdHncdbS`lVe(4yhm)7zC`T(Mqgt`+O#CJ-`-%dA4k>%98!CV9lnA+pP zL{m?@vzhiX&DwZ;%RQI$uis?ZM`j26Zi#Nw6<#Ecq5`H1dq@tPy~Bvfn~u~XU5V?= z6TT9(j7gd51R|@;7)VMkw{&k>e%t<5P}10ToQ1?0l)j`tkog>i@?x1k7m@JwE&C6i zZN54`?y#~!lp9oJb{4Uz!I4($XqFduFR)u71PIKx2-CL-Y#Ld%ym%Z2JoZu9B*XhU zb-ozPxZHsG#pO?bBJ**6Mzv?LQniNxEk_H(<{^AX3y;VtyxNs&uOEvvv$1|UN;JK< z;v2U*4t$}cmz9APwx6g-Gkd)HX^#00L{-4&1*-C*mTmHawmYo)?Y^U!U%dM>EC`T?Br;|4eT20yV^3BT@VgplEWoj#!taX0%>^cHY2dxJVr|IGwk(Mmzvi{xtv?k**AFgTiULHthaRaB?A7t zUp#|AoW2oqF@}fl>KpWaOGYc?qvhTPx&mkcBGP^hzPnH^sFOTuF7RCh>$!8|i|9lC z{zHj!LOE=jA%=wXZ(y_84;;bkN_DRV;*U8;PhNIUbQ2ng%6^iRDdiS^mCC{_mLZ~- zExPB2hq8{I_>u2!*Xw>9bF0sK%;=?2)=649;Fg&DM;dXF;VN-c7eO%K8}6sXHl5fE zQ-*~m%CwSP4lT<+N+rbodGcIkKhKky@s)z0Un>TvNJ(_(rRuEe6w)ks)hBdhqeQQH zci-0M5pi+{Iq5TXZWqhP`*u7ASc+9YyBi?k<3Jg$;g#>ya%x1ZS$8#S^bvm}$DZqq?u%L#s}Pjh#wy-K zNVQsVcLa@0OdZWBDO{6r#XD$SfnINy0hi%4KOc_gVvW{oEd^(k8NU+M z6E&9OJB(zUI@zBbQOS;%Kj>&=%mQu}bj9<3&*Z+njUel14^i#mR3FRw8u8fV(r&=t z>C!f7yj1nx8>aP~!l?72&iIGt&Dox7TbAWdbD2;-LOji-caKSJgF4hUe;O!1*i=<1 zonuWp=y3{yGR>_;g@!$QUKwesH^ORcSBSIp^f)VjMjlKNO|Ja55)~fybc+Dq#%dzZ zygSc{-0xWTnp8G^QJRETS|LKQ~@AdXffm%<>-R906FyGqRFxILQ z$2rWUGgfB0piEF7i6nG z>G-i8YZh}e_nqOzzC4W2MQO*vJf?sfPb945Dg9 zn;YmPJ99#1qO^!*YGHrI$><+10J;VT1V}qXg-cqr&sn$WX=~tryj_sfVAa#R9T`rx zNFL?P0?SAy29yxoRg*i&)$wkE^cA@VM#xv8zB{aS@ dFFlY0e-P8LN_GC{pBd8~ONG#IN)h0%{{uwT*~I_= diff --git a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json index 562a8db4734..77bf8454296 100644 --- a/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json +++ b/Solutions/Infoblox Cloud Data Connector/Package/mainTemplate.json @@ -1774,7 +1774,7 @@ "description": ">**IMPORTANT:** This data connector depends on a parser based on a Kusto Function to work as expected called [**InfobloxCDC**](https://aka.ms/sentinel-InfobloxCloudDataConnector-parser) which is deployed with the Microsoft Sentinel Solution." }, { - "description": ">**IMPORTANT:** This Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." + "description": ">**IMPORTANT:** This Microsoft Sentinel data connector assumes an Infoblox Data Connector host has already been created and configured in the Infoblox Cloud Services Portal (CSP). As the [**Infoblox Data Connector**](https://docs.infoblox.com/display/BloxOneThreatDefense/Deploying+the+Data+Connector+Solution) is a feature of BloxOne Threat Defense, access to an appropriate BloxOne Threat Defense subscription is required. See this [**quick-start guide**](https://www.infoblox.com/wp-content/uploads/infoblox-deployment-guide-data-connector.pdf) for more information and licensing requirements." }, { "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace",

Incident link - \n@{triggerBody()?['object']?['properties']?['incidentUrl']}