From 4d7096a40106cab34333ad7a9329fd32565a31e7 Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Tue, 5 Sep 2023 16:30:06 +0530 Subject: [PATCH 1/9] Repackaging SalesforceServiceCloud solution for Azure Functions --- ...alesforceServiceCloud_API_FunctionApp.json | 55 +++++++++++++------ 1 file changed, 37 insertions(+), 18 deletions(-) diff --git a/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json b/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json index 26fb37a9b99..8d9ea5ec24a 100644 --- a/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json +++ b/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json @@ -114,21 +114,40 @@ ] }, { - "title": "Option 1 - Azure Resource Manager (ARM) Template", - "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." - }, - { - "title": "Option 2 - Manual Deployment of Azure Functions", - "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code)." - }, - { - "title": "", - "description": "**1. Deploy a Function App**\n\n> NOTE:You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SalesforceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "title": "", - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n3. Once all application settings have been entered, click **Save**." - - } - ] -} + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] +} \ No newline at end of file From 30b730636f2e388f3624b678f6f9f18d1639c8d0 Mon Sep 17 00:00:00 2001 From: Github Bot Date: Tue, 5 Sep 2023 11:13:49 +0000 Subject: [PATCH 2/9] [skip ci] Github Bot Added package to Pull Request! --- .../Data/system_generated_metadata.json | 33 + .../Package/3.0.0.zip | Bin 0 -> 16896 bytes .../Package/mainTemplate.json | 1494 +++++++++-------- 3 files changed, 793 insertions(+), 734 deletions(-) create mode 100644 Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json create mode 100644 Solutions/Salesforce Service Cloud/Package/3.0.0.zip diff --git a/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json new file mode 100644 index 00000000000..dd3e8a3a585 --- /dev/null +++ b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json @@ -0,0 +1,33 @@ +{ + "Name": "Salesforce Service Cloud", + "Author": "Microsoft - support@microsoft.com", + "Logo": "", + "Description": "The [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).", + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Salesforce Service Cloud", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false, + "Version": "3.0.0", + "publisherId": "azuresentinel", + "offerId": "azure-sentinel-solution-salesforceservicecloud", + "providers": [ + "Salesforce" + ], + "categories": { + "domains": [ + "Cloud Provider" + ], + "verticals": [] + }, + "firstPublishDate": "2022-05-16", + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + }, + "Data Connectors": "[\n \"Data Connectors/SalesforceServiceCloud_API_FunctionApp.json\"\n]", + "Parsers": "[\n \"SalesforceServiceCloud.txt\"\n]", + "Workbooks": "[\n \"Workbooks/SalesforceServiceCloud.json\"\n]", + "Analytic Rules": "[\n \"Salesforce-BruteForce.yaml\",\n \"Salesforce-PasswordSpray.yaml\",\n \"Salesforce-SigninsMultipleCountries.yaml\"\n]" +} diff --git a/Solutions/Salesforce Service Cloud/Package/3.0.0.zip b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..39b6d4500085685b30430742291db4830a56cfcf GIT binary patch literal 16896 zcmY&;Q>-Wq59G0J+qP}nwr$(CZQHhO+r~ZCe)*G4b|0thO#3*QR6!aT1O)&900N** zlT19Cot3k_-L9ss{Wb^E@1DM( z2YdwXhEq~ehp6MOXxr{K?ZO^two9}y4oHj0c8@}ll#<)B-tQNmuv8PxbasjC_NZ?p zu@wh%PP(~SMSMKQ_0Q}WbmG&V@|reB`gZxTqei4s-eaeP=o!&(Ap=pAt5#q0aqtBL z7uKm5O{qp~KK5X)$MaKY#-t2aW%Gq=Va_*i?60-!tFFC75gLzl3IoYiYfNmL*IAMA zeAghs0$pgMfp80U(a?4db{-Ts7J|`9N`SX7JsDYzX{&1^@Lkw$NZ6SeU+ z!KfCIjg85jRN-I3WsW8?fA)$QqYvtAsW!^;5EQUuoQ$y8qdA1Xc)3POrh>5sBvhRK zWoMi5bZP^$t&wA81H$I1&yq29W(O$A_mAW+UOY76IkYuD+>PDx;+>;f-kjQlkE#J%T!wVJp>z$eJ?v5#V&FBaYwH*^K2G+EUYU zlEZ`(X$R^|L?**ws{|oJ7c?33b%)XhhHjG6LPT!PBJt9R504rvj( z0qW>_%-SIt=GqiJ&t&#@SWG3LZRNp#F&73OUi6d55$x}UE?qMlACeQnVbi`qrLICB zG_+4T*z9UXbE_RPxrnt?`3pL+2-y%Q7@LHT7%(|X4}K}N!#$@ z5lP5)4Zc6$YT4D5YwFjj#v5l_lNmp11bmhsjEy}0q#ctQQk5g+T@JX2ovBlLUsU=h?jt%PL_SQexTOHRrHf;c|-(urrymO>ZbC|VkY?ifiB$WHl5!}g9Rs7j{^|2;~ zf_E7O%?JUBy#CbjbKjeps33SmmQ7-W@B-p9^XGktjJ~8zo!bA{W!CXUTzUo{3>+4> z8}7MRRM!!ap=D>q@6+?=*^Cf=qP0C75#lT^*qITOOqh18MSgUVPsIg}Dr|D{aB*>P zW8nJmadGYhw{7F$+`sHx+1q*7DIYk!3|)SKc14pl9xD|@b}<1vhlYfzN&W?u?@?A{ z?K)}a$rI2Ou9=gj8b$fkGOt1ei=k|Mg$BBU*(NsUQW7QYcLrtmZY$-z2}8UJGyQvG z1NO5=ppEpIkm>^Teg!VhLqxLKzf?c4m~wx3GnlAqolC$DD4@@k;LXpWQs|G#?Tt@1 zxR<=YENN#q5jk^*-P|i-&-vFwwrg+yI`C=4%t4t`ia3de!BW#2mJ22sQ5%g!y6|(> z9sojUrh~pQ2VjMINH(kTD3T+2zWUBAgqW4*c4-CZ+O8CCk+RqA2D+IEV@~i33E{uG zSNN;|y!{fGkr+VLLrqiTWqW;`?qbxc)Q7*f>Lz}}ZxL>s_p#L!9W@&2TEVGe&*Mx2 zwRJJa);(7ffjf^-7t1(6ZGOE;7-O&!rl^g*^~|8(0tc|6$3F5bM8*^C>y7;x<|-`v zqp`BxupxVFS&X(fnNOV0eP->Y>cWv4j>8666Tpq>NeR0LciSdGHSZEfM+3~O{seqs zLG6x6tf@WylEH!+*Mn|t9CB2co8Krh$8Z@)S$wSBFJj~?-Q;(<4#c2|)rLfz4pftz zxJ>-bz*1yU^SA_+CzJz9He9GS5}J6Im0HU)$7T{8G#B7cQkE04F>ND>JjPQYx(JLh zW2iME6a$P=$(!LG;{cC^3vpFlOpk?5QfS;8>8TCtS4luBy$nxVnFkrO+cUMvsjn(L z*m1)9w5&SXG5TiK9(ny&?f20(RuGcUxo$y8dmNVTJT~k=5HP$3qqVXK|3MwmI6kczmGS1>0OCz zUaqB(`uQ^@{kQI;>0|Lqkg%QUb6D_BzRUqHBA|7r@U+(`r>eKqN=6v)%(n?jUAw(B zKWyj)u@4ri|6h6LhdhN#wAe8zS+?aeOv6SJS@IMDPlnMH?I*U0yp%qJvs4REC4}4I zUfOJjic9Sr8Kx;Q8O^7O*t&v5FOk@vjd`fmy_O`*5QgmrPOvgs6)*tdVl{=2h?hEq zi-uGg66ne4q+^mm80_-e;b7pr&nH}p<+#&rP&>+tiL^zme|Gjzd#A_@hwm&Us~O6E z8r>eo2`(NCwW~J$kUHhM!NNisMI4+4RdbNRb@S9FuhQY2@TP60gVJVPu7mX=Ey)cF zJHt)md~`VMU$H&%Z*0I2husnAP(&936o??9wCniCLJ>B>NGbl?&%`Afk8!yCMpD?_ zkpB~l8*ZPx)cRLO2Il_0iatFJZzyIHjMZg5msK=zP?e7W+Y+h7CEztLLc(SB=*ls8 zbR|0oPPtRwYMIV{&PdlpPU3cc4Ih0I-d`(GHJ}fk=;fE2nfq2zRQWh~L|OP<}*vqd%54D1KHSVupA5y=Tw4E>bgZsxS zX4cz#Z)~tC{14gar!jP*%LElaRwAoC-Y(B4u)_c64U2Al$FbP~045Ru0TBQ5hPH;5 zb}FW}4mSTe#Q(X%Ti+k`9ge1p`!Dqirh7bsdj5;BgnG%jq=XrVa1tE?=JVWypyb5+~>;X*Ob~^ z@<|%Mt=lO2+)88)WWH0uCCA@Xu^wiq@+O+Q*LE-YEp6`GTD|pCX8xWruW}!*=iCtY zU(E19cxzf4e-toCl%J{M4QSw-vh~fOzsMs>d7O30hCluT`}d=gNly&J(e^zGsAGqm z2Da$sO`4dbe)(1Qk+7@+zOoJ97y;Kv|gJeeeCiW^gXT|PG@ z{*Tp1<)BZDM-Cal*!&`fTw5DA74-a;v?-EA+R@^PY)O~3y--MLLqpQLtwHzIcwpbdVmn4hss^btsR9h+3r z^PHb!su;SXOy(oo&=dZR)lPOUbG;cIJkRunQx2$dl^=(AQvhqETl#;0`X@B1+txzs zOrYo`%i;(87dFN}8S)X-LS*l$qfv@0DI+zoK4Xc93Dyn

Sz2&xpTmdsCRE#=5EX z_I7?*%oe^iuZ)_V)sq_j%D#;N3?zO0FyuD$4&T=!*rN>IJV!L>)yN1~^ap%$7Bk5% zX86MlF!WxwHtv~{%~AU}kCtRmRt*zjQ0q$)OpN_5MDv(HY@I38VjK>QtV*tpBrys; zwlC(|sV$S3UWU5i0@5_y8j(Jdxd*JLA{1Wz{h?04`$D zmbEz#iddeLu4^KI)HY(+$+kBo5i$QV#WS#?DolS&#>6L7d377L#@4j%*I;aWS>d~G zAASswi4I~VA%XT$m}F+)!7^vnV?CP`*fiz!@|6~|zdnND+cq!^_gw7$fD__4a=?&@x>(vz$ zRP@BUx*CDaCLrC37-XzXY6Wnh*@B6o0BJB4?*vu4jZ6HQ$gb1Z-mlVL-oW;H( zs?s9N)rVDErb7B*H?u{hr}Hr6RWGU{)Jtk5R)_{uMU6;1s}@2o`YE5wK(y(FKsyJo zN>@vw2D=Oa_Cr?d!(40ZM0C=K3RHxLT)UT>-fC zv8i?=+H+4=ea_&B=~ThmVatb3$k_6xFMiBoclPM^Z`-})?iIbqH~lvJhH}Mk ze;+0@?&I3=UcBP3F?;tT7QfWQ?)N#1-?Ev!{_>c-`~m-i{$ls+#{YhG#P;pRE>vv2 zuP5R5xAttG!{O}jJGy&*JlgxAt$e>d(&5G9y^j5Oi|yHs{@GF&+y5tI&u;qf)_dw= z8=B$s^~e0*tyzp7Uh7p4&k-pY&X+X2#;v2uxK`z~OsSKDlZ~bg3v|e^1>aHtb>QBZ z-3JX6Jumv_rIeECP|~L}fmXfH>6^V?!Y zsx40v{b1*h7;w99z6l7S{C-~xg~oj5E(bExA7z6eAN?a`Hku4<0qVyVf({%z!a6%> z9Oe=pY|5o(YI@Fj_ieh-7$)8jnOb>VdWB_`i?=&=!e+m!>_oM=DcLUhQMM@TP<<%V z(A`iYMb(a#dHm3R7rXvVss@b?jq84*^xoICHc2|>2<(b*qm=Hge@RW*gZdtTmgo5% z1H|_K4hytKiQu``A^!1Az`_`_R$QpId4rAd#xuS2jMVQ|8Dd+)L<4UNLmJpG1+)hr=W>H%+{jEjP?L0(L_eRkk0mlb74vUla@@7y?US z(FM6buYtlDvKU67ezRja;x``9VRJR2w{L`y-w*>b@aHr%g1`H1DPT>7BH<(6pL7S7 zmLEdf^u>HA3<6OwPq0FL6TqUN-Id;cuV1HIa3xE}-_vU0za<*3k2A|JUZ zHywcF4{s=QB5l#V`6it z%gPW733WZp4`5t&0Pk>;rq5u8WN&NNfu0N;V9$X%UwZWEWYdg+Q~`-hE@|{5C{r1X zjxP~?O^LVXdcK z=)7WJM*;zhLPe@LbxX@Em__!Y!w}enR*NbdBe!pByU*n9a_pSJ|Ay}8i!8VJ0W5>H zNY))7230n*G#{Qn06!oR zoveN6-He%cs1qe9jmvVj&=_<9G`?FTqyVDUhwBYWEOZW!)^X>A;`boH9MCukf3RY} z50BTPQTi|uX^cSAu2f+}bHmbeAXtha1Jximpbcc$gf2vkD38apa31|n_HLSv$x|G> z{UQN~tr)t2t0*K#{;MTxw6^gjP<*yHrQ@9BusNHXlOB)9$l{FCe02UxqF(egZ*0)`z zZuA5l12Xo#xl;m1XEp;l3CB*qS%G`;P!*IG{3VqWUynbeSh%PS@t#QsSaHGOy#S9O zLIUk8bsp_~3crOQKALj4&6N1L+`*`_)_$e^4dc)Q-~^Q0$OI?glD`k~r=LgYNW3Uh z$jO2jmLr?>bnwCFeFsiEJz}TZ$oRoBs6men5mSbV;#mICg`C2X+RCjvvnpvOrRdAa zp7<~W!gpMAlp?{eCm9Ykt-6U^3dh1bCn$Me!tlb7g5jn1Isz$=$R*Ba z+_bjMNwC(k2&5-L8FF!E;raUkG;=e$)XNV7+9j120G-xf1fBOBC342Jiv*6)GUcx= z^}jA*ejK;*1NWzjYPaVjyS+dEw{{Y!2W-Pd)N$k&DXyg46Xzz%p#sb>%N#B~30ymg zv6}YPJ6@1floE@ofe^)u1ei$1g2eM-f_q?`Nh9{$&W>~^aTpJ$&(DY#jqFGQPpnBB zY#o%QPRp`vd>#(yxgfpp%F*ZIdr)-ub`B)<80K8X1&oj`hDF5nB;Q7L1-IgzuFHnz zf_=mL(0ZtqL&z@%>NRjn(W{0+O_Leiv=o0bc`D4?-FMqi1LZ2?&a6*DU*CtB?gUe_j>1=enE$c zD3hsECD}`MgEY*wCVsj~8;OE+M55T^hZDsG4vx9VPteSM53d(LkC%Jh$~mv;J~Ux5 zvP$i<>}6UvJDn(91oJV#jDjjp@ZyQ=u0_^b;p}1q^1>qCXP2F^n-%QZ9bvkT41l>E zG19d*?HFS?JO(P5U(cPp^6RiCTnkB$#`ACf&lEp%d)YPFi1!1no)Aal zM*-%rfS4Wn5mW=;E3B3;ZkV;wz&> zXV6sD_4Memx~pcs(`wDQ{)beFkR&UGT#6%mOM~eVwl}!_yC$21nV+5IW71eZz^Bf| z>{4d{wZsSZp~{`i>D3RM(gu@)2;xW!`ka2!?}fP(whihg$k5bg`gGt-DWFom8Dx?X zQD`YtTRac_C&&K2DX8+MqO+5|4qVF`c#o1oPMspy*{M>RRduA6kpZI8*(SER3TEtw zT*auk$BYe7Wy3L1L>bAmFr|0H3=X)S4+5s^{2l?qfYR5jSVT@YU3$p1C;BpqMPEqS zLxqq;hXrn2F!Ny%sJO%^!w<~Fw8AAoZ@x%{i?l+N44;(`jREQ>rDK?FPh`LJ-sANd%C%CngHRpkT`}Cn&ZcCi zQ9A%3*uZt}mz^bv+D{SxINu(2^mvMuIdURbpfLl*&Y8=q#RTpOT%IYl#3nV9ropwq zPVFraQu-;i17rf73bk$q5gJe-nFUhL`u6-Th1UY`<(d?3!Y7Qe3uFF{AG6uEm}_)E z-$CLz#V{g-jE*j)QhgDV3x|Q-(YyqS+-Y=37$#6h#kdGk5h1X1ldTnDxt_U@Mrn7* zlH>Rn(-sM<%(KY8D0{vgh^&O=)AdlmD%bOK!^4C~-o_?+_Us79rH38$^Z>Gq1EqdH z&o~9yd*~_{nrLL}lI9uSm`a7XsXmGrc*~;F*(W9vWg(Qdm6%b;teR(iXnMUAHk|Y` z3(bKWqtbm7pmQ)MlvHl~ceBB%ZV&{1jE+ z*mE&SpLfOd>`Ynp$?)HPYxmYlc0a>lESsjyV7Hg7`?;MD$GQyiJRN|W2W;S0vH_!M z|Dfr=K8Fl-&dzD>W7A!GiJzJJ2A+B+nt07S^*l0vm8!q`6ti5O|6OoPMC)l$ZY~$p zep=~mJ=31jvQMe&ol^RzdrrN04y1039(ndlpMKG$o@+axMb%i#>a^~CHvrVVu?eoq zC74B4tWB)$j4Wq`Eb~hjU6zNH)XbySCp@e<58Jbn@9@oR`Dj|_+1UEoJi4WI`D~DR zHk4f)+@AFMmHMokKIvqeg3=|xafv4Ie6LD%l<$nu${PFnT~X1m3hbGERJ6}K zzIc|uJPs}i&Sdo{0qfJ|i+`d|;M)>quumZCo`&zq`dLWw)KuT@2x~vXq^tIw$3F9( z-y+vParJxYod+p5P3`NP+S8@?cQO>$KC$%A^URK-2deU!4g1WTn%Jbef6zYBotv{_ z_>O~NLdzlnoS!Ri(J@)&@LTqUl^R;*1HQ{mGSb64(XpPL@b1N6yaaA>3i-SHv(J#lNJ_2Mp262Wf&CqM z2E#Hrr5Q|VPr&P(g4R6&se1;#(a}5T8R`0J?c&%r`|Rc8(qap-_j z_kuX%=Uu*Qdn&Z&IXI}p2WsLS>GcA*MbihMzA8U-5F&45?$00VpOW|V?^f%twvSVP z=K!jbl<(i!0!rE)M%H1hp}mE)ZNh*r+kMlm_nc_?UCB(eGUn|!kcMCSSjpIc?q!5r zjSy`?jy)4jMQ%KgPOgA@O~8rdfvz=|84UhpCqg-vGKO2_k55Lv(f|5@3~|GP?Pd7C z9)VC`MGgtVlma8Xyu8e&0eJsp#y_Z-qJ{}i5(E|z4dB66Yw6+yQ?03LyL-5GLKVUV zz$P?C1>76wWKc<9z$Z*jr;-9=UrUE7fea#!L(b@-k|>IbMj&$$M%n40isazo7TD_$ z(cyWr!t3Qk)W>~mfZPx@n943wK!F!bMjKcR+#hmwQ6bzN!d}GaBA%F{=p9y>i`Y{@ z!9rwZmQIm3)XWZCowJ3Zl!C?WoKIYU+o4XBCIy~n0qg<2_)^cHNJ}$QrD*{}Lxgfa zNYOk*y~@f07>Tz6IV8miz>bB%i3nOk$ujHZUQ94dusq3DWSL43X{Q#$tJz7+)&u~6 z17_r22;hb#Gqg75ms=UaL8vgd9Nz`oLS2W}g1R3>L6K>2E0jK2%ZN3vl#8@dMU=J$ z1|_Pq!(~WcGxT8TCVBy9cPTiy`KAG9qh{L(N(jStpgs6n64n7KBfX-NqTE9HQljnYX02OGM;P?I%~P`M%N9|lFqP)<=7 z)DNwU$O3@6iE5n@{lg6PH^Wm&NyV0hF{DgdRWhcAsvZNeN>Tw;Lt8P9GuO3RF%m(o z$x<9#2TTJ1vZ2V>kRXnZO?kAW49+4G(62Gj)5(lg#OQ3hYna(UN6Q!&B{+5bvA;5m z87HvppH6b}Mc`5X5+a(OHO@oMLt(?hVAkZQ(7=MaaZNDL*|52wwvbDO8KG!166)Fs zgY}i_{I$vGs|if3Fa!fmEYz`wP-~zN%a1nnl>-MXO{Fm6c|VH3~+#Cp0Q`QA;h%ofwA01Df_{}mAPleO)6 z?6}_=99OXc^7-)`pPGx$%GGs%c13uhkb*9_ zzqContRCSk3YLc;pcbH{yY4)L#5772Y!d)~3fktn2_Jb2Q_U2JNy`qX+_>#0my~Hs zfgymKG4`x{0&-`Qmz8zWTGItJ!r#R=#LFS912PTPBB%}sRBDh%U&&DQOd3!FFxqw8 zxWOwLY6uxwNd>%wt-9Jl?;Zu~2%)J|MW4(bt3xE50>+1k2yfZ6E+Un3Xcw1Jagl?{ z1HFJ6817;llqq!QkYG?5$u_LsyaL6VRVtQ|?#I!^AORczQ(1xX-r#Czr(d?FeS4v( zW|tAFe&~V*_R0}W#r9AdF|Uz}iCM(>$;1R@n&E;PN+tVBZSMw0EqX;tMpEg3U~CCF z^Z3Kix&cnCXi-oRL!}j71{6KkC~3gVi)xaZ<-LG0LF}P;W>8E#1%4r;dK{}Zzi@-9 zB@5Y%+L&%zpFzOGj0-RkmZUBud5d);8p-~&N*YM^>L3zZGtQKcqMZS657btx3$@nb zCAq+r;;PaNSS^feAItc0GXoy#SA9UAYvN*ee?tUA$Eun&;fzzShhphd| zDyE@wlvkr&DsJU-p|ifRV^N#Rc>o4tAPeWakA{n9dMZY0$+!{Q#+8Q*m56R7CdFzs zMyXu^no7XYHS|s78{}xQUaO!%y5N`7(<3KC*5SJkYcNx2+T(8|6bL4qpm~j0D9>}e zrEgKt^lDz9hNZ4uk-#N9B8ejm{Ls2mjhqiJJdQ@{sMlWjfumb30!R$57#p}XK);<| zv|-aFrI1XumEP&$T0>C1!AWRcjMuT`sXH@_aYq4^^~o&4g@S;G#P%ktUZHx94|rlK z%IfgMlLE-+d`?R|lk<+X(0fi>fLGJ0nwfK*P9zP8IYW1ftl8+-SFz*KeaM&CS@Cs%F z4g_`J_O(589DW!ACy>>FbN`cVU?@t7=cNpvMl5g^Ax>=E&Zia_3gKx+MwPlfz+&KS zqEG^<9Te>0pQ#FdH0ojI{I&o|R++fytEp7;$A7pWlHngV3?&I?blnID?=j}$1R!vs z2F(nDstUjWl>12r8pTl60`nTDj|m90Kv7y{KTHS_*!Y?fH3blE$iOKFJX4&$EhA=t zUj<8~XrHjDK3eA2BqT4hx^KWFrJJ8pYjl0%iV_OO4L87%mQo#TZ(b8qr`vhOpF8hr z!Kt7(DkWJW(d-ic1buKRlS_z2Nd?O$ z$Nb_&Vy?necvyyLn$OoVSZ_5g#(aAfMaEnYdL-@E&kt#11>knqsysBhh4ai~GTK%- z2WtB3$n(BM-kQB@Ma(YtvDD`~OV;}INL!bzY5{<}3g$`rI7ZfFYG_ZWj)4l+0sWr0;kmWr%rW5n(pI|ypQwL~ zj>aD8?@Z?@E7??C!G>Ektbo;7xL^xJ)@4I~kbh91Xf%lIEwrf~)+TS1zc#5llt1>) zP!?nrg;N#B70M)cgUBS3f+e>MmDCJU*+6w)Hz+efMIaT}xj@3G+^n8>k~#yS_5LG+ z&4;OpLu{Dcu_}yS=HmjWfhCiIF%6bsRP`nBeE$@6()N6+)9hxj;FaJvG0(42?Jr1W zULlJES(~c;R0uXTuCRPWgAPw|U3R+(L}t=5)&3Nv?d!ct8{fI9@2J|2XuRS~5F-(f z`5u?u8A)ADC*46=?yq|j+i}_?0`=M9=EEoyq+y5x&G$$afZcCfR%Qt(zH8N7OLF6L zeJ9Pkymk}Yp?ZBst-iBX&pEpobZWjsHDzFk((75@5*dT`kw=?(U~KEk?YVf?GVK|e z8+{7B_oaPCW;0V-#?zMV3`sMi`es`7^_1$%Db<&fnCSmOmQXbHP4v(X)i=_%p0Mhh z>Hq7Qwg#%cnl?@K(FD{s(f?N+eU|utNS#xCI;Q${P4u%5WC#D#Z7MSSzuf<}D7Ewd zhqyNWw{KGIf1)O-zW>o?s{dpCZ&Dig;eTyO{{MuHkpHiG66<6ai@A1I6HWA`7;F<2 z`efORvKQa3osyWWo5^#{L}@bJohn-C3nY&;G;|M}`@R!#`g~Z^nGjtvu;rX@&Agrt z4YAW9jySLMT*fj7d3vKGT=8Bar@3RG&Zwvp%J~TyT~6|Qxwj}XH+Ij56agyN_Hml@Vy0;0;W@)|#Z4uh@4i{)oz_ZU+&poiRZ1apPm<{EQjn zo`k}gY~IL`r5A$`W?cT>a2Yc|qq=W&Uy?508&rsrmPII=#I_!H1qq)y?10oIC*M2u zT_48k7QVTaA+NT#SKBL{3`g72t!vxdnwGisL6n>^#U})6BI3b1o==(#wEv*HiB-_= zA-I_~EAt``H}uvm+c)%IZk{)zazwMCNW2UAVF)m4@ptOkfN8p34$%?IrA9dCLE9)~ zH=MGMz|JswPVXZtA3h&6A}a>DjMzvnNPg6~S0W_mqflpZm)?*=8TZY)k-BojRWQRK z_~;;)(H_QcQ5K9t_zQs;D?vDN6CrrJTCZn(4*<^*ATpDSR$Q*Z5Td&yfNF}d^n>K% zEQWcCnCmGBq$-@a<;+mQu!9oxtF_gKr z{sFcVnePxS!kU@ycMkJfGL!LT&d2n<-7Ma4Jo&_ue7A` zZnliQ;y&2m-(m8$SGRUI8-?EAHDv6opWM9G$r^Uy&EdUcT;O4@gA+NG!EO)Wd(@J_^Y)!2@t zj#DBap?2M*EO`L>-rZmYL;o$}silXJ%}#^1GT zeymq-?P14z!+Znroj3nfB_Q7ALICp&R%#^N=->$`_*}xbN*MMSOk4qUjL}Pl;G0wg zaSch}(7X4;HHXcJAOwu@4GqLqHcGW0gL|40Gs`o zoARL$q)|sYcPZ!1`fTaej%74Yw!#+jJV%W1Pz2TZ1v@>WMgpK^PQNml`VBLDn|Z}! zP&cA9bmOB7|1yuKJ=~^qmwFM9n^@}gu$^viEOHBymW_~bl=y!;H^^?6i-qJokcRIu z09)o)mItGToqZGwR`x?%zmNCk=H{8i2%PG$r{ z+`13Y1~e*V{`WCQ(l#&4%ohOR@hWkvo@4}po7-qTQ?uhVX}!Z2lVDz z7D+Mj`5pmS!QHfFcQ^xf(7Jh+Z=N^h%aZtEK2XT!Z){z7OrgwNKmOH&F4l>%o*7?wanJd`5qjRIh&pAK-?{} zzY{ZI<$P6v^h$kAFGsQ{a`8^7ii|Ap<}gVIVqTM5g)BzAm&#Y}HLOfyAdtLdIbCng% zuYBs(3Ta8JNawLe6qJ>nG1;I(hy3LAsxCwH1pmuSMiQT>3kut!rkbH2i@Xl%K$-Qw z$rI1fI8oxixgyKFN8mQKRhowC7SBSqCI}Y3XMg?plV5?^xL$xbQ!>X&pZKU(@|Mz2 z$*m#u0LlWx`(F}~g?mSL+?+lpvX!9qBiyIouf8A62im8q^`Wo#ip?~Rw-5t=$BvU) zG73}%hF*|H|BlIzT>EeCgNFPu#pn+C-M%xhQJ3398F}Ym&$8Ss2|LxHWR@9KsiR&7 zqJ&%*l^_Y3%d-AUx36tY#U=&Rd9^`TovEyfVzHt*;41{|v%rKPN7aT!G_dWV%0fGi zC8+tBG|@DqtDEP?<*vv(r$OSH2hOi8m@#lNF_dQ0G(#j_q|SqyCM+-MQ8kJ0UOzZ0 zZ40fEP`56!LDkTe$z_MO6XctU9e&I0i5y3a_JQfchKM{jBiSK)7%xHyCZpOzYYh@s z%Gh!wi`=s_v0go%Ehiq32xY2GFidlx#wRh2be?G&h9;nwGjMSRndA!%+z>h#nn+?Y zwi1j2tgpIlB9Jg+dL^R{wPHA-6M!!^-g+VRuu_GWnJNV+(V~CEkpdlHg3{jh8o@-S zQ7%&{h>lC*?MGjM_Mv=cU>XD2ftAH6P}SHqR7sudjtE9-TTiq)Pr=2rJxg_lWpknB z&{r*9@)*mi)+(2J*t?lVx#(K%K#32z+Ec1%+7l}k!n6UgL6IynsNFw;c~$|!3KRx0 zssFpR-H6_8Sl(Q~@(c1Ur;K9+7bCNhsF)cv&D2=o&dv<4FJ|ezr^-=Yb@7KC4pp^3 zZL-M~xtk&TzHDR55v7nD3M>T;pHq>QOQj>@QOQlw|7+d=<2JV@9fvw8CD@nJ2i#5? zujt!B>7Ay(t%dFRRhvM-BMN;)8hHav**#@I{KY!DH=b<8?(s7xjmulkbTieMHf>)q z9I@*Lo)u~e#Yia;yOwDQBqP-Gl62jcY_fqcrd77vO+Y!sQyD==<8MSL`5Gd5G;Pr! zZ;@=XXUqiH_avh2UA<|ih2Yx>ksWQ zxA&u0W1N|BL5GdnF8Qv1k!n{3T2yq4uWh|Lof)l?YqyswAU_3^6^h)T24*}b-inCh z7Ig%2=qrSWgi(76+j^0gs#NCzoWsF?A*HGhM1ZUdGB`2{UIx6tgs`_#>^dVccKwJdVyuDVb;@~OqgD0i@v}E>zUUMzjTiP<+W0Ab;zXHL~ zd?r*+tBc@L%L(j;tr=Zw+Ep671$hD46QA18G-R0xJaVTk=42|IA%1Gk|BkLLCq>ux z_<@fjly2<=UiHuAdK&%Sf6Ig2gWd1J>*M41@$1<&D>au#Gf}^9(>U-7+RV>r2k?VB zMi?252yAtaucQb-@u;~D-=YTZPMLhD;hHNAvp&CiSf&!$byuDqPY|B8gI8+;3feLz z(Hs)iOLt9YVJXvS5a=uwd2-_50e#xUve=Vs9V5dxA%+KDK%W1uM)ww;B{TVdhFvTQ z9af<3*@1S8h6eP$Kiv}&mlYsn&N^PD#t-5cvxW+FDhA(gu5)s!@?N`oft6oA_iFrO zzg9;_Uu`kSZDhjJI!Tlje|)cLuQJPDU8-!}9Io+d>pkG0Zz)++L4g+rYqDYmiu);@ zY8iV{b@{5X2;K9~Qlrjfs+f`1f0?JI$D9vVNSA4ky;|mWA{w@p0d=M!e3KsOko=2bLT&~-uH|4+T*+E%Trid zmlgVZ(mqf7EK>-}*v+ZMP5IpWvrL!h4FSl4S`Z>48MP{uz(}`^vJ%l9`gQXGC4VMn zM1z#c(?%^#xr%a5A6?(fnD>#z{kN&g>ua;3y8rtysA`@rnxr|bCw@KX&&k|lSygWJ z4h@;+L7Yuu%at|E8?}-&UDoGO8L2ecsMYh+Q(w01Zxxum>>1BLHzP+|Cj9#ix5B^& ztuWs<_aLAg`GTS(OEqs?l(x-%cY2DkoaN6?xB7^A+EuU}`AVUm4Myyfb9928;koU> zH|jV%CRdcz>&FvwzM8`1&M@+79$Hn9clvwAGsEULE+NU^ej>^@)tquMM$!Gw&(WR` zReFPI`KQ1V#Q}-70?_Ajg|9`ghh}&j465H{m$q4bdRCRGf6#jES-F7J_1k-GMz2o) zM)i8td(D6Ay&e|WoyF7;tEWN8B5&<||2iuXNJEz4t~=SH&R1c3_7hXz>URt1>{F zJ%^dFi7lCok+|IevpLXrBp`t!pXG%C0>ryV)@LL;Fq^nFT6S{g?A5Qa8`^=OH@P7n z_&SOJ!#&$}3$0*bjR&9$6Cgb$Lft;<0&UL~Lzkr3h~ou-Sx)#8r!M;P_EwSb&lOkt zO%ewFvW37y2FF!~*kllY2~x(*Bt$5p3zIT_OO9BOq~wB?_qUa+DOm8icMauVp0XT6xjTN|Th_*O5t!i&3_43(2EB z1vDo{;st*0Yx|y7HC`Y%c310*k<4h&X~3HPomb^#I(a!iQu*1c?03=X-n?^Fe_r+2 zN$v1GYyCI5j5W|5hkJ}k0>b7B;6xfEG!oU*6TKl70=%+yVh=#o!H!xj+M}^s z9b~;fZM2t`F>KAG?ZAip>OR}YX}(N~=(T}~u*t1zo5?NWxmq_n+kdZ6f#H=HZEo`3 zy?biSVl{Z19Vf9Mdc>SGpZtNex)y3l&#PoQXAb0LNlJ<()^J~U9qUxy&| z423R7mJ)!LG@=j*TprGq>V8mX}5~V?Fh|jak_+9KM40(nj`=}_^F8Eg?&!nojI3g za#6rVKjD=%990|~9&gushl9Td7WXG7?Qi2>1!&NxkH2=rO!Gc4x#Bp9b_)B{q2cJ{vSX7Ike=cy&eL zp7j2u7l(t3>d-h;u?svN6vIw$RBjSp@}q*V6}3hl?I^?7{?QnE{vQ~5iy}HZs_m@K z;EX)l>eU!}YPP7u+M^G5k}&oD+>AYEcMG#eZl*5iG25ww=qpzH$~$)6sO{ae9k{y= z=p**0j{=W=zyp7&!XDfHfe3o0F=mZFaY7zjmTN5D--LAf;2cUo1wiiG+RF46NSes( z#(^BBih{z`?FjnPEdyHmc+Wlc@vMj1vhI&c$bHK#6U?&D!ZBJ04LXOA*ZOVDG?(*)C3Y~OL@RR-BlhcKtZN^B9ir?bYW6*p!(TSvxX zUA(kva{cSY@M-)ZvZ=e2JE1k8Wt0E9g#MhLOljGVZ${@IlSBbaM)z31UdHc!qJJgM z@8cjPM@SA2&-uAva4;X6f2Ig_K6EK_RNoaY8{zDO7^)tKK1Qi8@fP%Fd_0fWJqHy& z;?@HQqt3gPVhAgl*fL_Ci9Cbh0>Ugd;tSmy_qc+d|Kj4SSeHB>rz?0fc7Hvh2_Q6> zb3*N{uCA8zD@UW$r58XG85C%VJiA3)>cO6Rlj;s=v^9eGx&dW{aZxP~j6_hLsT)Rl z1UK=_NueQg9HvPT47Ebewb8M%;sYUI{$*97srQTWla454l>{+Kuh0k(H=1D_NA|Dl>QGq9hPxM) z>83+Oan2c$Cp8tyFT4Zd!MyEf#~CHPu@pJle`NvjXO8I-sLvQOw{@uU zd1~G+m?*gAtr_2o^13-+UM3E+G%pZ zI)@2nuY&oyLgBs+^Gn<(38Pvnung6Uu9Om&3mIf{HgwA^>eQ%hIbpnTZFAmhuf!$_ zT;gQt6TTA(IF5oi8sNz54?3BIiLMF zSM1x&eIjS1UQaFE8h-WW`W35>OgZy?d#I9D**D!gJ0k02mz;IdH%asmT_v!rOvR~M z->5~>QKx-(!(PKn*Ipav*SJ3y3SXexR#kiEWZ!?L@A|sa6Tk7cC!WiVe0SiixlCJS zeZ8f9G+%Pwn)ElWg+(fJ4%ZewaCTcNzpZ+A>({`YcT{zk>!wydpZ{fR#J!OC&{cUI z>AtIW^JO2}Z8^zy-Awm|N?ccyJPx# literal 0 HcmV?d00001 diff --git a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json index 7f281d5c0f2..9dbe2d7b2c5 100644 --- a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json +++ b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json @@ -42,140 +42,236 @@ "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", - "analyticRuleVersion1": "1.0.1", - "analyticRulecontentId1": "5a6ce089-e756-40fb-b022-c8e8864a973a", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1')))]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "analyticRuleVersion2": "1.0.1", - "analyticRulecontentId2": "64d16e62-1a17-4a35-9ea7-2b9fe6f07118", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2')))]", - "analyticRuleVersion3": "1.0.1", - "analyticRulecontentId3": "3094e036-e5ae-4d6e-8626-b0f86ebc71f2", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3')))]", + "_solutionName": "Salesforce Service Cloud", + "_solutionVersion": "3.0.0", "uiConfigId1": "SalesforceServiceCloud", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "SalesforceServiceCloud", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", - "parserVersion1": "1.0.0", - "parserContentId1": "SalesforceServiceCloud-Parser", - "_parserContentId1": "[variables('parserContentId1')]", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "parserName1": "SalesforceServiceCloud", "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1')))]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", + "parserVersion1": "1.0.0", + "parserContentId1": "SalesforceServiceCloud-Parser", + "_parserContentId1": "[variables('parserContentId1')]", + "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "SalesforceServiceCloudWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", - "_workbookContentId1": "[variables('workbookContentId1')]" + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleVersion1": "1.0.1", + "analyticRulecontentId1": "5a6ce089-e756-40fb-b022-c8e8864a973a", + "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", + "analyticRuleVersion2": "1.0.1", + "analyticRulecontentId2": "64d16e62-1a17-4a35-9ea7-2b9fe6f07118", + "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", + "analyticRuleVersion3": "1.0.1", + "analyticRulecontentId3": "3094e036-e5ae-4d6e-8626-b0f86ebc71f2", + "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Salesforce Service Cloud Analytics Rule 1 with template", - "displayName": "Salesforce Service Cloud Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName1'),'/',variables('analyticRuleVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Salesforce-BruteForce_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "Salesforce Service Cloud data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('dataConnectorVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId1')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", + "kind": "GenericUI", "properties": { - "description": "Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.", - "displayName": "Brute force attack against user credentials", - "enabled": false, - "query": "let failureCountThreshold = 10;\nlet successCountThreshold = 1;\nlet Failures =\nSalesforceServiceCloud\n| where EventType == \"Login\" and LoginStatus != \"LOGIN_NO_ERROR\"\n| summarize\n FailureStartTime = min(TimeGenerated),\n FailureEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n FailureCount = count() by User, UserId, UserType;\n SalesforceServiceCloud\n | where EventType == \"Login\" and LoginStatus == \"LOGIN_NO_ERROR\"\n | summarize\n SuccessStartTime = min(TimeGenerated),\n SuccessEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n SuccessCount = count() by User, UserId, UserType\n | join kind=leftouter Failures on UserId\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\n | where FailureEndTime < SuccessStartTime\n | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses\n", - "queryFrequency": "PT20M", - "queryPeriod": "PT20M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "SalesforceServiceCloud" - ], - "connectorId": "SalesforceServiceCloud" - } - ], - "tactics": [ - "CredentialAccess" - ], - "techniques": [ - "T1110" - ], - "entityMappings": [ - { - "fieldMappings": [ + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "Salesforce Service Cloud (using Azure Functions)", + "publisher": "Salesforce", + "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "SalesforceServiceCloud_CL", + "baseQuery": "SalesforceServiceCloud_CL" + } + ], + "sampleQueries": [ + { + "description": "Last Salesforce Service Cloud EventLogFile Events", + "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "SalesforceServiceCloud_CL", + "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ { - "columnName": "User", - "identifier": "FullName" + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } } ], - "entityType": "Account" - } - ], - "customDetails": { - "EventStartTime": "FailureStartTime", - "EventEndTime": "SuccessEndTime", - "IPAddresses": "IpAddresses" + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." + }, + { + "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." + }, + { + "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." + }, + { + "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" + }, + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" + } + ] + }, + { + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "description": "Salesforce Service Cloud Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Salesforce Service Cloud", @@ -194,199 +290,240 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "Salesforce Service Cloud (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "properties": { - "description": "Salesforce Service Cloud Analytics Rule 2 with template", - "displayName": "Salesforce Service Cloud Analytics Rule template" + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "Salesforce Service Cloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName2'),'/',variables('analyticRuleVersion2'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName2'))]" - ], + "kind": "GenericUI", "properties": { - "description": "Salesforce-PasswordSpray_AnalyticalRules Analytics Rule with template version 2.0.4", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId2')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.", - "displayName": "Potential Password Spray Attack", - "enabled": false, - "query": "let FailureThreshold = 15; \nSalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus != 'LOGIN_NO_ERROR'\n| where LoginStatus in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')\n| summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimeGenerated, 5m)\n| where UserCount > FailureThreshold\n", - "queryFrequency": "PT5M", - "queryPeriod": "PT5M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "SalesforceServiceCloud" - ], - "connectorId": "SalesforceServiceCloud" - } - ], - "tactics": [ - "CredentialAccess" - ], - "techniques": [ - "T1110" - ], - "entityMappings": [ - { - "fieldMappings": [ - { - "columnName": "ClientIp", - "identifier": "Address" - } - ], - "entityType": "IP" - } - ], - "customDetails": { - "Users": "Users" + "connectorUiConfig": { + "title": "Salesforce Service Cloud (using Azure Functions)", + "publisher": "Salesforce", + "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "SalesforceServiceCloud_CL", + "baseQuery": "SalesforceServiceCloud_CL" + } + ], + "dataTypes": [ + { + "name": "SalesforceServiceCloud_CL", + "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Last Salesforce Service Cloud EventLogFile Events", + "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true } } + ], + "customs": [ + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", - "properties": { - "description": "Salesforce Service Cloud Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", - "source": { - "kind": "Solution", - "name": "Salesforce Service Cloud", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." + }, + { + "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." + }, + { + "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." + }, + { + "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Workspace ID" + }, + "type": "CopyableLabel" }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com/" + { + "parameters": { + "fillWith": [ + "PrimaryKey" + ], + "label": "Primary Key" + }, + "type": "CopyableLabel" } - } + ] + }, + { + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Option 1 - Azure Resource Manager (ARM) Template", + "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy." + }, + { + "title": "Option 2 - Manual Deployment of Azure Functions", + "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", + "instructions": [ + { + "parameters": { + "instructionSteps": [ + { + "title": "Step 1 - Deploy a Function App", + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files." + }, + { + "title": "Step 2 - Configure the Function App", + "description": "1. Go to Azure Portal for the Function App configuration.\n2. In the Function App, select the Function App Name and select **Configuration**.\n3. In the **Application settings** tab, select **+ New application setting**.\n4. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n5. Once all application settings have been entered, click **Save**." + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] } - ] + ], + "id": "[variables('_uiConfigId1')]", + "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution." } } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('analyticRuleTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, - "properties": { - "description": "Salesforce Service Cloud Analytics Rule 3 with template", - "displayName": "Salesforce Service Cloud Analytics Rule template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('analyticRuleTemplateSpecName3'),'/',variables('analyticRuleVersion3'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "AnalyticsRule" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('analyticRuleTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Salesforce-SigninsMultipleCountries_AnalyticalRules Analytics Rule with template version 2.0.4", + "description": "SalesforceServiceCloud Data Parser with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", + "contentVersion": "[variables('parserVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('AnalyticRulecontentId3')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "name": "[variables('_parserName1')]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { - "description": "This query searches for successful user logins from different countries within 30min.", - "displayName": "User Sign in from different countries", - "enabled": false, - "query": "let threshold = 2;\nlet Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\n[@\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\"];\nlet UsersLocation = SalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'\n| project TimeGenerated, ClientIp, UserId, User, UserType ;\nUsersLocation\n| extend Dummy=1\n| summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy\n| partition by Hour(\n lookup (Countrydb|extend Dummy=1) on Dummy\n | where ipv4_is_match(ClientIp, Network)\n )\n| summarize NumOfCountries = dcount(country_name) by User, Hour\n| where NumOfCountries >= threshold\n", - "queryFrequency": "PT30M", - "queryPeriod": "PT30M", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "SalesforceServiceCloud" - ], - "connectorId": "SalesforceServiceCloud" - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1078" - ], - "entityMappings": [ + "eTag": "*", + "displayName": "SalesforceServiceCloud", + "category": "Samples", + "functionAlias": "SalesforceServiceCloud", + "query": "\nSalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s", + "functionParameters": "", + "version": 1, + "tags": [ { - "fieldMappings": [ - { - "columnName": "User", - "identifier": "AadUserId" - } - ], - "entityType": "Account" + "name": "description", + "value": "SalesforceServiceCloud" } ] } @@ -394,16 +531,18 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "dependsOn": [ + "[variables('_parserName1')]" + ], "properties": { - "description": "Salesforce Service Cloud Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", "source": { - "kind": "Solution", "name": "Salesforce Service Cloud", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -419,187 +558,114 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_parserContentId1')]", + "contentKind": "Parser", + "displayName": "SalesforceServiceCloud", + "contentProductId": "[variables('_parsercontentProductId1')]", + "id": "[variables('_parsercontentProductId1')]", + "version": "[variables('parserVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('_parserName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "properties": { - "description": "Salesforce Service Cloud data connector with template", - "displayName": "Salesforce Service Cloud template" + "eTag": "*", + "displayName": "SalesforceServiceCloud", + "category": "Samples", + "functionAlias": "SalesforceServiceCloud", + "query": "\nSalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s", + "functionParameters": "", + "version": 1, + "tags": [ + { + "name": "description", + "value": "SalesforceServiceCloud" + } + ] } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[variables('_parserId1')]" ], "properties": { - "description": "Salesforce Service Cloud data connector with template version 2.0.4", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", + "contentId": "[variables('_parserContentId1')]", + "kind": "Parser", + "version": "[variables('parserVersion1')]", + "source": { + "kind": "Solution", + "name": "Salesforce Service Cloud", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SalesforceServiceCloudWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "Sets the time name for analysis." + }, "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "Salesforce Service Cloud (using Azure Function)", - "publisher": "Salesforce", - "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", - "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "SalesforceServiceCloud_CL", - "baseQuery": "SalesforceServiceCloud_CL" - } - ], - "sampleQueries": [ - { - "description": "Last Salesforce Service Cloud EventLogFile Events", - "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" - } - ], - "dataTypes": [ - { - "name": "SalesforceServiceCloud_CL", - "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." - }, - { - "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." - }, - { - "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." - }, - { - "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" - }, - { - "parameters": { - "fillWith": [ - "PrimaryKey" - ], - "label": "Primary Key" - }, - "type": "CopyableLabel" - } - ] - }, - { - "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Option 1 - Azure Resource Manager (ARM) Template" - }, - { - "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", - "title": "Option 2 - Manual Deployment of Azure Functions" - }, - { - "description": "**1. Deploy a Function App**\n\n> NOTE:You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SalesforceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n3. Once all application settings have been entered, click **Save**." - } - ] - } + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "description": "@{workbookKey=SalesforceServiceCloudWorkbook; logoFileName=salesforce_logo.svg; description=Sets the time name for analysis.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Salesforce Service Cloud; templateRelativePath=SalesforceServiceCloud.json; subtitle=; provider=Salesforce}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "Salesforce Service Cloud", @@ -614,247 +680,224 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "SalesforceServiceCloud", + "kind": "DataType" + }, + { + "contentId": "SalesforceServiceCloud_CL", + "kind": "DataConnector" + } + ] } } } ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId1')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Salesforce Service Cloud", - "sourceId": "[variables('_solutionId')]" }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com/" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "connectorUiConfig": { - "title": "Salesforce Service Cloud (using Azure Function)", - "publisher": "Salesforce", - "descriptionMarkdown": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides ability to review events in your org on an accelerated basis, get [event log files](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/event_log_file_hourly_overview.htm) in hourly increments for recent activity.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "SalesforceServiceCloud_CL", - "baseQuery": "SalesforceServiceCloud_CL" - } - ], - "dataTypes": [ - { - "name": "SalesforceServiceCloud_CL", - "lastDataReceivedQuery": "SalesforceServiceCloud_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "SalesforceServiceCloud_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ + "description": "Salesforce-BruteForce_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ { - "description": "Last Salesforce Service Cloud EventLogFile Events", - "query": "SalesforceServiceCloud\n | sort by TimeGenerated desc" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId1')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Identifies evidence of brute force activity against a user based on multiple authentication failures \nand at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses\nThe default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.", + "displayName": "Brute force attack against user credentials", + "enabled": false, + "query": "let failureCountThreshold = 10;\nlet successCountThreshold = 1;\nlet Failures =\nSalesforceServiceCloud\n| where EventType == \"Login\" and LoginStatus != \"LOGIN_NO_ERROR\"\n| summarize\n FailureStartTime = min(TimeGenerated),\n FailureEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n FailureCount = count() by User, UserId, UserType;\n SalesforceServiceCloud\n | where EventType == \"Login\" and LoginStatus == \"LOGIN_NO_ERROR\"\n | summarize\n SuccessStartTime = min(TimeGenerated),\n SuccessEndTime = max(TimeGenerated),\n IpAddresses = make_set (ClientIp, 100),\n SuccessCount = count() by User, UserId, UserType\n | join kind=leftouter Failures on UserId\n | where FailureCount >= failureCountThreshold and SuccessCount >= successCountThreshold\n | where FailureEndTime < SuccessStartTime\n | project User, EventStartTime = FailureStartTime, EventEndTime = SuccessEndTime, IpAddresses\n", + "queryFrequency": "PT20M", + "queryPeriod": "PT20M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "SalesforceServiceCloud", + "dataTypes": [ + "SalesforceServiceCloud" + ] + } + ], + "tactics": [ + "CredentialAccess" + ], + "techniques": [ + "T1110" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "User", + "identifier": "FullName" + } + ] + } + ], + "customDetails": { + "IPAddresses": "IpAddresses", + "EventEndTime": "SuccessEndTime", + "EventStartTime": "FailureStartTime" } } - ], - "customs": [ - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "**Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** is required for REST API. [See the documentation to learn more about API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm)." - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to the Salesforce Lightning Platform REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." - }, - { - "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." - }, - { - "description": ">**NOTE:** Ingesting data from on an hourly interval may require additional licensing based on the edition of the Salesforce Service Cloud being used. Please refer to [Salesforce documentation](https://www.salesforce.com/editions-pricing/service-cloud/) and/or support for more details." }, { - "description": "**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Salesforce Service Cloud data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Salesforce API Authorization credentials, readily available.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Workspace ID" - }, - "type": "CopyableLabel" + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "properties": { + "description": "Salesforce Service Cloud Analytics Rule 1", + "parentId": "[variables('analyticRuleId1')]", + "contentId": "[variables('_analyticRulecontentId1')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion1')]", + "source": { + "kind": "Solution", + "name": "Salesforce Service Cloud", + "sourceId": "[variables('_solutionId')]" }, - { - "parameters": { - "fillWith": [ - "PrimaryKey" - ], - "label": "Primary Key" - }, - "type": "CopyableLabel" + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com/" } - ] - }, - { - "description": "Use this method for automated deployment of the Salesforce Service Cloud data connector using an ARM Tempate.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SalesforceServiceCloud-azuredeploy)\n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the **Workspace ID**, **Workspace Key**, **Salesforce API Username**, **Salesforce API Password**, **Salesforce Security Token**, **Salesforce Consumer Key**, **Salesforce Consumer Secret** and deploy. \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Option 1 - Azure Resource Manager (ARM) Template" - }, - { - "description": "Use the following step-by-step instructions to deploy the Salesforce Service Cloud data connector manually with Azure Functions (Deployment via Visual Studio Code).", - "title": "Option 2 - Manual Deployment of Azure Functions" - }, - { - "description": "**1. Deploy a Function App**\n\n> NOTE:You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SalesforceXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.8.\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration." - }, - { - "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective string values (case-sensitive): \n\t\tSalesforceUser\n\t\tSalesforcePass\n\t\tSalesforceSecurityToken\n\t\tSalesforceConsumerKey\n\t\tSalesforceConsumerSecret\n\t\tWorkspaceID\n\t\tWorkspaceKey\n\t\tlogAnalyticsUri (optional)\n - Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://.ods.opinsights.azure.us`\n3. Once all application settings have been entered, click **Save**." + } } - ], - "id": "[variables('_uiConfigId1')]", - "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution." - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('parserTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, - "properties": { - "description": "SalesforceServiceCloud Data Parser with template", - "displayName": "SalesforceServiceCloud Data Parser template" + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId1')]", + "contentKind": "AnalyticsRule", + "displayName": "Brute force attack against user credentials", + "contentProductId": "[variables('_analyticRulecontentProductId1')]", + "id": "[variables('_analyticRulecontentProductId1')]", + "version": "[variables('analyticRuleVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('parserTemplateSpecName1'),'/',variables('parserVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Parser" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('parserTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SalesforceServiceCloud Data Parser with template version 2.0.4", + "description": "Salesforce-PasswordSpray_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('analyticRuleVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", - "apiVersion": "2020-08-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId2')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "SalesforceServiceCloud", - "category": "Samples", - "functionAlias": "SalesforceServiceCloud", - "query": "\nSalesforceServiceCloud_CL \r\n| extend \r\n\t\tRequestSize=column_ifexists('request_size_s',''),\r\n\t\tExecTime=column_ifexists('exec_time_s',''),\r\n\t\tAction=column_ifexists('action_s',''),\r\n\t\tPlatformType=column_ifexists('platform_type_s',''),\r\n\t\tOsName=column_ifexists('os_name_s',''),\r\n\t\tOsVersion=column_ifexists('os_version_s',''),\r\n\t\tTimestamp=column_ifexists('timestamp_s',''),\r\n\t\tStatusCode=column_ifexists('status_code_s',''),\r\n\t\tEventType=column_ifexists('event_type_s',''),\r\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\r\n\t\tUserAgent=column_ifexists('user_agent_s',''),\r\n\t\tBrowserType=column_ifexists('browser_type_s',''),\r\n\t\tTime=column_ifexists('time_s',''),\r\n\t\tResponseSize=column_ifexists('response_size_s',''),\r\n\t\tDeviceId=column_ifexists('device_id_s',''),\r\n\t\tDeviceModel=column_ifexists('device_model_s',''),\r\n\t\tSourceIp=column_ifexists('source_ip_s',''),\r\n\t\tClientIp=column_ifexists('client_ip_s',''),\r\n\t\tSuccess=column_ifexists('success_s',''),\r\n\t\tUri=column_ifexists('uri_s',''),\r\n\t\tUrl=column_ifexists('url_s',''),\r\n\t\tClientName=column_ifexists('client_name_s',''),\r\n\t\tUserType=column_ifexists('user_type_s',''),\r\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\r\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\r\n\t\tUserId=column_ifexists('user_id_s',''),\r\n\t\tUserEmail=column_ifexists('user_email_s',''),\r\n\t\tUser=column_ifexists('user_name_s',''),\r\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\r\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\r\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\r\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\r\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\r\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\r\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\r\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\r\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\r\n\t\tSort=column_ifexists('sort_s',''),\r\n\t\tSessionType=column_ifexists('session_type_s',''),\r\n\t\tSessionLevel=column_ifexists('session_level_s',''),\r\n\t\tSessionKey=column_ifexists('session_key_s',''),\r\n\t\tSearchQuery=column_ifexists('search_query_s',''),\r\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\r\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\r\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\r\n\t\tRunTime=column_ifexists('run_time_s',''),\r\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\r\n\t\tRowCount=column_ifexists('row_count_s',''),\r\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\r\n\t\tRequestStatus=column_ifexists('request_status_s',''),\r\n\t\tRequestId=column_ifexists('request_id_s',''),\r\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\r\n\t\tReportId=column_ifexists('report_id_s',''),\r\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\r\n\t\tRelatedList=column_ifexists('related_list_s',''),\r\n\t\tRecordType=column_ifexists('record_type_s',''),\r\n\t\tRecordId=column_ifexists('record_id_s',''),\r\n\t\tQuiddity=column_ifexists('quiddity_s',''),\r\n\t\tQueryId=column_ifexists('query_id_s',''),\r\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\r\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\r\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\r\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\r\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\r\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\r\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\r\n\t\tPageUrl=column_ifexists('page_url_s',''),\r\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\r\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\r\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\r\n\t\tPageContext=column_ifexists('page_context_s',''),\r\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\r\n\t\tOrigin=column_ifexists('origin_s',''),\r\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\r\n\t\tNumResults=column_ifexists('num_results_s',''),\r\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\r\n\t\tNumberFields=column_ifexists('number_fields_s',''),\r\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\r\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\r\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\r\n\t\tMethodName=column_ifexists('method_name_s',''),\r\n\t\tMethod=column_ifexists('method_s',''),\r\n\t\tMediaType=column_ifexists('media_type_s',''),\r\n\t\tLoginStatus=column_ifexists('login_status_s',''),\r\n\t\tLoginKey=column_ifexists('login_key_s',''),\r\n\t\tHttpMethod=column_ifexists('http_method_s',''),\r\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\r\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\r\n\t\tEntityName=column_ifexists('entity_name_s',''),\r\n\t\tEntity=column_ifexists('entity_s',''),\r\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\r\n\t\tDuration=column_ifexists('duration_s',''),\r\n\t\tDisplayType=column_ifexists('display_type_s',''),\r\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\r\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\r\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\r\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\r\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\r\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\r\n\t\tConnectionType=column_ifexists('connection_type_s',''),\r\n\t\tComponentName=column_ifexists('component_name_s',''),\r\n\t\tClientVersion=column_ifexists('client_version_s',''),\r\n\t\tClientId=column_ifexists('client_id_s',''),\r\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\r\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\r\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\r\n\t\tBrowserName=column_ifexists('browser_name_s',''),\r\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\r\n\t\tAppType=column_ifexists('app_type_s',''),\r\n\t\tAppName=column_ifexists('app_name_s',''),\r\n\t\tApiVersion=column_ifexists('api_version_s',''),\r\n\t\tApiType=column_ifexists('api_type_s',''),\r\n ArticleVersionId=column_ifexists('article_version_id_s',''),\r\n\t\tArticleVersion=column_ifexists('article_version_s',''),\r\n\t\tArticleStatus=column_ifexists('article_status_s',''),\r\n\t\tArticleId=column_ifexists('article_id_s',''),\r\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\r\n BatchId=column_ifexists('batch_id_s',''),\r\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\r\n\t\tClassName=column_ifexists('class_name_s',''),\r\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\r\n\t\tComponentId=column_ifexists('component_id_s',''),\r\n ControllerType=column_ifexists('controller_type_s',''),\r\n\t\tContext=column_ifexists('context_s',''),\r\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\r\n\t\tConsoleId=column_ifexists('console_id_s',''), \r\n ClientInfo=column_ifexists('client_info_s',''),\r\n DstBytes=column_ifexists('request_size_s',''),\r\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\r\n DstUserSid=column_ifexists('delegated_user_id_s',''),\r\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\r\n Data=column_ifexists('data_s',''),\r\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\r\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\r\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\r\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\r\n\t\tDvcAction=column_ifexists('action_s',''),\r\n\t\tDvcOS=column_ifexists('platform_type_s',''),\r\n\t\tDvcOSName=column_ifexists('os_name_s',''),\r\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\r\n DeliveryLocation=column_ifexists('delivery_location_s',''),\r\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\r\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\r\n\t\tDocumentId=column_ifexists('document_id_s',''),\r\n EntityType=column_ifexists('entity_type_s',''),\r\n EntityId=column_ifexists('entity_id_s',''),\r\n FileType=column_ifexists('file_type_s',''),\r\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\r\n\t\tExceptionType=column_ifexists('exception_type_s',''),\r\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\r\n\t\tEpt=column_ifexists('ept_s',''),\r\n EventCount=column_ifexists('number_of_records_s',''),\r\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\r\n\t\tEventResult=column_ifexists('status_code_s',''),\r\n\t\tFileSize=column_ifexists('size_bytes_s',''),\r\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\r\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\r\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\r\n LogGroupId=column_ifexists('log_group_id_s',''),\r\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\r\n\t\tLicenseContext=column_ifexists('license_context_s',''),\r\n\t\tLastVersion=column_ifexists('last_version_s',''),\r\n\t\tLanguage=column_ifexists('language_s',''),\r\n\t\tJobId=column_ifexists('job_id_s',''),\r\n\t\tIsSuccess=column_ifexists('is_success_s',''),\r\n\t\tIsSecure=column_ifexists('is_secure_s',''),\r\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\r\n\t\tIsNew=column_ifexists('is_new_s',''),\r\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\r\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\r\n\t\tIsGuest=column_ifexists('is_guest_s',''),\r\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\r\n\t\tIsError=column_ifexists('is_error_s',''),\r\n\t\tIsApi=column_ifexists('is_api_s',''),\r\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\r\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\r\n HttpHeaders=column_ifexists('http_headers_s',''),\r\n\t\tNetworkDuration=column_ifexists('time_s',''),\r\n Name=column_ifexists('name_s',''),\r\n NumberFailures=column_ifexists('number_failures_s',''),\r\n NumClicks=column_ifexists('num_clicks_s',''),\r\n OperationType=column_ifexists('operation_type_s',''),\r\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\r\n PageName=column_ifexists('page_name_s',''),\r\n Query=column_ifexists('query_s',''),\r\n RequestType=column_ifexists('request_type_s',''),\r\n ReportDescription=column_ifexists('report_description_s',''),\r\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\r\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\r\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\r\n ReadTime=column_ifexists('read_time_s',''),\r\n\t\tRank=column_ifexists('rank_s',''),\r\n\t\tSrcBytes=column_ifexists('response_size_s',''),\r\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\r\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\r\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\r\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\r\n SessionId=column_ifexists('session_id_s',''),\r\n SiteId=column_ifexists('site_id_s',''),\r\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\r\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\r\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\r\n\t\tUrlOriginal=column_ifexists('url_s',''),\r\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\r\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\r\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\r\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\r\n\t\tVersionId=column_ifexists('version_id_s',''),\r\n TriggerType=column_ifexists('trigger_type_s',''),\r\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\r\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\r\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\r\n\t\tTotalTime=column_ifexists('total_time_s',''),\r\n TabId=column_ifexists('tab_id_s',''),\r\n\t\tStackTrace=column_ifexists('stack_trace_s','')\r\n| project-away *_s", - "version": 1, - "tags": [ + "description": "This query searches for failed attempts to log in from more than 15 various users within a 5 minute timeframe from the same source. This is a potential indication of a password spray attack.", + "displayName": "Potential Password Spray Attack", + "enabled": false, + "query": "let FailureThreshold = 15; \nSalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus != 'LOGIN_NO_ERROR'\n| where LoginStatus in~ ('LOGIN_ERROR_INVALID_PASSWORD', 'LOGIN_ERROR_SSO_PWD_INVALID')\n| summarize UserCount=dcount(UserId), Users = make_set(UserId,100) by ClientIp, bin(TimeGenerated, 5m)\n| where UserCount > FailureThreshold\n", + "queryFrequency": "PT5M", + "queryPeriod": "PT5M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "SalesforceServiceCloud" + "connectorId": "SalesforceServiceCloud", + "dataTypes": [ + "SalesforceServiceCloud" + ] } - ] + ], + "tactics": [ + "CredentialAccess" + ], + "techniques": [ + "T1110" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "ClientIp", + "identifier": "Address" + } + ] + } + ], + "customDetails": { + "Users": "Users" + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserName1')]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", + "description": "Salesforce Service Cloud Analytics Rule 2", + "parentId": "[variables('analyticRuleId2')]", + "contentId": "[variables('_analyticRulecontentId2')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion2')]", "source": { - "name": "Salesforce Service Cloud", "kind": "Solution", + "name": "Salesforce Service Cloud", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -870,114 +913,92 @@ } } ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2021-06-01", - "name": "[variables('_parserName1')]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "SalesforceServiceCloud", - "category": "Samples", - "functionAlias": "SalesforceServiceCloud", - "query": "\nSalesforceServiceCloud_CL \r\n| extend \r\n\t\tRequestSize=column_ifexists('request_size_s',''),\r\n\t\tExecTime=column_ifexists('exec_time_s',''),\r\n\t\tAction=column_ifexists('action_s',''),\r\n\t\tPlatformType=column_ifexists('platform_type_s',''),\r\n\t\tOsName=column_ifexists('os_name_s',''),\r\n\t\tOsVersion=column_ifexists('os_version_s',''),\r\n\t\tTimestamp=column_ifexists('timestamp_s',''),\r\n\t\tStatusCode=column_ifexists('status_code_s',''),\r\n\t\tEventType=column_ifexists('event_type_s',''),\r\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\r\n\t\tUserAgent=column_ifexists('user_agent_s',''),\r\n\t\tBrowserType=column_ifexists('browser_type_s',''),\r\n\t\tTime=column_ifexists('time_s',''),\r\n\t\tResponseSize=column_ifexists('response_size_s',''),\r\n\t\tDeviceId=column_ifexists('device_id_s',''),\r\n\t\tDeviceModel=column_ifexists('device_model_s',''),\r\n\t\tSourceIp=column_ifexists('source_ip_s',''),\r\n\t\tClientIp=column_ifexists('client_ip_s',''),\r\n\t\tSuccess=column_ifexists('success_s',''),\r\n\t\tUri=column_ifexists('uri_s',''),\r\n\t\tUrl=column_ifexists('url_s',''),\r\n\t\tClientName=column_ifexists('client_name_s',''),\r\n\t\tUserType=column_ifexists('user_type_s',''),\r\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\r\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\r\n\t\tUserId=column_ifexists('user_id_s',''),\r\n\t\tUserEmail=column_ifexists('user_email_s',''),\r\n\t\tUser=column_ifexists('user_name_s',''),\r\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\r\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\r\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\r\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\r\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\r\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\r\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\r\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\r\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\r\n\t\tSort=column_ifexists('sort_s',''),\r\n\t\tSessionType=column_ifexists('session_type_s',''),\r\n\t\tSessionLevel=column_ifexists('session_level_s',''),\r\n\t\tSessionKey=column_ifexists('session_key_s',''),\r\n\t\tSearchQuery=column_ifexists('search_query_s',''),\r\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\r\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\r\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\r\n\t\tRunTime=column_ifexists('run_time_s',''),\r\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\r\n\t\tRowCount=column_ifexists('row_count_s',''),\r\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\r\n\t\tRequestStatus=column_ifexists('request_status_s',''),\r\n\t\tRequestId=column_ifexists('request_id_s',''),\r\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\r\n\t\tReportId=column_ifexists('report_id_s',''),\r\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\r\n\t\tRelatedList=column_ifexists('related_list_s',''),\r\n\t\tRecordType=column_ifexists('record_type_s',''),\r\n\t\tRecordId=column_ifexists('record_id_s',''),\r\n\t\tQuiddity=column_ifexists('quiddity_s',''),\r\n\t\tQueryId=column_ifexists('query_id_s',''),\r\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\r\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\r\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\r\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\r\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\r\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\r\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\r\n\t\tPageUrl=column_ifexists('page_url_s',''),\r\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\r\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\r\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\r\n\t\tPageContext=column_ifexists('page_context_s',''),\r\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\r\n\t\tOrigin=column_ifexists('origin_s',''),\r\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\r\n\t\tNumResults=column_ifexists('num_results_s',''),\r\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\r\n\t\tNumberFields=column_ifexists('number_fields_s',''),\r\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\r\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\r\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\r\n\t\tMethodName=column_ifexists('method_name_s',''),\r\n\t\tMethod=column_ifexists('method_s',''),\r\n\t\tMediaType=column_ifexists('media_type_s',''),\r\n\t\tLoginStatus=column_ifexists('login_status_s',''),\r\n\t\tLoginKey=column_ifexists('login_key_s',''),\r\n\t\tHttpMethod=column_ifexists('http_method_s',''),\r\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\r\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\r\n\t\tEntityName=column_ifexists('entity_name_s',''),\r\n\t\tEntity=column_ifexists('entity_s',''),\r\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\r\n\t\tDuration=column_ifexists('duration_s',''),\r\n\t\tDisplayType=column_ifexists('display_type_s',''),\r\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\r\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\r\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\r\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\r\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\r\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\r\n\t\tConnectionType=column_ifexists('connection_type_s',''),\r\n\t\tComponentName=column_ifexists('component_name_s',''),\r\n\t\tClientVersion=column_ifexists('client_version_s',''),\r\n\t\tClientId=column_ifexists('client_id_s',''),\r\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\r\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\r\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\r\n\t\tBrowserName=column_ifexists('browser_name_s',''),\r\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\r\n\t\tAppType=column_ifexists('app_type_s',''),\r\n\t\tAppName=column_ifexists('app_name_s',''),\r\n\t\tApiVersion=column_ifexists('api_version_s',''),\r\n\t\tApiType=column_ifexists('api_type_s',''),\r\n ArticleVersionId=column_ifexists('article_version_id_s',''),\r\n\t\tArticleVersion=column_ifexists('article_version_s',''),\r\n\t\tArticleStatus=column_ifexists('article_status_s',''),\r\n\t\tArticleId=column_ifexists('article_id_s',''),\r\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\r\n BatchId=column_ifexists('batch_id_s',''),\r\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\r\n\t\tClassName=column_ifexists('class_name_s',''),\r\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\r\n\t\tComponentId=column_ifexists('component_id_s',''),\r\n ControllerType=column_ifexists('controller_type_s',''),\r\n\t\tContext=column_ifexists('context_s',''),\r\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\r\n\t\tConsoleId=column_ifexists('console_id_s',''), \r\n ClientInfo=column_ifexists('client_info_s',''),\r\n DstBytes=column_ifexists('request_size_s',''),\r\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\r\n DstUserSid=column_ifexists('delegated_user_id_s',''),\r\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\r\n Data=column_ifexists('data_s',''),\r\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\r\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\r\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\r\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\r\n\t\tDvcAction=column_ifexists('action_s',''),\r\n\t\tDvcOS=column_ifexists('platform_type_s',''),\r\n\t\tDvcOSName=column_ifexists('os_name_s',''),\r\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\r\n DeliveryLocation=column_ifexists('delivery_location_s',''),\r\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\r\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\r\n\t\tDocumentId=column_ifexists('document_id_s',''),\r\n EntityType=column_ifexists('entity_type_s',''),\r\n EntityId=column_ifexists('entity_id_s',''),\r\n FileType=column_ifexists('file_type_s',''),\r\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\r\n\t\tExceptionType=column_ifexists('exception_type_s',''),\r\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\r\n\t\tEpt=column_ifexists('ept_s',''),\r\n EventCount=column_ifexists('number_of_records_s',''),\r\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\r\n\t\tEventResult=column_ifexists('status_code_s',''),\r\n\t\tFileSize=column_ifexists('size_bytes_s',''),\r\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\r\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\r\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\r\n LogGroupId=column_ifexists('log_group_id_s',''),\r\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\r\n\t\tLicenseContext=column_ifexists('license_context_s',''),\r\n\t\tLastVersion=column_ifexists('last_version_s',''),\r\n\t\tLanguage=column_ifexists('language_s',''),\r\n\t\tJobId=column_ifexists('job_id_s',''),\r\n\t\tIsSuccess=column_ifexists('is_success_s',''),\r\n\t\tIsSecure=column_ifexists('is_secure_s',''),\r\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\r\n\t\tIsNew=column_ifexists('is_new_s',''),\r\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\r\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\r\n\t\tIsGuest=column_ifexists('is_guest_s',''),\r\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\r\n\t\tIsError=column_ifexists('is_error_s',''),\r\n\t\tIsApi=column_ifexists('is_api_s',''),\r\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\r\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\r\n HttpHeaders=column_ifexists('http_headers_s',''),\r\n\t\tNetworkDuration=column_ifexists('time_s',''),\r\n Name=column_ifexists('name_s',''),\r\n NumberFailures=column_ifexists('number_failures_s',''),\r\n NumClicks=column_ifexists('num_clicks_s',''),\r\n OperationType=column_ifexists('operation_type_s',''),\r\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\r\n PageName=column_ifexists('page_name_s',''),\r\n Query=column_ifexists('query_s',''),\r\n RequestType=column_ifexists('request_type_s',''),\r\n ReportDescription=column_ifexists('report_description_s',''),\r\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\r\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\r\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\r\n ReadTime=column_ifexists('read_time_s',''),\r\n\t\tRank=column_ifexists('rank_s',''),\r\n\t\tSrcBytes=column_ifexists('response_size_s',''),\r\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\r\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\r\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\r\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\r\n SessionId=column_ifexists('session_id_s',''),\r\n SiteId=column_ifexists('site_id_s',''),\r\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\r\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\r\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\r\n\t\tUrlOriginal=column_ifexists('url_s',''),\r\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\r\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\r\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\r\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\r\n\t\tVersionId=column_ifexists('version_id_s',''),\r\n TriggerType=column_ifexists('trigger_type_s',''),\r\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\r\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\r\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\r\n\t\tTotalTime=column_ifexists('total_time_s',''),\r\n TabId=column_ifexists('tab_id_s',''),\r\n\t\tStackTrace=column_ifexists('stack_trace_s','')\r\n| project-away *_s", - "version": 1 - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserId1')]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", - "source": { - "kind": "Solution", - "name": "Salesforce Service Cloud", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com/" - } - } - }, - { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('workbookTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Salesforce Service Cloud Workbook with template", - "displayName": "Salesforce Service Cloud workbook template" + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId2')]", + "contentKind": "AnalyticsRule", + "displayName": "Potential Password Spray Attack", + "contentProductId": "[variables('_analyticRulecontentProductId2')]", + "id": "[variables('_analyticRulecontentProductId2')]", + "version": "[variables('analyticRuleVersion2')]" } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SalesforceServiceCloudWorkbook with template version 2.0.4", + "description": "Salesforce-SigninsMultipleCountries_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", + "contentVersion": "[variables('analyticRuleVersion3')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRulecontentId3')]", + "apiVersion": "2022-04-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "Sets the time name for analysis." - }, "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" + "description": "This query searches for successful user logins from different countries within 30min.", + "displayName": "User Sign in from different countries", + "enabled": false, + "query": "let threshold = 2;\nlet Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\n[@\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\"];\nlet UsersLocation = SalesforceServiceCloud\n| where EventType =~ 'Login' and LoginStatus=~'LOGIN_NO_ERROR'\n| project TimeGenerated, ClientIp, UserId, User, UserType ;\nUsersLocation\n| extend Dummy=1\n| summarize count() by Hour=bin(TimeGenerated,30m), ClientIp,User, Dummy\n| partition by Hour(\n lookup (Countrydb|extend Dummy=1) on Dummy\n | where ipv4_is_match(ClientIp, Network)\n )\n| summarize NumOfCountries = dcount(country_name) by User, Hour\n| where NumOfCountries >= threshold\n", + "queryFrequency": "PT30M", + "queryPeriod": "PT30M", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "SalesforceServiceCloud", + "dataTypes": [ + "SalesforceServiceCloud" + ] + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1078" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "User", + "identifier": "AadUserId" + } + ] + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", "properties": { - "description": "@{workbookKey=SalesforceServiceCloudWorkbook; logoFileName=salesforce_logo.svg; description=Sets the time name for analysis.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Salesforce Service Cloud; templateRelativePath=SalesforceServiceCloud.json; subtitle=; provider=Salesforce}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", + "description": "Salesforce Service Cloud Analytics Rule 3", + "parentId": "[variables('analyticRuleId3')]", + "contentId": "[variables('_analyticRulecontentId3')]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleVersion3')]", "source": { "kind": "Solution", "name": "Salesforce Service Cloud", @@ -992,34 +1013,39 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com/" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "SalesforceServiceCloud", - "kind": "DataType" - }, - { - "contentId": "SalesforceServiceCloud_CL", - "kind": "DataConnector" - } - ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_analyticRulecontentId3')]", + "contentKind": "AnalyticsRule", + "displayName": "User Sign in from different countries", + "contentProductId": "[variables('_analyticRulecontentProductId3')]", + "id": "[variables('_analyticRulecontentProductId3')]", + "version": "[variables('analyticRuleVersion3')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.4", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Salesforce Service Cloud", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Salesforce Service Cloud solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.

\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n

  1. Azure Monitor HTTP Data Collector API

    \n
    2. \n

  2. Azure Functions.

    \n
    3. \n
\n

Data Connectors: 1, Parsers: 1, Workbooks: 1, Analytic Rules: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -1040,21 +1066,6 @@ "dependencies": { "operator": "AND", "criteria": [ - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" - }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" - }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", @@ -1069,6 +1080,21 @@ "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", "version": "[variables('workbookVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId1')]", + "version": "[variables('analyticRuleVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId2')]", + "version": "[variables('analyticRuleVersion2')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRulecontentId3')]", + "version": "[variables('analyticRuleVersion3')]" } ] }, From 4130235f73a4b634b6064fb356416045e866f5d7 Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Tue, 5 Sep 2023 16:45:05 +0530 Subject: [PATCH 3/9] Updated data file --- .../Data/Solution_TSalesforceCloudtemplateSpec.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json b/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json index 156f95e1ca0..1d73718d7ce 100644 --- a/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json +++ b/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json @@ -18,7 +18,7 @@ "Workbooks/SalesforceServiceCloud.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Salesforce Service Cloud", - "Version": "2.0.4", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false From 234198435f1eb92979c24129684c4bd26043a049 Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Tue, 5 Sep 2023 16:51:21 +0530 Subject: [PATCH 4/9] Updated Release Notes --- Solutions/Salesforce Service Cloud/ReleaseNotes.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 Solutions/Salesforce Service Cloud/ReleaseNotes.md diff --git a/Solutions/Salesforce Service Cloud/ReleaseNotes.md b/Solutions/Salesforce Service Cloud/ReleaseNotes.md new file mode 100644 index 00000000000..6c1f40e5e37 --- /dev/null +++ b/Solutions/Salesforce Service Cloud/ReleaseNotes.md @@ -0,0 +1,4 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 05-09-2023 | Manual deployment instructions updated for **Data Connector** | + From b5a4e5919bd4399a77d61aaf9e88ad0172873f06 Mon Sep 17 00:00:00 2001 From: Github Bot Date: Tue, 5 Sep 2023 11:27:42 +0000 Subject: [PATCH 5/9] [skip ci] Github Bot Added package to Pull Request! --- .../Data/system_generated_metadata.json | 2 +- .../Package/3.0.0.zip | Bin 16896 -> 16904 bytes .../Package/mainTemplate.json | 36 +++++++++--------- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json index dd3e8a3a585..a82320c116f 100644 --- a/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json +++ b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json @@ -4,10 +4,10 @@ "Logo": "", "Description": "The [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Salesforce Service Cloud", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false, - "Version": "3.0.0", "publisherId": "azuresentinel", "offerId": "azure-sentinel-solution-salesforceservicecloud", "providers": [ diff --git a/Solutions/Salesforce Service Cloud/Package/3.0.0.zip b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip index 39b6d4500085685b30430742291db4830a56cfcf..a44b64063fc7fbb357bfe13d4410249f18a766a1 100644 GIT binary patch delta 13350 zcmYkjV{@Pl6D%Ctwl}uT4L0`1w(aB!H@0otwry);n;X9O`<0f7N=)~-jugM)R}{_*>>N3ViBkqOQiqFhz2qA>+-4HVEe8) z@_*;fXHi&4_eB_F?mBI*-!`S3?)W&S&oz?~LBv{D+|$DQ)iTADJ?8w!U#@2YlboP! z4KKVy15E;^r{%4&x}xR4Mz|hlRtkS+BX8|+v}!T>smsJyrTQO7Tv?8SOI4y%P*uhb ziSN?J#G4=0u@%vkGl<+zdvj2*#47|MpsJSH>xWyUneMXi`L_duRUHFWEk@9ZoZCLIm4!$6GA5u0$kPU;e zn9;0G5(Akjf|?B{>=+(qziVO(OciuAlcF>-z$sbjBAOcTnK#9jS%rJJvFM0b%D!%D zcsE*{HB*hK=(?y4(N$JUEs^ynOBnrVub2xy?WK7tfza*^hP!~OOm$17g}V3y>VvM{ zi?>qWf$Hcho@x2+II{*XMy2CKm?wH{SzYv29ZsY;{KAZu-keH6d0iD<pXcRYIe`M3caG*@?5$`&W-wa z?Qx-0`_h&({~nFgZEyPcmCfeWOH=rA^Iu^bJbrzeKl-sr+{~H+k5^_<^2;r)IhVK9 zSKFMx>Fsk&=j3Lr`+FzJ%4n?nKZnOMuIp8{H#c&L-4@oj=j{Jl6^Y%R(x{$pkV5-i zKw{T!_q$S3vn9HkQVPFPF#Hg0>X%}3rB>+z3jzFX*EUTr1T z_P6_tfOGi~n?U5x?(T4utmarM{oTqFgR7hq zjd8Y~oSJn~YMW{#k$x>&vQip@U1mx9==~BJrzx~NC8sQHI4KRf?44jG9 zmvyu)%@T+7y4dxuGuEYbYFzX-FnV8A+b(uYk=T(CMd)2yEy~nvBYX|OOYwdWffIQa zB113Jraa|2M+@Hs@%J&S2Sw-|wV506KTxa8%6x1T;G?U?9(DF%dpMPqe*#XmuS7=@EjgzL zGA%p&tAY(-F<5s{YmN`b+0F0+ZT21%29G%_5fxP!K${3bBSyVBEDfN@*>b>e&mMB$ zM?&7P+zNo?@PEp6x#e%H{5n^j1h???XF#3-CI0q8(Icz>r*^`hZbz20&-cL@A%!yH zvW9zyx_<;hr!xSm8&P{`mGjBr7HHWBtw$pn6e49rJo~EGivCIVRdx? z(+4`U8QwL>Z@V){XUe^i=M-yF9+cNVDtkJ-IZQ8Rm-yZ(b~ao#d-J_q3U|H1wA*zdFT4MfdYT3 zC2@L=As9PFug$c?w>nf^;=`?E>qaLg~}Vo~4q+?2D!TkwS-+t`^agvi>b8 z6g+BG>4Kz9ZL>gjx%2isFjEFCx(uA`p3RLO)92HX6K3F=>En$utKb2;jJ-h44Ky07 zU>xCNKrqJvl>)XxFM>9C&Nd%2mrtp$gj5wf!)^znrOGlkkHQVkQBRlEVYnB#vc&Po z8+V&e5avleYgIKnHr9A8?LPq;aZ#jHAhJg8s*omVlFAzm6RWgfs zXdJhzMW+|sL)(|#SMk+Y^Id7*BhV2}TQ)+ue z{q2Myj%e;{mCk}4B*B6yjyVCtky6tJPqFNNg=MUW{FSSxG z!Px5W{3xNr6FXs@Md5+a_f>>LJJmHck#kaA@tM#UrvB5qaND6wgck!Hi&s7r1r&%C ztanV~NxmcGjK$F5CDP3M`F3=VyQF9LbA0cpIbRTKNIoNzERZvy9#~(YF46r_GF(w7 z3-WO8%w|)Pwl6-r(JPssHH3F8Yc8PFOqpQ_l$uF*R6-r-No@e8>HD^L->9ZI6UsL~`k&+!I@VE12(aXMXQW{vLyP>%y2onkTQs8mbAq>+ zNo||MAdSTow0mJ$)WYbYMy>BKO79sO^t4GADFV?&nlD?r z#||+e0=H5F_j{nMQvPAzZs!|#X{CU>#W$SC+za>mK{zgd&$EtUH-|9DE>B3TPDms* zQq{VAEdUXZQB+pZ7aV^PhY`+_7k@HHasy6KJ#5G8d`Ev2gL8ZM_=I{<&xtO7&z`W( z*+ygHyeP{l1s*rA-&)&YBET%GFtW8ELY{NU-Dcq7NJn;{lbnw%PC}cs9S==hM%-vz<Hdzpm|EiHt8h}*RY5i-@_l33oREuuz zB~rqENMoX|>iO!hu&Lm@&~C}deuY;FS0y1uQu~SOEfc_my1B;Z*E!zMm;TmXIwFJi z34Y{U$RT|Waz$=nAEM&Pni_e_qirxQi~^9tTGSHs{`gQ-Na9_iTL=%qYGi5!Kbru{ z7nDt;_$dM}is?%9s(*jiD>xBR+E8G2sK=dcNiXJ;5GTtxKVnv_oKj)^ON-24eu2_b zn<{Btu5HFbQW8M83_N2lEO0nBVG}EVXGYkPB;r?Ge?lhut0=ta6&(>q(8;*^lMeWY zotS#s^IGCy5h%r7mW?#HhEiWx7;1#$XGUQfrfSfmK&ILeLI)`!gvp6@8?oewLu8r{ z%8kI(p0^}6`~#VY0912Uq%bgs?WzCVTUn@C*?QbGObfY+uP$TF&rmlhi$$hZR5w7B zqer02E|FKijwpgxb@7S&$B;-r2_evZDY!8Q<#NVz`5QS}%q^j)1{(~zt?PM<1Yg}4 zwrlLC;v~G3DVw0&(L+Jnc+NdFLl$$=nz8}r=PhDb8HbhYcwV;~1~~%#B9tHIhK$Jo1LzQ(3V#1W2yvhdknjVj6%}Mf&6O zmUhgCg1C~gDg?6md@6mKlja_d;^KtDNm#w`WTcZKKun!}|fBoe)&{BjS9@EfJxdz36VSTMN9lIND5FEa86OAGiVazhENl zgv_coH3*Zyv2^3d36$*SDnGy=O0bQ00tWwqaeSgCX;9DWcRWBtpc?I>ADfmRl&4%> zT#^r_@ZxLn@c37x-y32RetIRqsSpIghW(r<6(Spk#g1d9E}82NSm*N_&azUoLUQX9 zST)_k&8Fj^!9Ii{;m2|4mYMw#zLh|_aI!Vn*6kso#GMts1b-GFaR9KDR7x0Zi<}*+ zEJYJK2h=#L*`A>qkj+R`*27_v~ z01xAV7j2kqG+eEBC@5#D@d|QCt;YgL`$!aDtQdN2*B{5Kt%7g?5GY$t*gI)6|pNL(8MW+^ zVI~iKHy*W3d#(J`Tw{R7@MKQ~{5o^Q<+IoUHEqA7S#T6~2x3F#03In>EFqpTScEAA zNKAHHv>gv!f8Ty29s*A68{D{YL1==S364iM_43!maGeBwTp|o1F}BliuA*7?5hZu` zenWvs|2L~7YgPL&NTMJiwzbj=S2pgChiwTxJ5w%wO5&HVtDTji?YBP&mJO3;h?@)6 zy?m~FBMk;QUJl^ReN{+Hm7tNf-|+VDZzG0V$0s&7(XFoCkEeW6k$PIx>x+5S_lbRk7(Xy~hxa{uWscq%lTWmnu_CIh<#d{NKI%Yf zUN}XT<>So4%hYER{}D2QQQjod65-24be3+7FvuDE`km7(KaAznOye3u*F6f|k@K^#^weM4 z|LRfKI<)%?P||3&W(c)S;D1D(AaVj@W14|9_M}1%$=GcZ@H$73JDpv9p5d-fmafi4 z)Ayc$TayjU_T%|Hq*Au=wI;YamN)FNAphcB>wTV`z~0{)BCtmOp>8kGODug5x~x)z zHd6Fa+}+s&{UfTb-t9{L<CsMj+ISy#(1% z@&rMIFA){hPVegjD*cWn^X zOweZwjpcJPgbIz{gxiLfPMBb#kco^W*g$|XL_g{%?35lRg_5{<7c14u#_%pbT9qLF#EfLjE6VHP*>xKt&Nkj@;` z?tE%?5(~2w+T6YtPVnm7O&sMUJZ`64@YpFiygcKW$t&@^9;mvOFb+(yx3_stkvrHLB_b5Cu%A zu(mSg6yA7Hm7+(V7Js2(-NKMW`3U|YNBj5QTJx z1aX`yV9rccd~TO|X{|OO8=2Eqds*vMNGqZ;uoi0(i+x?|;+6)AQ89+25GglprfjRBv7VfB1vo!zog7E{qwGoBC`_EOTGZhhZeFy`-Po{fRycbf%k-ekOz26ykk1kxiAn#1X?2wB7_i|Y z3;GRZ7}b$51{FppEJl4Zxc(+)|N+e5xwa0y{1LT`PT}?a`U|H zcnI>^RmnN1p*Hr`my|dEhOn{!>BAM+BP)r$B`N?x7;#T_svSYd>KqbA$9fwK(g2op z-jQRhN2)^4T7_7b-__T`^iEozZTOp#x$v0MfYxhs_7`g-A|zoM_@akjL{=Y=J&mrC z*p;HD-hUrk6MKs=^B23n0hDk~&0m;0?L-DH>f8sGgig5r+JjzRLCHWv$Eae$|4>4W z{dzLdD2P}zCFy+fP>wuR3cEN!A$U}*;*ui=t+*{yfO3M*9CDVxMf@+RZl*y=93KIN zhE>7z?J|9{XtY^5>Txk~3?l+i2`cyes{YigjC_bh}}w&PwjnesiEi!U^r>rUD{U}D%|YMHv*%8 zdP%tJ!`A;#-0Egl=q-Pc%kli1&91@1 zsx4{?2Dnb8-=p05D4zLdMXH5nSq&jtim-u&bW=u^Ab8raq7_~gYe~?8^=Akatv3K=RqWUt0$0xVGi!*29YkNIoA>S?vx|)$ z+HcIvBtkXyK}?>mXr?ChWB<&4t5pRgd%a&v3r805g(_uVUqc498?&;oMghhu6}@xg zmYio>&|s3Qv`RqVn24%z9@6dPTPZbXWewUAMZ~iyqaGpM7_FQ9*hU$2jf>vN19Jyo zgn!8wLJksSu*kr1&naB<`3JdwS5+C5{D>ItUpD6*)`6+8T2NnjC};~U*EtoX;-$VR z6Sx^PaE3efv3>f~V?XW`K8IiPBy+0)) z_4%4LGv6UE<1E~dmm(lAxsYIM_;rvF7=2f7t?8r4gRqdo8EphNpP2@R;?zW5D#$J5 z!pC8fH*O(o@SJ^$(w!b2A$@LMX=ggK^{Q58r1%@U>D7@Dbc1zDd z7GJj;jrrI-FE%8-#A6aolDCi?m-RJf%#8bCnwjcQ&ONfoD_R0o)DSv*ZDQ9OB%1H5P+T(KO4b zjGj&CzN&^G_N;fQvsULqF_M#Y5|in{DuEUq`mPn;Ua?imD=0M!Bno$bNIt6%!wO%x zgu3%0o*J}p-YpY~8Wjk2#mtl?N4)F&sX@z02UNKQY&Ce8ySx!NYw#)!+3IVb+{_Ka zluQ&Om@I#l^8Oak?-B4pD-51h#yZ9n&BhrI3-1lz-dD!nr`z??H?z8*F$y}exEZ4; z^wTd|PeYL6Yr6fABi{74qD>^N*jz?CsiJKlCGTaeL2e%Te1S;fKhgD7D9+iB+?C|Y zcA@BF!)WN`Lmo8(S2&aGHGY$DYIgC(2($+{6$7VyTr!@R3k$*31<>2ZNK8J@73K?+-bAjsRq}ZxeRegXkn3Q zP%#{X1gc8U9P_uTtxq zEFG-&cgCjEO%sPVxZP96<~c{}vbCLak?=p<)(8|0ZgKlBI$N;9A35gMP-_}m+jf3U zJkw5oMkk{G3R=HX(rNgd!)a=#M|8;Gos)grCwc%KQ~jC-reaBx|Be4=l8ZS~do~5N zOZF|dt=*%2clsYz#aTDeBdfli3R$Q2d_?=+fD_v^(er;Uey^uiUQYgRy?|g3ruRQl zIyATcN7VK6KgaT*>ISC&$Tt52{u2ZK|GTd9|LegHQu{yrv2mh@p0ob{%4;T8$vC$Z z(@Zv`*)5S&I>p;e@E4yfUQwDZnMiWZM(FUK?dzE;Y324cHr4f6JHIe+IsLPtwq`tJ z<%v7q8hyJQ9%d!Oo^f1iJdEOrc6P$WKVd#6On1ftu*cMNC?p-_?e+(F!hw$8?DdU? zIC@n(^B-C_7GIP!GY$GZnWOBOY`%jh?3FTAeVk$0duo#%$x6AXzyUN%vJZBNRL~}l z@R^5=&pF$oW)v4%l4l}Sy+;O7lH#9((w90KD3a$2`}yAulP7usiqi1ab5NF>*3ijA zCsm-p8jZjxwD<5fcA?h$fvjznxwXRV%1#LEsCq~D%*wjfg$<(Yyd{D-aXuL<*vCfD zY=Y$;(`$^Z+?>!ypG~J(3;XO$pj#*6_W)3OqBn)HZ-X;WzWs}PPk5LbDCTikFUBqn zh_lcejofQRsB96c&qB>Ibm+sf=nTX1FDP9-Vq%von zA-y-REn_sjk;vYPIL^hSasBBnqXgeF6be&97~2cB8SAf7v)>_S0*UqL3r2`eF{Vm$ z7}ABvi*T}m6{P9GJ&0N;tH~nCpV*_0*2Hnakw+r)FMdpF2lujokmFTx5#5tnaufsx z+L%QzOOxXX%zKPcJ@fm*Py<%9L zuZur46H{zr-f2(c*<~GcCUCyVd@AH)WNq(mJqopaVJ}dhzq5O$nK|XfmLvdN3hdM; z3wS+R{7&%=)Epceto;4T`k^|*IsN1I4?ifotd|6#6{$Wk+w6<+KBZG&E?mk+VDB;| zgHU$$5wBAkoui&wI2}W)Pk3L!CS!Gno_Nj${60$4(}3vM9TXO(MWKYgmJbrpaP+*T z)Y*H)dzDSa7rPmI*Q)nDU$+Zv;>CC)zeDit_k36C{Fq~dgybHq(u_aVAo!{7af;Bc zVCrEoMGc~BfKe)j*zjAF!0-nmM#n*DY$)G#V#~wp-NEw=r~9UY*G%FwBf#p{_BphE z)y~%%cD*wXTKHfF-r&pDkPC+{jWOE3MKf*MYsa{JEH8Pu9=wq5F=7Z1aEf9Gh<12} z4+X-=I)2EO>($E%t>uu9z+e8PXBrur|B_|7-yv)`ajE?YaT(3G`iH;M8;`1tqG>HS z^f2~u>k{4VOlb~XLKH`k-2XY<3(vz*qlO8tX(O|)75I2xU)MB)`8lIz4)$)wEBo-S zIEEl>W2^|#>7UPa(b^5HAIW21g5kg?pY8G$zM^S=J|gh;?U5%NW6nZQFl+OfpSpH| zA%-{7>t+f7Gj%jt;IEVE#~Bny2UJ9PLx1fe%lV+|Hbqm-H++fS&s@AdyCidsUJ09C z0Y{PSXgSUvG7PZ{a+Sx*nwF)HSx zjTyM7$Yx`$j*)T-QyGkII1B}zj!gH z(Y@?>q(b9i)sr^!luW?P3{?q~K$OD-RcN!y*HKe8wB&%LsVs10+WU#!Sm79oaB3(E zA_8(}pMQZ#gz;z(nJ1Jds$XSAH)vF$5u~vj)Eh`?mcF* zCdVZL|7qc~8WL@**=NtHo~SOR^X68%o=SyVjcWwqSXmh{4oc)Ja^H;0aHP-CjRn7? zax42mvM&K{O1PaUOtjF~UWUh+-xT*-WT8f5wTTuDl38)x;-qwsc((Fo(FkD6yO%dF zY~?}*g(^&OV(FGTv^R~SXEd&wsG4H8V9bd8AJws0IOhz<9f^~YJ4srvqFve}zfWR? zz(B&bMR8N+uO5xq(fM+#<=n4~5;IWJ5-~ z;BxnR3k#)3)4BU(dh3^dB+T)7t`c5F+m);_08Ne5+unX41>Qypm$sLaFs zrd#{q$eCn~-5ek``P&26Mg9(qB`_PE3r7H;HRU%Aq%~s(mvYK3s|B-~{sh9KJvVZ< z3uOcuEx#b8do(VE5@3RjH7q=D2rI>!WaIV1$rcpeUe#Tg>Z!K8`euHaVVUAG3hqZn3v{RON|6>`fSHZCXlH@X78m;PJq$f9;ai56 z2!GrveQp@t6v8%ZcL|mj8_kx}cRE!K-}9Z%iKTw#ONgY4%ECDns!Jq*G%_=FA9hSr z;Bp2xv{fDl|$JfRPDrWrYf~^FGmzsB!ht83n zAf|q<>}Hg*j0Yb&(v}LS8ezUibb+h$5G6?gU*2via^t-uB*ek#-Pw zx{1341^s}o9g|WsIWBYcx>jv6eqqAdsZD<&2*+?^qaoq*j*;zTVK{zu_JJGBpzTT9 zS9Jt4l|lBW7f0}13GQDP>?gAOW9fAz% z(;}IHoM7u09=Z-Q*!KkS@O?hKGxzW-P3UtFqe&5_dEh--xP_Xl4!ie@aAnMr8cWu! z?OEE;Vf0jPPmyuRz~|Z3s5D|;uN9kFjp=6ke$_)ycgtq?k0UTJg3&bfBRyjOMw?h^ zmfy8R#k4b2`^5qn=B8gNRaC=75Dw7ffDVxGRyouv^rq|dQRfgn7M!NToK9CYr>OZf zPfCq;{JZpHk>kLdeU@wEq(S?{uE%_d$IgUl3HI+=AY9p#RSS?W@C0CYi_5$ z9NSqcGYF=L70l4kDT69aP=YPX^cZ~GZq2NJk)O#iS$}z$DQdMW>4YYczPml=g8=H= zraF(W?Xv0?;oF|#Fk>WTV{mT_chI+!nb)GK!tymH8YA%VlU-)Rg)_txtMW&(9B`+I zTAEh;f4SFZGP1&pKgfe6US%+`<%{dgy?F!aI5%dyQh6jly<-Qc}D zI>cSf00fzq?{SYh^Vh;&X!J9n$$hf-5Ao7GH#~)Yx(|*j6l8Sy2}B()C9}CP4?miP zROaU#egP)}Q=EPyQc{AgN8*B$4M}Gs)E%!vJgsq&>f3B_3u5!s`xF|A;I9kifJL{5 zW^gnzmd{y-rde%DW~G^5z-rA&v8c@H+e=Mmw@&v~*^x8w&>m$)h-i5V< zpf99WTH`mn`lThHrdQP#jKd_PZWp&Nqp!^Tz3v3rJv4YECxX4^^<}fVP}WKvqmo-& zQ_?1|#is*^90$KzB6*-1+a-c9Ybh*E9)m_}FmfQGR+l?&1q= zY8+)lS+0qpll+_gYU=Ll6wy}Ixq=?FYEVS&s`*_b6($hn5yC`7l?^fd^PdX0SQAl) zKW~+WbXhWJnFp+)^xqaw;~-SfGM`q(#RvGTrC#MJg5QP31>^AaXD zIDCv3V*@$_=jv{*LKP2WzdGIA~axS#Q18Na#iBGtWxX3M|4YH$);k$P9F?sJ)|0ob;KEtUik zQ4LMn~88B`_snkv(iI~&3jH-MDL(`}^|5%?( zeg?I`ko!Z^KAAp!ahZ&Xj#&-u9gOwRq}{JfNuCjfW59;bJz z`JSkG{?hMT*269Itp0-4y~=ptO<}527?HoQY z4gtPN9Odftg+C^r%fhv9HDv~C{zm(SxlhyY`+vnwgpvQ&U;oybabcqx2A%&JR8=QX zBOvH{cfGka034d!o$fc^4}4J~L+%q3UxEsEpVb8JDpZMp@b`e6$$lyr-8~S@uSvPR z=Oy3rhN2KZRhNY09JN76W8~7ze=rS#Ymsm?neWKNoX*4YYG0gW zOMnSTAb-;3^%a_V#!KTmQ&>)yf@d5yJapCo^Sk5MN1G-r+C&7WXLwR)Tu6>&xA%*Q zd?dNO9uVqyI=#!C7dmefRsLEZp!=OOwRvY^2f!;FKi}ub7M66i4GyeK5qhxN>Q?io zYc?lSIUkL8QRPfs{l{ap^4pop)s*lO0RS^xACYyp(J$E}AMKIs_A0T3np{Qi!i$Wg5z}o6n(EvCtl?occy7>Eqm7yprfqWfOP$@5FAe zM>c}|@#mRTd#tIc;r*AbMd8v7qKSeHRUpT19~*bPt=RK>12W1MU2M&qsVu*+k{407 zEzQV{up~@~Wb&Y>h$S4~EFXbZ705g_IZ#%4Aob@s&?g_hKQFat4L;R6zyLWpPAo-* z3d=N%`aNS@rR_F4%fU;`Ol?Q-=I0^KR?tj)-+tgA&2y{BbS&FT9Oj5DC=nqdjDzP9 zoHa3AtzZ|Xo2x+3OSkHZ-}`nL?)Je+Z}OKuEs|V`Rw_3SoM22)ydR7o4KR-3k@#po z-xvL554RJU=B7&qbIcu{D?Je`D7Fsi!8-@-bK8wAbp!Wi#~mTFwiq_ldu0jpY=+|+ zpvTfayI~;z&*ZB`Bu-@0TO+m`^J#6iv{Vvd+C!tDfoPMDw{QN}REPgBL_rBBxSfd3 z1NJ;Fr~PZ>h-@~5oif(TNV*RWLw9Q)x)xyG5o>G%+0~sGW4aB$T<$50Q@us$c*|IEM_{zI|V7CF5?Ffzb+z8HglTM&qyAC+V z51&VuHat=7JvsH*!{hPHNH5}jp^wr+HZN}Q?}e=GGRpFs6ZbPhXWsQ);Qu%I XljtHM_WvY*`b2o4>_q-c1%dp3YJ<>i delta 13401 zcmYkDV{o8d)2(CMwvCBx+cqb*@7S2wwr$%J+sVXECdQnn-m0(a{9L z7gV&KNp`a&9%eyc_OZ9~%#>-4-XplTp@Oq*m}V>mUacx3A$Zc>4+eH3 zAB@)6Suc9>?<1E3kBC7={_sb2XKs&QGL}`x)_}N4#@N*6+^OJsPr9#)gVNhc;wRf* zl|;t=&6LW(i>|QvG9Qzg&=4?a)E!&ZyD-6>;b!9?ur1oNrgwQ`of}{R_JtnQXEzL|Sn$Ei zRFoq*8U|I@ry zm;jzLgp3z6uqZOpaZjAn5>UytgBh_CC6%pRREBDEmHddTN{h788rEo;3hhVS$d-_s z&cjjCIID`(DyfxTCL2tZFs1CQnh!ner+qAg&|?;b>>Ru(T`7qk>@oq_3tg!Xcdu~} z*H5=*w-@@2>uYirD(3*MKEYqRqTbKZ2wwHN8&0E-n2rTGYN=tuf|^)OhGdb(tQbxH zm3Xv#YEhV+i^Ks))D9i_3MQb1svW8&3Fz&e{O*rJ;BB3ba|huy!l&DbY|lMj@jF2x zXVQRbM=T%uL&cdlefDJ;tGMFfxxLG@cirx*c&p+&z7enXNQv=rCbqgRR-xPUrZ5U|eT#*5 z_!OLg5zX)Sw^nYNviMRn4)!xTRO4jGz!#>!Zz1U*a3HO7fG1!t;m4<4Y^G=C zne*IY8jWQW2$io@B4k!xQa^jS;UaAgsLD>%1mdR@x|Bvaqw&Lx;4H#+!c0{(I+o{% z!}{GE`Zwqrv^%sf`^nOKpI6&tnAjunDba1 z=3RsND>#9OV8&5#rqSjLH71b2_S7>{zf)y`Z-Wp6z9j~0?6?@%Ms}p&>e}pf=6lbR zAQi2UMgNoS-)a=o_FXiMzt8Vl-xG_sbXVM^@2!bU9A|_D^?EN#3>-hG*`G=OGgErp-2J z5MJOXHR1N$RaJl2@&kx2k@0kh>%e$FQE0lfUBC*DQdxFn`72U?9GPk;tG$P$U#J() z09-oDP`tMf;o1{~PQu%5B{iPcIY=%U&n&BzvA;MG8hnNvgZDa{YFN|&)gpL>C}0#I zV@6VTDAJjU6s8!P3Th|MUc5>IZ~EhsYn|ZHACp4(=LB z2|=Omp!H4hGb}%J8+O6$hzbN z-Qgm~oWTyu)z+>LKN&Q@l>>LWc<5^ifW z!wHs9W*AGAw{cP^J7q4AG^RU?vDqP^tp(TB=x=>oN_O#Kh*0+ZMEh#C?h`t`mNQ_X zHL)XK9VwU2OGu$8eV~gS1yC+<)T>bbwJ@?>n0$7>Fg{Y@{%NRJ=(=p|Kmmh@K}V@F zb6312>m@Hr%y z=j1GnCf|#pKxeWgN-yYH6sRCp!NjoB18b+#Of)Ech4I_leR2@PKY%{V_unTqlFM@*6o4}UqJ(v#R3=;;@sopg zj2Fqd6_#b&g~HvDlf!L5@X7xq2puV)n?rg5)mpxhmftAv9S6dslZ$Cv1C?m7lQ7H~ z&2zolRj`XBR4~msFK9eQde)e9qFjGOJVuo6Cm7!V9w=KeEFEjsr$eSe%mfn)I{vMd z%P;QEY!+$?ZeY9LvcR)=s0vOO`JB#0um^yZjF7M+-!<=mDlRy<73LQ~`NjB5pT~Hc zB4jN>jHMP~HzjqdxIe07AD2Y7{zBuKD@{+XA=bLRXx z9kTy^+du2*_9e*LHUet zj#eT0_NF4BXVfxRjD^9VE8Zsv(72jn;en*?`!zg2q-=7ow}wK=FMdw&9zU&T_a{Vm zNgURjqzt_{v+(qFAD+D#TlVP-1?!y72ZTxYUnG<7Z(8(>X*X#C(Iwh%d-}g!VnPHS z<@=rw6+pGe~ zL@Gv!b=5$q%Goc3DAt0+(_xZZaDquwuH4R!bQdWEFPHcC$S3XWC=zeHNjrRfjHXVT zvTS00ZusB9h7pyckHxo;*q-g&Xj-xCxhnHGp+FbQ0_s|lf1{SNNAY&oc|&u-p2=-k zJ>2pE><0_|DzuHnMZdNM%t=2j0HfXSfVHTpJ(eu1#XMB3{Dbc(ra+J!+e=#hqqB{Jsh@h#U zEP&r-zgyXA{z77xV7%BB2Fb^ergl~os3&nK^ZtQ}#`PrJ7eG>AQ9Y-TCg!LJo=kJy zTUpV_yfvS5)~j8!T_{j5Vq(?Cew99fKvhaS_AI|_Pni^)Dlu++xivi12?#z&#F$K- zD#>1S7-V3tH4iXQT~8EYB9p)$KbR;kaDs5oMSn=1$HoS@%5<-`J2ARQ=3>EFMbsaV zr4qT^i+<`xa7hj*iHZB3oOi};RB-8agc~@sfaZ3@%GKJn{1fJa+CVts(y5 zx70(J;HNms%brJAtRGu4l%MGgz_opVn+91P$7z>i&vxnxg3YRUH>ISq(c$SWjhLX>QXpmhGpGQW$Y`t-x=sGO{y#^6e+s6Og~aS+ zuM_W*HqpI|s7t3fes-#?PE{SHO;n(ST(-G=uCgW90dFxT;Sp;CT-k7JG+9RSEJEqc zFpCqR_nolCnvhqZ7^vJO2OgQrRhJ=p?H?m~m7)){?4d$fvV#H-UWB>uNK8UQGu3onM`f;G~YgAfLQ%oD4-gYIEJ==b9l77A>KN*++ zHHb^ZzfHnG@^19{o?A-<15>b~ZBUh}@N(NsbeK3HJYJhm#8&bO^5Vo?9Vba`B-KUR zH7ht*IO|^i?O{?WJ%sz%D28EOLE;C=gd)BMnh-s^V)8bpZ=d#WJJ9Asw?v|%Sno*R zI4FO}um1vuUvqp;lshc0Dv{_Cl^t+HQLk!U{-M5q-iK_TN5oGfo?z@^okcp;jw9I|$ct+7-)J>}o-E9K8(^iVt4rdEQx)sP_>0 zm*?ef+mOFljXNi586G!C@|3--T2lC?!0nM%S8`G(X&PD=>e$g5C8eKMFA$Iqaw*ik z8boQpgk={_IqBOCI2T(DBvx!vzKWPI!!L~ecXXf4xyfFm5BUm_z$1whDQbFnE}QC) znp`*x?uq3iLgvY!Pr)*QIV#CZl8Oq0pPT$s1(ElW7j2Yrn<_b8Xd!KZw8|=r>VvlD z(}~PhOex(E1FC{6kl5Iv=N@Q-qRdO6AbnFc!GZVFoRhIY32*gBw?*n|mQDDlwYH54 zRZJ)B!{b6;gp)tK`~2+oK4e5&0iPYOu;!a)oyKSPk62lkLB#kAt9F2Ob`Gb(;=vrH zJ>{st;e~EHJJ?3a%fXc#idOFGWo)8n*MW3gZrIt-5G2biNcQ{vghzy{hpB?4i9w+* zX^!QEtyGkc?yZPLpe#C_Yhof%0Y-I8l^ui1wt3c%q1Q)w-Nh)g&RIfFhAtvu1_qZI4xineD~v-_+=1`M7zDyJ3 zphe)+E5T`k#p4@awfdt^ zCClyc?-`$TjG->=#!^A;yRG5oBjYh6*OZpwF)fhpJ@w>0kh(s4=-n@O{K1rZs^^3i zUGq~xzjgPs0i^DQQ)ET)mt|DN>O}HCLT0eCvt$+`d@$LLWCbD|*89Olk(sO>Rd6H5 ze5rTr31WM)46X@ugX4%@g#c?A{+jCRZ85z^gmjI*)3`^0)9d6kA|e1gNJG$a*l*_8 z+%DDgjq!o$)QSVge;f)IUI7i{^i*w=iOn`g$fhs6)WkL)^i^?^l^NNEiR0vtz-}zg zQ_v=lDB$VWCQKwhyCdhBnBFlZrGHEwF#Z-ft?%ps?H#eF(|17T9q!83fjvd9&y?RF zBfDCAf?W3i_3zL-1QB3!Ni&|(n?Tk-hOB!4)A9~_VPbYNG&S(o-661V_S?-TWW*Qc z>h*CGQ9teQT?MC)>4k75&O3kA^Hy%pb8^x`4$>hyH0%ZOh+z)Id{(>bAVuH8-J3fy zI;QUF->EiQX&=sN=9RhL{v85)zT< zyrj_%`k3N5M1%#7`eaN*-Wg+8?HzD?LmtnP#p8L^oRN8#X zr4K*lC4uJUa`9HW$kMi;;6yDhqzt)BmL5EVL?7_%E@dYV|1|Jy%xpUmX)(kO3^;Oz zI;Q==KDlyt#0lLHl3cuOR>k6ACZ*#_VqyssG_X(+{I`2!DmljJJzhDU%w=)PFsK~s zAyl*c8d-3D4IGlgB3YeFaVU}*N17G%2!R;{R3JtaTu8b>3;|{HfF{5i;xo)>Ymn*H z9T&!)PqvU%#N;5bCKD~g*TkUF>}9CO9DIJ)P80rg#?rk3OIKESSTzUgWRyu3JjBEe zfu5>?g3bfo=pZ;+o_319pnhn1L;(cSLqhk2>@RK@U`eE&l8Uc@U_zU;qH0DDS3L${ z3nZySYGN&$#akKJE}M#D)?}#+u7Re3fZ5SxtV@%}#HHNZ(1v7D2^-ZI8|r7qso-?B z-89UsV`F8EOOPBpe>q;5#Ez5L^iL6J2>x1Gw0B01R zJL#3#lG+tu;aj)g!jb_B_C5CULm$U*03M^DkqMtWIY3!PU_jUvV4?wY_A< zzT}79sDCYZyY{gzNY9j0utoM3H%QsFB3&h*@=$~|162*yTxZbOM#)0#0+Ej)+uS#h zqplIE*@AExxj@w#w*nNCGVN(_0Aa$6u}8H(5I1&tSy_KtYr5b@gt`QW1h~cYA*P{P zM6^J`N{#cFD_N=@DFbUjM!Sw0*99cPOkkrb>A)B9HC8&9J);qwVRTfhn3K8U^vT3h zpafA-k!_mR#AQIraSm%WFT-(U0i}`|=>gnb zEYjeC2$dBWuMO@d4n}3Gde>(vnhqIZS_f`eP|w^kbewmkk#pL)xVS~E?`&*v78!1s zVRQ=5^o|}#^b!}8R1}p?C}uXWGxuLCt?SU_D%J%Rv2?l-WneL5jWWjU0+{BhS-$f) z6XaehC&tC(Q_yGf8b@)Ocysetn7RtE&6thp_VpPg{Op7v6X8i(qB7UXgA}+xtpVI> zi;v7aZ;HEmGibFKp<^8D+tmzoSU~kYbFR6Y!-Z=kQt)wi6 z?HH|I1!O7-ch}G-nSZde^;#{UtW7x|kkiwnC{NYlzlUf%Q)tlxn2H8LiT%>KL@iX} zKiV|1E@*nTD$vB!(yREzD>foSAO?Qdx?GK(k1RHhMd_^3IJvH3!J(fxy!9&j(*mgj zw?;F-#jBY@MJ~NqqD`^z{R2Iu-*%6kG7_>)q4HaluY9A#l^BM=pjsRNC5Kjt3)&oD z-pVgpx9gHsPNv&T@APu7A*o*HA^llQ)UoJoFf)vELj#ue&MwZ2fkK4F`68iJp>awK z`o}_o!|8!P1ys=Wl#zTU=M`_hecvgtR0CQ7Q$rSUM!s&Jfps3uGlXH#<@_eXtP?C9 z0TIlfu;ZD~Zul7oH0lnBHMt#VyH9X6X_K&_#5uH8A;j-Gw*6-$o=+eqJQn~1a?l(C z@(g7M4FMVGoY z@Wa^GT)6~RFF3>t$kc#79QCqveVK=)s!Uw)*HNwcCv-3`o&f;i!*DW4rk9PN$X;V^ zE+E2Zn(*upm>M7~V7c#9kkKqvEeOx?M!2A0^E9PZj>DudL5cy;(^9HK9Ia|%>kK+C zgmUNHt$CCUM`Zz-66t2Qga`QjbNO6SJX$)WKe@N&bjljd;qRGzb*!6miNmfcx^PPm z5OaSwip@s3gD+<7W-=H}ai=}_i933!vKZ-c@JXQO&_b#AeuJbD2K}hd+OV$=*Fg74 zA?26LXY;c1T<_SHhsCt; zoOn&f*sJBhO@ADE-?k|I%qG9>ATn+Kt;LU@onid8V58rl`DW1&NI!oC$~cx>%BaSl8^ zx7Vv6ChH$#VsJ$JccTB0m29D`luYJ6e&h&B_E%9_Gf6NLPvO{(KDM%%}0l^(HcQ{Q2= z1KBuGaUz0~NW^|i$mNQrrKz9pq^9_I7p7R7i)5)m5n$~zeru%S7^`|8#`~Q>;97BB* zGrUvvm7KjdqSi+G|7sSkK^o5%O;ddgfwfJ{|DBFLO8B zicJ2```;ARcA@_i@B07dO#+(#qnfAs|L2>j{?GQmRypvy|J7xL{v(^B{~tbyW3uaq zm0ng8L(I7(ViO(qWZ8_GkKm4js-%L4`D4vQX)@D|23F}4EWaE)d=IDRo(p;UTzJ!o zC{r@H&2RsjIYWI0a+d=FDFM0P8B5&M=|H11Qt@sgkCk(f{-}ft#_1m_rkv#0a$gB_ zKK$^5(F?-a`lt94$D~7skK=A{c{SE0E9H-BlS$f631{;t}d3a#Z)7&=r`vBTfkAr=IpAUZXn)4I>Uv8c+t6F5UiFkq=^+6~&X7Ok0$$&+= zVGh~hk8|w^p8d8_*lr{>KjH0RY#^uioGesWe|FFkk@n<=esBi!71X2M3RFf0=x^CbI&g!SpKE4Z;{}3a}s-^#D4*O~{o7s8J+w^U~i8vvMnk7LNe2}@? z9A#jx;ogSNpGo2ZbyTXB<%mP7JTl8`i>=!0u2!b5j`ln{aOhZDb7HqZWkLFx`&^#)Ij-eC<9f zLQTBQR*|bKZCQ`DkF=!mZqAI|;y%QX?_uh;XODIdJLTT*RdoD|FCaIsb+U#_Y-4!$ zh){2%SSrE8VuLz^gWuch3C<`ye`=$w6JqxlUtqY*T!k3pp9j`QKOriIB9hli<4VR? zJ;ud{r43yN@`z5f`UFwu5{q%K2={7W!rm{lJU6qlYL3CK7$*;jAa`PL-gSZezPNL2+BSSkdu%HW_!Ba8`|fJ4qD zeW^s?ip3=q#>N>vR}Q&KMUm2$0S~)*Jvcgu|0ucU5BTipZJynEPR@HQ>7CAxC3X;U z_VB&=%~;g!={8{9zY%D+7kgDc6pA+L%;YKSx>27k*V?g!1$c87wovCe<3xm^Xe7)# z7?L%TfGzO^l*!kxTN2yNsT@IikfmXp9i9PYUJtv3O{Z@4;t*GH^lRbU-M)C#))X!4 zp%EAff48sDJ5WXy$Dlhc>_OZ>_AXGRaYRv~pov& zZ^cNtKpNu)0hBAS@ZFldXUlXxgFAR*2K6%FHug}??rDkr3?w2!J$}WTiX>=bi)Xmv z2vb`+$KrhR>diG=ArWDp*-FK5D{OOU%Kl;G4 z;qc!mq&p|)#$DDILM=bB&!A-E)A#Q;%Uy|>EYyj8fJYZE17eqZn!M#L0U06d_qya5 z+&?C=7T7Wrwc4~GOoLxt;M+&zW-a)*Z1PPDWuR`&KU81s#jdUwtlisC(BM)jnomt1 z*fX-PYT17_=X-HSeoxGVmkU+}F{}19Jsm1wC?>e1s<8fewL(bRm-Lz3 zES#zE1iIXlW+fK*r!ELwd6k$sq%@f{gcCH&_4K3W5f&9}L2qV41tGB+X)}dR4^~L? z2U330(=Rixf-$-YdrjBR7c1XTv<($Uht2|Dd>9EfFZwrA6*!Qejc-_9wJowdA@EX8)cOv9@S%_q zXBB?j$H_dJ#xA*vjLq2N=i(`UkfQWW=PtCZX0H5WkH^?V+v>h(eOV>Rl<%94PDeI( z#N*0DjSqYB(|#h<8$qkrT~IAoO~vZMuWq%Fk+O<%4sS$RP0baT6E18hK*_M`Jk(Hx z8tCaCNqnF$C~S+KYKFfr^4YJ0WH);qfG;qo?-tqN}x={fy+ z@p*4G&^}dd1b?|(Y^i;;i5m1hc9hhT0TieY3_YQZ{yU;Rbnm~q4ITn;C7BL{JU%n< zF_+pTSOtC~o@9C0kalXp$uF^L&__QFM2osFsKS!6mu3C8Zoag)ken3O63~NOaiy~@ zio=WHMy?Qc%z_ey9n~Bb*T#2*D+}v5lBO4A)4|e~t8ShfSG=I^oQ8;R9yq1Hpj8Zfg7L1 zHPwG)Y#5q=U&nFjv6=(dYQ!;S5gi9XPc<$?bNezyM7 z3u}m%Dz?N{DNKtM^Cg8A2BtPJ7 zPpM*PPpni9*8|0eM6=GI_k0WCUjYd(P#(mk|L?Z#rpzA0N>;))AFwYuW!xi#IGL4X z#q5x27G}yf4wgiHv5T)gRnAHp3twDFm>T_QlTGgE-7ML+W$T;H7=?UrP$^i%JSrT# z>Kz&Psvau9$DA?Fb#6^MKtP|A65>zm2kjt7RP^bj`pVGX*24MttVbg36^%V2hrW)b z=9w}e_4G5QH-T!|;r=}*jn`MvVk6azF>OyJ0=4T3nFDSL!&Eg9zm{zgA|uTEoN~>c zYO;YewpF3qLs%`;TMb2D``?IY@+D02Xxf5t-U8J|&zL#5|DVV<;8m+>yM^TMp{Abm zAG!Z_DArL&FX2=-Q|8s|0~dB&)y{2^3$0&_M|{5bK8^8~W(6H~nmg1xK#@jQ1y*!S zi@$xn7Lz5Ts(ZJO2B;7XoGpgppf+v-57Dx?^Co>Hde}3Jm$Yen3esy`+P^Hwl@@dC zll%DhhM%chHbzI)0KP6k#nF8B+6hg5GI%>LX@E1mhTqz+6c!D-(?Fi#kbj}28h2!% z9P{!7^2$EO0^p>GwO2MKrnq($bH4e#>+?^opWm#GUuxBrTU}=C9UeClkv)b%X-@^} zA-+=3DG7srN`)Ay97TM7x8QH;$#;)M39Nk!hrkP((><�MN2azqm|VGrCsws<|OHab=8X$*M%E)Vex z@w|nuPe|A!uIJLJ)L9zM#QeNY<0dL-vpQiMAP(*rVP!QXu{SunkR^d6qUSw$i5|Q; zX7i&*YOXZN0^UD*eoQ5D87x2C|3P`s3t6cNENIJ^#B%zzR=Q&`i%6TsfWl;>!k-h5 z4C>b=nZ=c4?;I7e0W&=C1o8OqVsv-@Q6^L9YuL@Y&}kX&mJ4jBXlTIj^WF1T;*v6q z{7J{N?D&2>Yt~Sqe#PMH)n!gDUEXt7FSy#%`)&;o2YjrIjy~JtP}|8zq;*oLseJig zGG1hsKf6`gy*OPG)z*6t^VMPw0RH7M|+gB_EyflNGO zuobs!4)i@_X*NYXr`A{?G$`fHz4N~A745bsbTOBw{AgWL?(a!^Kkld>0S>g+sl~CkwJ&@&F=uEkpVHkYo=jcsHsJpdnt77yA~eQoyFD= zXQ)m3L+PjQ?ena35Cc_)r@>^4mQYz4Bv8WS=$e1U2uiQGm!8$YYdbyR7`?c^V!~d- zHu_U!_U=i|{o-QH@49|P?RYd=uHyc|>==r%?=L0fV?LwSyd1y&E{0oB>FJyYW1LUS zA@|eUg>6=MPgdC%n=JZw_?6a^aO4sB&e7)}N;m)ry)2(?yVu`TRk94{AtzVD10uuI zKmVe}+s^72FIizMBapGnt>mt?1N6UxZ?=LuR3M8-2sqS0+8ntp#mw!gNRBw40U(w+5sN$q*h^cRMPgqUyy;g-IK)fV!gm?mCmF=k zaEj;eSiA_8EM@o>hmZ4~_nIlYnsSADbk-_HQLBOBjH_pkjg{CSv`6ui5wx|1%5*x}zvVZ6I|_>dlJsHlh1kWHx9UD*fWVDWs= zdiV{Ne%axPlP@xg2-e1o0TdWVA678BV3-%K{HOS3UMs3&Nd;2oWZ9BSL+ZU=4v8QX z&Y8{Efn{TH1Iq)iD$&Q&+WUq z)kHzi_+70}rt+h~$APOxH$Ih<>D1*yXyqp>3ZF$QyK}Bp{dv`6z@OUTTaNlqYWbgF zH{71F=D$!jmO&@dVByi|9v+xY=unW=ekS&SRPAqT)?(e8c{Hv`!a2a!1B@{~x@L$q zllB8|N-KMuZ^!xaDH4~)=3?g88g1s+sHd9UT%7;?QVNQw#A)+T^6lN#Y#tkdy3(@> zkI=!&q0H+Y5|?Ks16ItlF}sS)6osDqDqtJKDzAc&N2{IbTLmn-6JdH}{JZ$~_=iup zrxh#>?ecFPAt*-ic$OF#n>bzlEs%=N-{b!j72Mexv*pT^(44D?Q8=}Rsc(o*`DwcO zUwue-g}6=o%B<>9%H6m~ti7D2fq*siuqomxmS&H3?m<&)-m(4>w`maG&r|EQa^FKJ9Hnh*a7xu}?brvZ z^n9xO%iy;#5?r!akSJ&YW{g#c1%NuZYST z?ka9>ub0c+gTe28>)Stn+F!;$3b5dhsi|+FrTVX{0iQ#S%1??LXdfo%d=fVa5cLse zE{S!ugwm-btT7c<=`1NtMC@3B9ETI~iFadWx)M7gA-{D7KkK@-Xrj8J2ybSf^z2}8 zK?|OME^eORi)Ps6h0a6TM`=_9v7*-0s~uzb5{SVu1m1A+7R2?pHQG5`p;`I$w5o9o zHSIBhVZG728ySRpfRDB3M(8IzFJ9aB|5PR8nPi@=57qh*4wu5lT346rx_+I!v z0DRzIs+iXn5QJiA5o_7_6))ii0HAWK7r#vPr>tE6}@k%Wr7`D;ZZDBcmM7UkiVCh23PbpRuW1U5nu*X zNuCUN{e^z7;$?8*Dy?Kn^XW$qPn(o;q0NGqY#}0R>t57~mQ`v#PoQv%5 zNcg#3E*!0#Pl*ODJBOk5C8M0vC3*8D&Rjd9PHr0tCfT&4U?XdRrgOw<7B^YCN@pkXQECJc)@UsO$Ebt$GtA#=RSA^E7oLA$C(OV%sihD z83IX-f4gAzR##Um29#sb8ZZlEi4O|5M4eotF81J0y~uV4HrkuQd|W|tAh>Ci2SuT% z&D0HJ+(Vmt=cF)DIS(_WhyY=>=(%?Kwzh&0B<$ZDstol3(E)Oig&c~|``dmGKZZb@ z*<{9u}A9WsN?riU3SLm1tp3I`w@c?av)uuDP$qf(Gdc{H_9ut0|6=18P;)hpsuS! zc`+O5Rzkj;2^GUNXGDq8LNved28^HZ3|#Pa7rw+3(w~c9l=8|({BZC22L!+#+a+9| zF=S=$ROR>3yj3t!a4k?Xz8mdxb-J`f9`3*&Sy40o9FOGWhStnvtQwM#m=oN7c*Bi& z7MIiU5n_6Z5W-c30DN3v@Lh%nB<@j!(=8U*gc-(E%1SAQ4syDhc;ps!YS*^>VLfwi zbKPyP#3u_{?1UC93)Jo!d$o<#-KlDy9V`rQ zSiL^x6#umZ`mHVJbnGRvt!yG#-YuU5H%$B1hXgYmM)CdYc=|NWh~;i4uGAR!Lt6QpVTRuRsmzUkN?bM{6DZ4X2x`rXT%7T-}X8;1G8KN;obni zBcz99=1^mGCE@Hsku&V?ye}qMO5En#9rmQsxlPGf&S>F%n*X;|dsp2^qsk%DN};M7 z>E}>4Pm(}grc@yr+=`hDS4_&BKyQe^63E&>Y<6iB7PrJhJ2UX{PgxEW3 Date: Wed, 6 Sep 2023 17:47:25 +0530 Subject: [PATCH 6/9] Updated CreateUI file --- .../Package/3.0.0.zip | Bin 16904 -> 17390 bytes .../Package/createUiDefinition.json | 6 +++--- .../Package/mainTemplate.json | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Solutions/Salesforce Service Cloud/Package/3.0.0.zip b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip index a44b64063fc7fbb357bfe13d4410249f18a766a1..38ee1afbc805a1bcadebfd6bf3464584da317459 100644 GIT binary patch literal 17390 zcmV)yK$5>uO9KQH000080H%&5S1*)=cRLCI0K6pt02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH-C65y8#fmIzrel&q3*(xA&q1Q!7hwV3pYvIV3V#9JIxQv2&fs3#P!T@ zLUN?ISp$8RzQDdypJcy7&Q%vXj+3<5ATTuK;W>wg-?@?R|NJM$dVewDLZrNR#Ci*B zb8|Ev`;j2!8J~+(WH#VG7g_|NO3OJjo&*QM;V9Q)DaC61SPO2&t7lI{EHi1P%7Pa~ zV&zY1@Nc8CuX;l#Yr(T95t?MZkfBya#Wpy0yjvVf;-%0AjEJ}+tenod=BcnC0>yh8 z!eFSfSk9XP3`z4^{>*iR!I&pT4C|R0H!?JBVhl#Ygj(jdl>85w&Y98SqiJm&%~!!( z+C?!djL?v1$wFisw-f(&bc#WliDV38LCNuRHCJYAcp^-!bST~=7zoUAKJBrUjO+pu z{`N3`htGwO^M$Ryzn*5(Y=8epWyR6{K08SSH-c#q3(c%zb|F}-l0>a!HfJ*d?t;n8 zSe_&_Li0u?1?}jFO*NZl?6+TjWiOpEJJam^rSRNIn7QazTlU-Cy+^Bss5W|9GBe}T zdb58$oSX{1l1Avl;i{jX*6gQJ6j0sAmvxs3_HKf)GA}rn4+x^zXUvC&QgJD z1IAH%;sMKrwj6LIBaoe>VU==2mT#Id-LzgnwueIOyx9yZx5C^;8l6_FRnVNTGnUN8 zxmHmTTGG|68ij8AYDu5)oIzuKtYfuXu*$ehWPAp$>`E1+D6|sBc9mda32K8m5Nxst zrW&?o{_p<&t1J>axgxtXv}Yn*WD1~^5CvdIgf&{>R-KXYYDF!-1QBPE$OU+1;T5CN z4iIgN-;lxYu{;$_#Y6|g*K0|h0KRYx<(W$W@x=Rj>%?7@Nb9KKVo{OjO51TF<~$jf z;bBChi3?ji83B>N35;wJT^J0Ul5gSI4Z;&i;!)({6;Ddb(gs1NfF52>gvwZRvXx4Oh`|*EAspm6>wahpIpHW!x z8Sz{WD#^22@^?iRI>6szAP*8Vjw|}{R~7OGfsZSt-dX1489MfZAy9I{HI_Huua&-> zDRtS59K$wOR)*|l0esT%17dmpTyUMSlst*gRAILua>J9I_LVyi*nik2mpZWAyts}9 zF#4c3Y=w4H%-XTN74X+;t;50{&JD!KKr(ccF?`hY+JqO)$93Cei3<5vb0PC` zLhAYiC3zXauPJ%{AR`I|6_X)b2{spSJIi9NQWr6Rc|->fB*SV`bhNwfY^t}EMj|3s z34Mp^)q#GmRgrJ#&nZqleJA1X8Py9`7i~t>&+2WUMidL(nyGp6#OwulTE)vHwp~8pFt{RIOn3G#3XipT_$ha>{ z8!%@CW&{Nl5p{T@fbkKKxS!8m8K(P*$mVv@?-;Q^2xy0c;bd^p>zev460Y3_l7*te ztM~oWvo11GzS)J72>F0VzwMk5B%|S8%Nst_fxbbw9F>LRqr=JJWHkBvXmYRzg}0q< ztzzITuQUe^Kk2EmfZ zhpeO2dJ&y*^PX&(?8BY{Vh_#<;D_~`>eT< zN{AiFaDYeMy`uzYq!_C;V`bPd4(}n)`AjC#UbTv6nSo8}!bn+Mpt#m;0qyed=HePs z0M7Zsd)L#`Gb;T8>SA`O)Y8Y7tc?V(hthK@s5$^O$2?dlST%(u~0Xp%VJfcOS#&D2Oh zP02qmWW=-374W_+YFY-`X3*;%?{)jLo8vzWf+Oeq`ildx-c@Np>V>>2KH?&FW`v{E zlz+Bcp|y^^u`4)E)PGq zSxLyYiFUNx=mbh7$x057K1XcSzK%+V3;*v&^> zR^MJ}Y*g>v+F^4V1=I7AqMM=72O~Sf6|17|aqZ27sU59CFGrKxUH3#~?K-@Z@VZ%M zyM}koFSTZ0*rD538?{GQ%Jj{E0`)>9xx0axqh=v0S9$uJKvuPGvsPcRvUP_aQyAR5 zi@7cKVp!W&45$?Oj8U~QymQCTZ1}sm{HJkhTOg!Ko>W&YBg(VR#qZ|YcQWU}hg^+Gk_ME~le^+f2Tp^j7C{q<6=GTXq8$JloO{PlfgMk(H@nq?fB*+~oi& zpLLwmzw7m(wSkNF=iTFSeJ`;+E+225{@A#@RoFe_@^%gH8kcL${s?iod&^v@#&kgy zsz}jM(}TioK{j;P9PR41!^wQcVB1*p|3278!crxL1_{59JI=^J;q{igjAc#D7E!~CBzIDe}P>w*=cGPfwAFBzvg!B8Ft41uF^joO z=uV$aGxAaNRPaI=rCo$V%(9)JD4ks*?SwX?<-ihx{j&X;U?^ee+scgtjxG^X(B6gZ<82H$E z$tQP)!{5yrTJSOmr{O~Qn-_wGAOKTtvJPl;V*`}B7ZBIf+6B+p!9%v>TB^dmzG~Be z`C$nJhmcsix~O_RG4$n|)Dq&-T}IS)2c9bLfN#<@MR^X!or8~7Ul?HzJ|V(hQ8+o3 z^Q<;$B;#0Uy6y^9ky$ObyrA6|XAk~xIBNw(7h&n)Ju^EkQlaa?1lYR&@i!k$W$k~| zci*b8dC`4OXkJ)Gt#`)Wc`UWD{f~TBKv?bH<7r_i-WEvH)e84EP>EkPlGolK+&e}NRG!vD$gIZrIdN)UrT@ddoH z(&QqDu<9Gvj)FLtCallmGz^0%`O93rLxe;l)Xf}Gh!N^E@X`c2V~IqFO@oM?S{{$# zht1h3kFH$!{{t^boi%LXvp^=aA`1`#Tnp%Ufo&xMcliolCO09+zTzZu{h2}o$K(31 zxj#!TpmdnOcKFmvz2rB`O9}2n#N!|ZWPXl= z#(w9__2YzF4z|jY3(o#}9YmLLXxY54(EKaAzHsde=Elt7k$VMQPNQH>)nD(k3}8*+ z{aO6@tR}49WH7n&V1k8NtoTOFP0aehcO1C_nFzonxwRe#I}L`fQ62Q#+sTi#9L+A+)}k2uSv z?G!}G^|^=B8}lR$8;3Fpg3Dnan_g}Tjgr|aRo#aFRt*}NQz2X%Q9%t{S&?f^0I7l& zP|R`UV3VW~V@V~UAN%UhzN*@fvw_88Ty}9-YvXd8AF^)OALJzuHZqN{2CCQfh@_3W zaGcdEHc2mwt!3T66*Jd54>?3Zn{Vg39BQQQLEul_*^x6WwL>gxs z3Ve{gAUY6hOUKR{K#Lt4su__`P4G`p6RC0{wa1aO9_2qDWYRTw7xIXdgykIp#Oxx8 zH#3zGKj^WdLdgn1qx4vzl~Zn~k(=CPO_Z?0W(tEc4W87Lo%R1zSpURho0C_K=O;j6Ix^`wdAwV0P=TTk8(Eu$|Fp0LTyf*Pgg zjan|e_hT2+oX#yWvyEfl? z^0dz%Kici@Y)vQq$<}Dpx1aDQPj+{#r;oR-oTTPBAO?^xT9`cJv_xIdaao$}r3*5l#uNejD=I^@qA z-ACU(yN|lDdv(~FD%%~|o$76GJ>B73+q-@K$m0DSXP5V%?2dLp#ZRB?@`?R;I32aH z`*tUG-!`-R_Pw+Fc4v0q{zln-dl7cu{`T2@yBoXLhOK(94ta?Y$KKK-R{JLP!Pe?B zU8x+M92|~K##6I+I*jLo7;`;L+}U*xqu|PQps!6yu1sbWK~Wk)w-BTpZH>0Yb``k5 z{L1Cmg{m@eZH{!+Y^8$Gv(o<1+6S$8^z&VTBA~-V?mO{2KPL;l|N5as#fO%CY0av- zsKgB$`7X!Dd}J_1fLP)dBj|F-rO3P~;>?i#%vKY?uHED!-_5%c6U$1WXKH?KxxSjM za?kAkw>q0O+)R17Iq`ZRt6) zX2JUQmSdtkkoopgVqICTCl@Z0wSn3pv62+0YG|PFnj0TW%k3GPT3*a`^*-y7fMsp& z#%K&0EF-F=4BTUB)-_G0k#&R_rrcTS4o4}R})+QL0gVG_hO>&UMzx{dOyI}clqAQHX_9l4I ze$u}NA1Jtve+VWC_~ZTDb#k3P2tgnE*jS3QTZ#DvnA)I?L08P`g*eCG|T zV>9b2qa$bA-}z)S2EmMrywymiibZ!~R%XCk6^9XDfeV3Q8!NZp_rnm6mM+Dsl@2;H z>r_E(0`uLieo#bKo*_GcL80pi>)+;*RDSrdU^HW!@4+R)jvhYjv0CA=6~`cFPOVS{ zYuH(E$^BX}7#?85fUgCjWiEt9BAz^aSe!FbKe;Qs$OIlA-Jw4V*w~j~mP85pt_@Rb z5Io&$gMEVM;-i$f=rrNsQYLF`1ak|%V$8`vkM?^9!^MO5K)~pi5mDbDF;km z;~L~+)aFy{9O@a!5OxLIEe@B z;DXzigwTg7&LOzWh*SuxLq72$&{`H(SreE777h@dg2)oP$@iu?HVN+{ld=9Tl;gx1 z-hgQ#3F6)j13es-R$EYkNLrDu;{IK5JS=YO@dm@S86^&X1N{U|K*-o{c=UZxeNhM= zv6wn!b8cT)z8lYJ-KV~>#|T3ZAT-z!BWDJv|KU~OdBHW(KNjg5l1)3Q$1v>2!p|xG z#$~#Hg~;_IJ_S$E2dicSk-@Z(D*hCqxBLpjqN2aI*{VoRB|s=QS2_li;5SYz#*_G` zP`F}+1eca*6DU_kaXx&jn3iEi4bFWj)uM+{$I83Sx)@@Gm`yy(;XP)1pyCPwg=`Sh z(bdcbv^?;jnci=u`d$Ewb{#zc7p;FlUq5G-8BAw7Ats?2760}XdYcn3m~76$Q{~a7 z+BS?g^Zx&Pv?Wo1UxdY`I3ZcAR77%+d`dP%L^Z=OjZ@15!NZ-;m<_l3!$+W){1j~$ zm@tY$l3_6gH1g~nWPgAoaokKp2e)bNj|WfBULLa{>oXB`Pa~NggzG~#J>8V_!-wbo zxj!5*wU&PHT>tX^)=FZGX{I?!dV^3G20Y?gF*o*0D$mZXodG-dM+5dwIJH0>p0M{} zxjqOiQis_WK@f{dWFE1j!&*ha{~~Y(=l=G9{l6e(a}ZmlD@80F*cao*uG3RLW3pCy zsHVtZ>d`nuX(0(sg=Ip~iaU-mn!V-TZmQ5fiX)DSo6B_|pyd78>v^twxH_Fs1 zF1{eExHAk5WV#Fq%|!*Jn2h1p2}e*&790TkacF{(ZbxzYP=G2KaXABCUtd>QPxc)5 z)!MCA4@z~~Bp%xYR+1S@#8zYr-uGHAC3A$5DH!eD+n0HcqF{TZMslqZ0Ozy;5oVT_ zObbj(yFAECq;caouw4o+m)ATY#W3kdZ;s!cobA6o!k_WWk0GW#x>5M~=~V5Rb`6SI-(ygL|d$158t6 zqh@~-pDez85QH~K>DSbO8KkMXuSH+Um%x^HM&1Iee^Kh1icInMg>~3hk(TaWZT_^h ziBEpUK)6(7Bnefijy172bnqr(>-#5fHduCYr-c!y^@_TGAESaq&y_3&T4%s93+8hB zFW2uaOJv235T_u}u{n7|2%GVobQLFdm>sycr< z_k&O2h!{>ADsQQ}%5nTIq|6_43{nlG zLG-6?6en4Qes}|Gh5rL|M6MR?iik*~V5%$7Xdb4(P6MIs(Zxr)A-4~d|3hbNT;VX{ zL0MQT{Zs~%Xmxmpk*QaK=TJM_rBx#dLgrzIDA!Oy_!L|qh%N>mQ)^de`O~i0^5-^; zJ1T@`gkrio?gcjZImkD?j={mTye#Nb+U>H7(IGKQM}DnZPfbM)p6)Oy%+_Z^3E%f3)nQ?AoBK)9#i zxL2-2%DE>GZC`K~&ke>Q9r)o)q=v}IH9D#>-JAll2c;X&&`?UwlUzp7P^i8``=I(x znFeGTR14MG4|aj6NLU4;Gdqj|%sRe(?Mm}P{a zD*pAb~-)D3me)$&5hY=y+a_YS5uuTNL+jpG^h{h_;N5 zZ2ef!W?lgc7sJ9~B(nceEM^|~#0WRz^>t1W>*6LMWREJYrL2i>pkli{}quBy! zM;XW+rC>OE+4#orIeReK(aMu0WCFOWvqSm{H1c9$KqEZ zm4;@kDm1oEE$JIlxgn(~($>7XP3n+rLy+6#US!Cq-8;jH`TC({{oP;{u+mi*rrfcQ z8pWa0L-~b}`k~a$I2n-AUW+!)?nUc}jNHlSjt!Wf5kOcCRPJ`MTLlQDG3qjG+(g8B zS<;*6qvAp7hTo=Si+>iBbdhYJ7$}GE*9LY|bqon}_59M0I%suBPz#EM2DnxxEy74$ za7wv>rd#leHJ8>Js)1kIl*XDfkhRe0Fz3EFId?lwTFGsBv{$XdV98sE0IFTSQ{Yqe1`-jRap#LFeQ@16pF8|_^d+d`X5 z>#K%TZ?i756$+-*?z>9O?v|3hO2z&@Q?Xkzo$KL{B{G|r%V=IMlez3_R9M(DCgs-0 zxkM7~H=KOiL>4IxZArG~$XI()ZBsJsGQ{~RNwgokle8r_zD~-!&xOC+9QdZeHfIEz zGl82kfXgA3=8WG?nZDX!} zs~K&{z-^n{f2+*fMKf;igZWxAYuloc)#Ia0nX@_;yG5q#ze9#>H#xmcChRH$b~!hq zH3POPD8)Z3>v8)5vsNQ#mC<_pjMnz;>s99Jm(N^Xcve;!s;dmuB{Ni);I&mI>UWxn zx-c)SGENuBI9-^!tIX2LSIjK!kd~o$FT12%bjob(kTGgXWn3UbRDU3|bIzg;{J!bZ zn(5h2mbT2!+ft?asv7)l)dly;eeK>?{utW8=YBFTR~eV9jLX|bPrl`hOY;f%MMUi` zGAqBgjLHs5Gk+S0jZY^SJA1(?!PEOsw^F12`dhU9&Gdk*vn7c#*?0P7!D=l1d7T4`!ue4b#VZzTvu%k;sNVAggSmU zM*b=TzKd~g>L5WpMsBZGmW-^eFEvaV1VypW7p9EyaDQaMwmI4R%TQzzZw=0x_9hW zSm1#6Wpw~z$F>G=n%bZZV@(I5pfZKJ8Lv-tq#0xyc{)_}G9;0$%h7uyH>7%2K!773 zj8b&BUI()vHL;(oYGJ|(RMWKM9D?Nv%Z8~1XY7ayI#@GMt@2CEq%+i~EW0|0p|*yC zk=ry5m`md@+y-5dx?_{NP;h2_mILb*n`}WyLj$-J3N0+IF5s@dP3KJw$Xa7Rook!X zPNRaZPUV>wA4fqF0E9*xdGR=ur3S@soTZ#hYNC=-16DNSh_OdTrUsrWj1h5BrK)uz z4G`vBRO*StBzlI3MWKctB-m>VDVpIZ;;04umEV}bF8NIr2u(c7@6kbF;h3zM3Yc?g zT(M*4Qom#a(0&*;!dYS11Z$wB1k^0Wsjpw`qSV(IMklah0!yM|*YOoDsK}I}yasv@ zq&jW_D6lKiDi@(2DSS5lprWi?YhnmXk*pRSth5z{RigvdNvZ;?3hD{RgES3lF`^1a z&8Xm;04o4KHssGtq>;s1%6PPtK}{W?Csr^wuFZxWM2@LDEYtRd1^RIjNOfHQo4ObQ z(n#7LvZPuc1W(t#kjQHDn0AFnlC=g#C=16mOGAOZ^b?FC>kWMc&8d=x80A)UNLSl1 zp-+k8pET2#HDHSxdT>w^daEe|M_o~0`2l|Fe&Vrodi4XK8sk`2sWd>>R5YwB;vNg* zx^irsI{mc4TiVXjYd8X;6P6l9cicAJ%~Rbx%}rC>IKAenZJbu~l)j7HnXB_D>3y~C z%<|=_G~KX*LV0amU^bmlW`RZ-qpc*;4&oZngh!{rAD+x8)xts*Fx>v|#xgFfYvYy6 zJ;w|_rD7f6%TG3^$loj1!|;u<39c$)syf!xwRS+j=0?POE$EBXzT^h#A?QSumqFjq z!6Q9ah(k#lo)ADrfJ$A*we%7)$0ChvfDh&Rrghm1i0w41GJ$C=Hvv<#+kQ!s&@>c` zr;c^w`8l$DCu~zwv%Hp3SAqCPH^;bRSBK|VHm2>o8W1Q2{d`Gu)0gPSf+m~7YMmyTh$~Cia z5X{5C=f*gTD%S9&h|d_E85yF{`Z6*KrI~aUg{n;Ufg4`HN|CyW4oNB;$5>hcvpg?I z4fcU83N;j!QAOj>RA5m%HVLe!r-H0ga~~Q5c?2&?A8fQl`52w4dc4u-8S1@4qbZ@c zBKEUw79E7Ervm_)P;x6Msa=EpC~<91-GZoN4@=a@daUwExrKIk9k6NbQn0$!OM*6` zTtqb+usQm$F*jQBI zo~&D?M;d(ST-TV~=t3(k;2H#AO%6QI6dks+a;=gy80=bG9ZwYn$O{c4r5X+6lr1!Z zN)Q}fX?~GD{xmS_Rw%3!=rB%R+$1^^+`R7wF#6CkUV$;AK!Ya8T<8&@PhIWWUuvMX z_Gh3*8rNH>kvc=fN-RwS@V3&c6<MXRI$$3QDqHWk;9w#qR>hUxE`!gesXxd zBvDIO_99!SQ2pI$y=udrDM2i-ZA$eQ+BwZ8oqIsw=tgB3XgP>#jMX-NrE6KNH(e#D zP8A)>M876hkX6i_khReaThq5P^6sPtIC)M= z1E0C`h7o2?d;{nka5%uyYJ#4NDwPI8ohuk78d~CRkRezu-Th!HSKx}FL7*>v$Gn5B z*&ZVx5uT~T7&rcLF7&o2tppQXE$U-Kw_NT2i|CW33Fw&*0U&&K5Ww7k=|DgUybh*6 z5}jt+lEN7l)|BFFckaS+1jroo$kul2VHH@2kY_?ssoDnS7@H%5A_v(J z9K=i2j5-jn?$evQuPuL;Y8l;=CFT166HIi3`CBllk>n^g9vg6hXLKhA0EF(&&_hsB z4FDt1si#w*2%}1?U~l=g7QhFMQmOhTn1B#yYtN~u3h+AcXD6wTdHQmjNek>jwQ(fs zjWheI+|XY(YOr5=qqCjKE0T{=UYIX4Kw3X4dt5*G+^{ELh3(D(Q zDTx$Gn$B^4!9AUP>IV=q+Ly%eGt(xV<5oEh}gnAP3J7geTul1D2hH)UTS^)wG&b6MB>(JVT!{e5dL4 zSk7o2E>tsE2Quu_S2pNXZOM41T}{Ds`n5o8*&gOcgLMti-fiLdaG5qI9Pg1aZHiN2 zbzeO1o%U(XMwi;iZ7{x+kKeFqtz3MgYlQc>8O{$tiS7V_&06%9x00OGBcn1D3L>lBe2V&J;qcLwGr+7JPz zD%L4+Vc~g!{1!qDoTxI+FR9Zuktqvv3%SCmHNYLbM8VA0;*!ZR9Ac9g+&DI`wCuNMfsDuOrDT=nysU`RF!$ zGO}1&!#A<&hA&LHeF<3VOq3YQ#+VeV`oQz=^7iJwb#2`+_Hf*M6#uxGjIpMzdX*(a zRPQCG;>4O6Q@~BPa^T!yf5k)@L)u(+A+{-5KnJEtdaEV8RlmGc>A#*)g44fH!pCx- zw;N&N)|dReok&4y_~4DmnrZ!@ogvXHD{sogsaCIFYtx?H5*EK{vrHmcIYY;sR#wUr zD-C4f&)o^=gU;W%6LZxfri)}_N#K?*+bNDSU4Ee#-mV|STllLr>e1z^uD)!i1zLUC zt_1zo(qsoJP%QjbzHHZ`AgZ6VtLulw)B4)KSSOIGR_pSqx{i>Yb(w;>yM${)mS%^{ z(8W?tmrnOIryXn4JC~XN=5)?w(l}S?o2&HARr=-vfu>dZ<|=*D2vn=QO5fDBuu9*o z>3=m*tMtuP`eu3YTBUEA!K#9~O5a?iZ?4ieSLvH|XzesNO>yJ&ny0pLTFq0sO5a?i zZ?4iebD&lF<|=)YfLH083V4;iS)=GGeY0A9mA<)3-;|QOO5ZF)t6@$c%~kqlsf|_o<|=)&)YK|{ldaM>wQIvFeX|C!O5fDAu}a@urEe!ojYNZT}|YiiRpD>+GB(lQrH$1LRhWEnqqm#NW|Ub#S8 z_q$zVYW%taZB9K0NvL*d-!KBK?vm{HIb^5Hx zwrt4mS&*g93|WthWIHaD<=B?pxOi6Mzv!1dvAanST&}+5`DMT5`Mab$%YJ-MAM{jQ zWl(?YOMTL_E^;LfLKJo1)oc=!mdyL5B_(S>tpUQ1(Nw5OJXk4D^j{p!%pCpw2USkx zNlafVMkAIX5$N;XbcP^yj~`bcP>-de3~lYt zbF~VeuRS|odmAJio7o%=w$9gj=WF23&SNP002PrX;O7utOCE;5;5{-qLI3arGp(5vm2Rku>dO&Cu1fc;kPY7U-(A0+ql}$l(NR!of9WG55f$AbtQoae)^ZIzA_sKjVnIIK(Q-u_bt=cxQ@J zN~5~A{Ddk8b{ez5A26I8L;y?a>+2R6uMsq9%`uRLAIpyO5yqtvVn4l%q&O(-El3lg zJXK4?z7gWt!=4hHAXjj23ySSV4bWoo+`?lU1-QX8MvN0DHy$Uhz#|XmYoFmA zvL?O4Z4}mLBYd4R*3&9u6*=?QKfKHjI|8Q6I5d|6$)>JD06W8xwe{56>hJDYyuY(M z-054~-tF6ysr_{Hczg0>G@%AM^^&2UO(eaRnD3yZ#PXx)*nJYE9Ggb}O^ihy-+Y5; z4xen{^I5h4+9N^U7c~WOQFs1^;A&W<2DT-9_5D-B`>exSL%Sx3ogG8T&i2Sq@?_Tp zGkiQUVK931)YRVY){Y5kINEw@LVdI|G&Y&_rYUGPsMyar>wBnUa)z@h?eH25pRXYr?7&d{;@qbyak(tm=#hNH)m z(Qs=r9X=Wntj#^|Hz_61GaW3jCRwv0S+YEctnjrp;U1OYrZb~M>;j`WofII46~qx% z(mzKPo6yK?`(6Y|8!_Q?eFrZ(?{D+t=*xsbBE~eA0IK=v(_Lx(j)t^ zG@(RsoXefcT#lONQZ4SZ&7Mst?W<=T#$h2u)g!c(_h+Q+}SWtWdvP3$)M?*_F_kWR(-J zy|MXTR(e3Y08~die}yJd4bSC@lC0$f>x>9O>78u6Do+FN+SuG zY9a|jHr&e0kbHrXbDArgGf@+*(pW@xKtM zLY+fCwNfw1og{FT1wLO!f5G6$sE~@a$|6LngCZAHg{+V?Qv z=dcM%q(60MDF$dU$}B*RpkvQ-XL!|A4owTA0;T9H_8&74jZiAAX|SqF=1#?afZJ=yjdH|~jyLj3xrUotmz=J* zDb)LsF;%rmmFB&fl_}P7pmo=`g|pmKs#R2ZQ$ov+n{x&GFESrLIcQS+UMU=)Db&Y$bioT3Gy^T4j zsQRUhl&uaL(P#-~^W7C&GmauyNA7=R@sShNphJaIi7ytni$>f33Wm}CX=WM~#qa1) z3g3~_I~2z%-=CIV%eTEkn|b>^5FkAJ3*uD}*d9|io4`x;v&Y^=GitYd=}u3bSf{e= zqOzVkA}m_T|4^f#{30e5xz;KpO@O(ZS8j6CXOax-!dTldYX>w%m^%l-h4oJ?G`Wt@ zS!@{%+Ke{I<_#tr=p#$C#lMi{RtP&UZnc$1zJ$$&u9Y~nuW91GOtvNitk+<>8I7|= zjIQlFu`!m_0`Y@#oq~;l;<8b9pNjqytq+f`opNx+ZFf*J*L zFjl5hjz>9Boc2rNM8P})o{-orr31d4On!mozhObuE!m}cyr(|QTIFuqFYwjv8ppT` zdGm!i%I5@~`09js<;_#^zJR2JsZ%)z%o!g1CoHXlmkC$^&BQ?mRSczPAf%y{JuOTu zjScl_|C1YQy1tR`Kjf{`E_^4qb;o3I?R-rY+EIa4^`KOP`^QJv+#Zux1@)M`J84h- z5N`{YKe4^SA82sFi%dlx9KWaJ4tal8k9v_-n);c=v%pPcqpdcJNv1JRQ#tLK2_>zB zPKPaeUrb9bviANfFpelK+$hNY>%xlHAH06|^U>S!+jrxaCnxVt9&}l$S=YsxmHh3V zI1r#VWZD+s_kLXAm>4mTwyt({C6E%2m7VZ!iotr{;xc?E4zsRdn)*9v``(sDIr6TH zT0Wi}LcZ&;nw1bNEM~F=9OO-9Ke^zBluH%}m-HweP6vhn{#>n*`mJMAT;fqS!oYW2 z!Ti6uu{&`+Qs!a;t6pm9a24K)1iD3qf!+A!A0Q)Vfe@I?aUGtQ55ApXG=)RCP=jh- zRG4|xYf!tlI4xB^-*tCKq?+};UjJ%$sLPA(n;=ful#VHLNv2*&{eA6C>CjbsI(4>t zw54OYue846$t$#{&{P!+aE?c@8a4v8{^m={y~glXc4e(snREOP4xFesniO8KcH$Qh= z+qK?gzVhl;vPb5XtfvjI&#h0zb@0DMy{{j2Urs3%)J{kJ@>1%TZ%w02FabJSIcoE{ z`^7AiQ3V4q5u}AcOpMV&l{6^X788qHpL_l0EJ*4{<}MPPI-@MkC)1(iEQfD%KMXxr z9QN(2e7?SFD&CxU!9<-_7ENZ!egm-w|M^_|rPN|7_pqFGnN^7mIn~)D=IN}a{57dT z=-Y;hKK0bP@{4MwU6)kH&e_HF%Mh|wyI+csfgpDfb?iI2<3P=;`IZAUxvig@ZqH3D z=R^MGPt`PjRiK%Jf5fv%0bY1W;i)`@jXw1@h_7ZpvO@EFZMl{|QnDLrkob^NsJUR;=E8}$W@ zlhos@OK$G}lAHdEC{6e)GJVy@Nh}YkALkz{VfgoVb>mHu&5WkqSG)D5#uxh@%xY02 zx?Y1*9H(v4oDyE=JnAJk1If%WuU7Jf}-%hFe>dD4;Hd$*!95Ff|9n zkcp#{`B5+bj4pwp1C|P7x|b%t2s{VxRvB*f6uOmy9`%(J8Yp0kHAY)(?)pH=c%XHJ zDl6=ZBGnVT5Hq7WQQVHWBZi}4X=sl7$jQiLbl6Z=g@}iJVd8-tE`?gpvXSk;n#?Qr6UYfSUSOQzE%o^s?>1VdG?J{OdzdhZRHo0 z%G&bd5Hi`+P*>biESPFfC#b%;@JvufH6OC^J7D*g(=O#Ot3vY z!Af}_#cXhLU34a)7~kIlP!y#r-Ro5=2GYUL>!SDmld(OGZ2f?|dzbhnfJXmLZm) zum4elEk0=L2`n1}6gpsyQ?Kh~EkTRHHjZWOAX~=viI+8<>D%S@h3{h4hq39i;c&Rs zwLMO|Xm6|#kIpPSXLPSe8!$e`kPJijR+?YLysuJ^ZsIowVQBtv>r|Nxs74GNV2Hvr zum;aQe?^RMlN!DiD~NsDL!N*PnPYMVdyH(-T&3wLu~yWH#Ka|~*aVa*R-$)B+3Es~ z)mN*{E4g`?PSu_7Vwpn!Rc~B#e<(BWwA4^ubhl*zN0Q}!VTqvHnudT@ zC;wbFvD$j6)?018EV%X3rV)#Ou0r-*L-w6?Mm212R2g>^S!fUBYtUXOn7;1v9*Zh4P{20Y$$ppA8?8g=aX;ZLUT!&7u7zdB>FEQ;h zS`YtOg&W^pafOX5uH=CdDSRwO>62?yr(pSU)}|6*MiR{SsSRxtiw4N0gIEfEKf?QR z7KwKMQ)Ts0T(KJLu4e1$6Z?Q}|70q&k1CFj-u|}#`si?cynlN7`@54vP?e?f)6;k3 z&#NlJ;o6k&htjgFUa2 za)DswqmHpkL%mg~Qq)_8Dm64-g({0r_fVyb(CM8^2~mzzDz$M>(aNLaTQNenKqaY0 z>`nZr*J*W*D}8q{ggW~q-(R?J^mW38Bdz}I7B1A=m26?x-`LK5gbR(Gt-^)XdaH2Z zDqL8HYh}_R%)NyRt75!#xNrgA>UJT*8paET2y5^Q>O2Mc{e%d&S0Tc?4-wM+e}4Q% z9&{w17QfT>Zyqh&u1FvIZli_ukrMp(9xW`K(xq)8c}IQa>O@d{*ImMVv&TlOuT~M$+eA#azfQz-TdU)` zMNIX!HCs6PVQl9BMtmaPbbyz_}tk z<>Df?9&1&O#r6M}WKPQQr||htaS{do>^WY!`|PJp`4{_%&!3->bBX!Z6V86J82Cri zy*zqhU0Q>Ays7SjQz9N;`oXpD#&L=_13ss}nE3OjP3t+sDX?50jAT5amSA{Fk+#P| zOe5zEIs%!aVm^o7r+9V^>o^8u6hR#n%pUvK_nXME|z zy8b;KNlh8TSAUxY)e3(;KJly>WAf!I0^hQxh&Zo4&n&!g^^ChLnveKTe6m<65%FkI zyhbzES2ebqJFZ;W^WCvxkMxp=xW7EL^BESG&FTAS`SXb=2lJ7$2FGUq|9B*>Z2Bc$ zHq#Fo_f0J z`1I{5pY9&tF2}k@cRl|no;j?=g*slWFNJ%yFyDN>BC)|e$>;R(;_kj(_Cc4V-MPPV zZ4YZ&)HnIZ%q2b#3`3F{mb2C#;67j5_hsF}_bg>G2j{t|{Cj(z`9oB5hVTo~;D~kn z>t?w3mB@=oZQ0xZ^@em{|KFmrvNHx+3`Sb7H~xLBEHn2=j<7-I0e5e|gV7(KnS6a2 z?E3K;f7e`Np174pZ?Xg4T_&`@Oc(&;ii zNps)M`R@Cw&0|3cU(b8f?Mm@7c~j#Tt??8oJa2zSYR#3DWyccUm7dj(6@9+>T1u+P zTB)?(4vK+mZyYpv!IRZJ^_6G9<3)7bE^=|EM3SAAjJ`mpn7t}N{i;14l9eAR_5 zc;A(_El%xEcLGb{~jYYs39;-MZdrp=#DT@gLh+Hl1m{ z@asT#uk&NUI_G4=l&>Z7r(fKb?0$I0@%zS{>|;THE{j;t+7&oQhI{*`fH@u$89%uH zeVAA28yZ&~$}c9ipNZ?JZp)i&W~sZcSt^v=HrsDfo3l9iW^QK5(T6MM|J?CT%j$mJ zjSeeu-w|5-hrG+qP}nwr$(CZQHhO+v{7l?fajdoaEexNoKmbt6wYKH44(eASeI; z01yDq+NA378&BS6kN^O*Bme;D|3!_RObuO3RV_tK%`ELKT`cYG=&YRW?RGV7?YB9Q ze)seRJ>Vm7H=L4+Iz%0JMca0_X&3fDvt6QvaX?x`wtEzcq?Fv2^?twjgr%Bjrn5_A zw?};=iLE%8bJEStD&pfYu6}06pc5bWl-IO5(znZx95o`9@*X-RL{Eu+3mJ%_T($a| zkAlw`xUf#dXi7C=^RWkWJ)RyzGbUxYDx1$;3v<4CV}Gq(Uv=#ziqLqZQy54tTVrC| zyiSXZ=eq_87U)774TM{;i-xvyu=Ak6u@HPlpw^6XXODaQ#-dv6Pr&VvYGyl{j5K;P zoT!br2}ZSuY-~(!r3(KNE^;)H`LkEd7=2J@OSMs!hoFER<79-z9?T*9#mhBPG8K$9 zAfe*)FFMAn z(UzK)lN=_TNIOtxA~G2cS|tb(x}eFJuR4@AFm#ig79w)<*Tjv>hiFLs@~L%6tV`9Z zRa@8s+B0UxIu|7oxs}%Lutr;~Yto-1GO!w?yu*BJ;xN=SGa_T;2UB&gf>=VehPq@) zGc4sjvcG)0h^Co!P?-`@63A{j2TV4BN#kspYb@3TTEJopIB7vTD@VrtZ>FW*rk zIHX1B2B@R!F>8lpm}^t?Jd@eqVKJ3}wv`8;W6ljeyyz#9BiP>yUAksAJ|riC!=`;^g(}QsrH2w7b5Z zLi&qY?lFh8+;RfuDeB&1Jm|nvk1c6G@2{N7#n%~NjoMrq$)?syBu&4J5#6h zzNqrSul;SZrBi#hIT{)}!GJM*7qIIJ=h2qQUTXyr?;3Q`C$^A_)0rRxy!QwUWNH4~ zQL$cKb-Bk{H^L@#zdF1!HKT;N^#-fh&W?+Fl6b))FwSDTvNyrN@6vZ$0L(GHhcKI# zU$I=!U;fx(l__zb=$H#J9HZvfxKMdB2{J27zNwI>{-Q<`YC*E0kF$)Ki!!_7 zA!3=b3h9;&9UIig?X7>Xw>qwLY}x=^zs1JMc;`r+<}hp7*eq-3NGSK8BDj;Is`#_@ z>SIj|1#dG7nh^pLdHt#5=e{>HQ9N8GT8cI<=qKW!CXUTzUrY z4ICD?8}7JQRM!!ap=D>q@6z+<*^Cf=qP0C75#lV)*_jcPOqh18MSgUVPs9ZdD{OM| zaB*>PW8nJmadB=1w{7F$+`sHx+1q*7DepPG3|)SKc14pl9x4??b}<1vhlYfzNuGns z_b4l}cAd2I7Z}S0a&3Pkj<(*h~!9~t-do0A!g;dU04CSwkw5Or0jLOfo^8Pm=pX$ zLin%l6+S5dZ@&a)BnD9RP}9_S*<~NGWFMT=0V2n_DpSZ z>Z=M5b{z9QE~}1qjJ}z*M_&C^`+c;H740V4zd~u-FJksmL9$sfnQ5&U1BkD7^42$o zD^+yA-JN8pv$yvyXcl+(ZEEUqrFQEZR=R#pk&fCG%9l#+!%?K83!VHTnZ})lRQMQU z28734d~@b@nw>nu+FZBLT|0TLF8I^@4UPsFSbc9nHSoYJG}{SYn9u_ zwPmmOr|Qk1tl&hWEH@y(zV2=5%dlWy!OFct3!ZPq{LLd|L5TAvXeT7zP{4@u_whzA zy(^K;%e53zKYga8|JHppeJoxI61Fpa4h!DOmpR}?1hnoHp7a{!RP~lx$p{0U`ZhtS zYqyu?hYh_T_Q68+KbL2I$WypPiye`YWm_)8G;Ac1B~KynWEf4+eqx)*OX)K>OSJ%1 zLbx65rOkGzxYW*(VVV+?(R`YStt&|M5{doUn1@>3X-UEiVc2fq1S_Le0Rs>&R#W(h zc&S6UXh@YIfgYbsIwlE(!7i^I3$M~B1y726~K#s&;=*d2lnMRXxRfd~>xyN-V>6k!vLl;XerOkAMx7>CPm zB!%4$`9HF_;r7W(t$$@?VD9g$=+o2ihGI6sSY6a}Sw#~ERrv_8Es;uG0ABGTBwSRF zt{j0!SF(fPlso0Emg(&0jC4)pByQ)|@XM%?ecsAEBybo;ZL7l6)`&iz(fKd0OEhz z(ALn>PQ}#L!R9}O_&-&6fsdj*sBR_SN2Bm1HvAcI?KUz>sNnW-_QGS*ld2qFR;o`;KjF{YQ?M`&8Nd zno^rfK1t)ZbrVIOTZznp%y%NV@W=np{{66I(i6jQw0(~P z>c}Cdfh~G@lO`sqUw)N+BrL0duWZ9NMu5C9pKJkHnuN&)N9=m!!4sxGhJ*WHu@wC8 zZwg-79Tw|dC}JjO0?-6t76+9dhcj|O%O}u&@+HQY-x0}kP{b$z_#sFbPbSHk;@VVS zm(NX!|6}z*Ip`DPfkOr`Hou4=*Ve{O1wFqdZHgq3cC>gRThe81FBDSR__l3>K~`g+ zb6Pho#O8E_(YeTyTaqpS#Bu1?k)qooKPSBMt_`r|C#l`vjmRAZXoH_C=4UJueFV~7 z$0n8ZEa&HlDu(Vblljm#^q7BRwUeF8TyI7P&oh1DgafKv<;Nl36u=tkhW`0a|CmN~ z+gfOy2^76#S^OXWxsCBphI|CI5ZQa`Xq4hg%18~Y&sZX2g0+JIl;ZpK6XI{%-V~;( zv2JR;y`5hcvxRTXE2Cy-^`wTsvTq{*14$o047m-x!}rw)_9%ll&moPz8hL|7Prw&P zA*1|KrZ3DeL(h3@8*cc+GO`OOJ`Ka_t9eLPeguOHHyuXoIe0U@)OCe*%hCjJ)^FP z2`B-xmW=gDNc_@-bX_wUl!hVmR)&o+xu8kOJkQXIf{5)EIWwP7-Q`8lDpT8@)$1`x_JNhzwa}9gb*Wb{vyk(gxWaD1AX;{ps2; z?TB}8>uucH1v=RRKjQf`Tg^X^uKFV)ElU=g#e7@4)s5(5z^&l>DKeKiBkI*W{vXg8 z*7FxAsHmywnmW7d04%4WTnLoqtX4IGIM8fC#9Sx=$H)l#eG}W6qOMj#gl1YOMJruc zQv+`EmiP**NDntg9nor;_iYXDW{Znf@-byy7u6B!>RO2vqQO)#Bht>Qg^=@p%9k<_ z?fwv`E3oQxw`3}?t1v(xWVL>*wZ<+)M_>eGO?QjNEEld*1bZ?aeNm|M~rET=(>Ly!%%-!PgzLRvk{wZsz{^nh8)y3$? zQazq=%`Xcb)SI2;`oT`0F<^E-d=rqu`TafCij8?pU5@0YZ%PJ1Ke`7>Y_u8Jf>e(z zWF5Hnf9ma=ahOVZu_zatsp&aq<+kZYVwtx>WozYe=oOY!&)#q037Y(?!xGfuCse!T zM%bglL-e6dLl;7g6Iblx|$w#!{J1a<^?QF^yl%hGkb zFuz045?p^Hz<8d;@ZhUdX)guNu>yC&JOd1B!BKiA9p(l+PZY}Y(%)OfSZ#@84V(?U zI)K-*SPP0KJ(hNMX>h*ud}oS{lFp{Kv;D3`(Cj@#Qu%q#SDBukKhvH6sWIE*nViBi zVDdvnYJynt1wDXSnNi6qW|-v=-C?Z-ZU|>L!*8VdM?eTHh8$J0GsO(KxytsVb@FnX zyYqr!1VdmcEV>}~r!`PGLl(mb)NghyNBqWrbl6;t=fQfu{;q5{G zjNU&dC9*dHVPoiJbC&4*&If>6=uXxrg2E4uVHpbEi>ZQ|)BNl4KQ#w_VV~f57<$ag z_fnE4N?$@ac2j6L2Fn}fX#|m43+Wh78X}N+Qn=G{Sp7c(VYc8ENOI*2h2PQ1vl`B9 zE`9bW63m-nhz?nLI3N^jrRpj_Ph}w~Mu{V%)eEQr{5ho&ly6?Z8+Y1J6>C^}QVa=B z<0__*Rz$|Y=2VfFBN`g$zmXZtuxR%HrfwL{!W3$U-k z)%2)}`tC*xF7@++c*APNG5StH=(>e&&9p>!x>Q^eA`*sr>5#OGtoMqg&ZqlU%93-h zRtCq49oBl>lPI}3nJX|<@cFmn60xB5(9&&SRf{BP;M zKgn{6p1>@*EIJAglDEs8Sbf3sLjA6$i=)RnW8S_CVTdEaMAE z+@KuwbeSAR`)@2UJPIb=7E?q|I-%7Z5?bm9vLNdZ@rMk7PF=X$19{qEbN0jd*wPKp zJWG0<<=n)S3^n5(V)kR3(AkAl49j0@>(lg8=@OqV?R_?44ROb~#8(r`OA2wfN6{Em zCQpau4ZsV^M<-kFdpBW>Ins?5l)z&-U1|ur1{~Wd5KsbBZO8QnBNpC+Ve7haLh*SP zPz-DyfiYM&=7Yg$)hKzK4l&Tuv?*2i(A==}?hBM)s6Z{q4QL0An$U%a5#{lC7S5uN zW$mWvm^{V7+bt4+*ovVSxQaqz1 zE;td`-atwiYowR4kXY~6OU|!2Ms~>r+@}*$dN)@T0(>vOW`K!tuHCAWi-;F8jFd6- z^FGf(3_DrrW>gRG20L*>9g*BOs-5||2txSM9P0G*ceP`MZ!)I#5l& zc4bs8XH$B-9GK^QWKrw`l;MZGjf8E^(PE13acBQ zYpw5*@D49=KI5jfZH|LAmeY_P1!NG5GmFmN4WOBuQKepf5ZErLya4F5{vyb{=O~dg zrd=d(gqA6PZKZMjss=(5uM$uq84D86h6(O~acW2HxSStoPU0}`kDp%< zuNv8qM+ciiU}AYTnmec>qvi$ z>ItsJI^C8H%?101_n@^=D~6F@4b^Jkt5GY5#m)>dqNPgU8iRkNLsGf4KIqj-{v~00bq*h45u7L0-a|jM8m%eXZ{?e?Q;;oe$ zHon~JpJ@08?lx&wm~+ z_PUjGUekSO!eV5V+GpX*w61qLQJM(mV}ebCDvt5vi0m&#)?481V*>KSB3@^fow1u0 z?b{sSyAKP1xEwLlw_10N&YkZA6ie^s&)m3m)f28}R=BvUoRoBxkuT$T_y1;#pSiv5 zo9x7TfY;3kBk-dE^H@Pl{`n1713W3Om#pTMoTiw6s&aIT0pTk>xtRy`HrflRO-2qx zw2P?5w)W#GqCaKOQ`GeRc3Id|v0Z7mW#zs@D@Upj5W=a7AbLv&(j#tfaQk&nHVtHc zc9xGxBmDrMI2W@@T>{(?8`y^`dora*-*ajkObQ?nLR!@0^pk!o$fs~^P%lM>qBYaE z17A!574pd>lZXgH3!%E=z3V?d^z%(cl{Xcc9qV!ATG9ynBqhkuEsmL$Dy3CfOKK4r zEH05*YLlmI%680Ih>QEfTnAk+6c;(1nlKAjelfu8h~x1nY`(zb{ZkNF_KJ;)!0D!2 z7oq+@PfkDYdoOda2$JBa$b}o;Kxiy34mZN^Gb1sLP%-F}CsOGOr3Mw_M`c61k6LlW zz%wlbDHiS$^Rl9T6NP!0o-}+gbo~x!}B3hmRF@ODd^D2LkWtdEFtv zRx^g|nGjK!hL$j8=94{nD$1D5d!(SvVMy6fGC=*ghmELUwQ`*-=yd~~0@l3|6a$ke z$IKJ@@e-;FC;fijw6}E(TEO#G%rQaTYPQ}W2*NKQZpuHG5$=EiWsiL-z;7z0q*9jp z{<)``@FBskrmG1BZM~eyoMoeYgd({*BXJT?D?S_RCJ7W)qZ#}A;8GGOxS#=5yM#cD z7vo-n-Rvp8#)9&E2tkc#tZd*1t9*uCOuNU!m9-bzFLi5!))qyY%ZSH43<`r9Qu_xa z$b!qDVp9h*?SCrO{Cx%{v%StkD}=L)bp{0ejdFUXDsIro<##$niK7zhq93187+j!K zTUu5KB>(1X@$~#paL^lM8+vvv(5V;z#)jn*FC8Qog3*q3t|68E!GDw6Z#2hB)e6pS zfOp+=2Q!zNl@k3JjDQEjp;vmIG;$}2aOrGkxTDuYOpzleas~P#Q0$1gtXj-qSMcIg zc_k*PnM5DI0yCw*P)Omo%mq*hbSl)U8C-NgjbsHtF>BlFs}x=n*pFjUrxBkh-Zo_E zFaChtcEwzy6Y3r^j8p79LdeL-rF5z0l;=mLCUnV#gybO)-UKAmC;jm)paowX% zag&(UGSFj*p=`6Jnq_UK$%OE*R5p|4jBG-F{3}n$m3Bq2of#NCM+@kzp)!ExiFT*j z!`%`C)g&l8#Ol1AaaKN~!SwMYfgRVx^fDb zfyAR0grB0~8+$G$>C>*5o}DSXJ{kVo@6Fy?$?j(ujAhfb8SM6wbw9W3!B~?)o|gk~ z>p%_MN;P1#?H{!L*XNkw&gq%WU2MB+FYyyw-@t3{L>sSpx1LA#uM+iFpJJBF)AKpE zM6{k3#pZHB?W2|6))VasE&G(Z-U+3Dy64o3=K$*d=%Hu7^vM@p>X|kJT2zg-tWN9R zcLPA(8=K&&T!L9-h1&e;&d73B$TGil(M5S!NzFWJeZu{k^RPWD`3~RAmXD@&o{g=a z&4XK7m(K>7X9L;YznkM;zfzxd(?^|bQ&74DSPu4lS3SI|obT1B?(&^6T3KUXze_6m zRe?RTkBatr#~07?m)}7p0y9~?%E0=xdEy`F<9IgB4E70R-IMS=Sw9O)PYw6&PC@M_ zlyud;v)Cuzvs~o*N3MP^y|W^iRlp z`gg1KSKG&_zjFXp)#Unjw}Fy&hLCj`uW4@~ahoxLmhHaj)_ab%{4QlCS{TRdHfb3<2P#Yt>f*AQkFcH1`B4l(6!f6N|X&T0|g23MF#fU~yr*NWt@yN;d`rn@r zY4$7`?#I5H(a8lCB~ajuC~yaq^!4{`ARE^6KOl;!su^&k{u`U30=`;ktX>kqRB5Q= z?iyY@p$dTpz$P?C1>70uWKc<9z$Z*jr;-9=Ur7flfea#!L(b@-k|>IbMj%Hah%(nf z5fzDpTVSV0L=)DZ4n{}3Urxk_4$}eYuCc@xIRGT}K!ibksfSZ(}H>U~xF*6Bpxms1l@0f#q2Pc|fnc)iNm4(9TwD zSi#Z|fZPsHHx5v9v9kh3Ag@9VNOA!&VqkM2fR<9S%zC&M5f2kAPp}tS=?NokUUGdJ zoP@2+KtVVl1Z+iutr&7ZDr0|nR-v5+2(Sus-}0T8HRx|>Ie^zy7zDKft5WrknXpLv zN~u%_X;@)XV0gM71$4H+4Ob_kR!j^gwX$a3GG*Yzq2M*~L0Vl+b^8p_l(0^~uy#d-!2V7_;PRT+> zL4%XPrVQjvU&HNot(Vbm1F)4nYju#bSp&BwBn@e?5w$$fvngt6pb!&hI1Z8~GH7>5 zy`zvwDe4LOteTP40a+kWFEOnX!dBccKNB3)e3VP~@ zDB-E|m+f_a#8}g^Zz|czN5iB1Wh9!GJHWR}+|6VF(7!XtuR82JjEeFs3VM0xW`BKo~DKr2mV_br}L$RlxCU z7hht&zA}~_?@gEcJtImspq@XTgY$FGgOAIuM%FXGPNI|`S{IW&Tr={^LY2`J^VE6-SuP??6Q2DYKFXP}M#i?A`*P@RmS_>|0m z%4>UGlBpRM6t@C+*~2d?XCQYLSvk2UO;v61F}^PT9%k+z`d||v?t*H707b@`G*rx` z4P0X`p<_xNy}qYaUW* zM>a3n6t_9(JdTU#KSJGXgR%r}91;zyqS^aZnpUA$vr5F%Qv5hNm})?QFclRipN%et zc6#NjTCZmcYWA6-Y6mW8;O=};RP1-9ck`OD7?(v1Tg;14CYi2Bp;WT3RCez0T%s2w z(|5lNt>@rG3Kj(wFVtFL;29Emg>7w8nJY`V0adW?X=Yuq1UM$y}^!(Ma~kRnkDRR|k>UnsKIl6zvRn zd!V)(U8uDdZ^;F&6jzmI!0LjycCmaPv?sy3eX4h9a?IT9PaLDbMscXy_{l! zXu!8AccbafF^FiXon+VQV~JSU+-a&e2q?VjP{njH!fTBvSC^>L0u z1kXaV5|v`JoTgAM1<0Uc>KXbaa*S}dO{h>+pquf@>8p{FpzZlxfU#?>u`hD6V+#h3 z%vL7aKh!b=2$>TvfGURL-7Q z`WCg*fb2o5b$K{@J;{}&6N|)R<%-|m5rg`zc^OEfKx5^q{)I_Pwu>EbAn|o7#eoSy z72^W9`{~be3byJxq!p5=S5rDYTw(t%gKRkQhzSn!7;|to;C~$GX1XbEL4>zxtBr-4b#s5AZ5=7d}@KQ5T0ga zRH@qoEC$`?3MG)*Il&(OnW|uiqaJ3iZwruQm5GbKno2c){09pn8UA6zP?B&))*Auf zJjPKt00>>HLokA(r~uCb<$aO?L@`vf!M#W7VgUdoQk9q64iM1;8s1W(rUAnY893#D zr;F3ZWW){dt6+&0>=Vz`M#}t}h2&+I_6(S%b@Eecjjpd;Q9{9Z;08F-Q>%k*%xYrG zbviHkb7x#FI283prD`P-%`Wke(EljQ=KjT^pn^ZnxhtVoRA~zR%;2t{-;mB9bW+fE zT6zXC`nug|EXEgjF;g>}#cF&u;m(8G)jya`Lydt=3^a2bOtvuxm=Y$O>N0oVtTtE+ z#V>`LUnqCo!Sv!yVz%N~WJsEDmeb=dRBt6c*pz1lUCej~ay0GE69>w|E^OAK(dv}U zGLB2@*@PdeXz-!WdzU+FbuX2|Ia#OBn;xy>Xi+2YTVWlPTBW@MQZRxda14ePGWpQ1 zaYu@&IWJ?Wf(sPf(<7*o15i}W%~-M~x-Om@w4HTz;Qwc9*brLGr29a@H*Bj&)5HA)9CVvQRu7k17f9J2I zR(JBpo*Kr2uO4%%;gWgJ$04!pa2iaKp~I@Mu%GgQEi@GmXX zuU+aVTw+Qgn;S`=wCPk7E-^m;mp)2-*=4Dn7C^~a`&gSZBdSxuPrtY&UdyKKl z13|oGeA;_tCU-a$b%kU%b>YwMO>CD5(`bYj$E#nH0HB63S|r~C`ESg=J5o~XpJMx` z3^ku-!}6_9biksT(V5UkQTuONCMCCXBxU{Vm<|!NbEm&`f~aoR>RgX)hDC2nGV{Z`g%h3)r1k>@_*~qH`A-Hr~emTg0TnE`yVMalH317 z>iY9v!^+^=Ci?%9ZT<)RAF}_-dM^KO3l@O-|H04AQ++gSjsKTjGr30Exvi9Px+%kM zg`nCg(PoOL^lbTt%yh*>oNYczhwI`{&s0$>f1tUgVZhq?jh5Z%!-m3|?wE-);dE#G z^LliYi3okpai#e(1hrjB>6?zb|{71(n%%_>84mx@LeaBKJUbx+_&NAJP8^oH5l0y-Xr_8$;m2!^Y>5 zd08`t9Vx{#nY_^>3ok_>?5O;$ff9`1waR``y=nSPFHk`Wx^@A~a@!g_b>yrDaD$R} z9Nc?!7rj{P>qy47#@t$d{{QUq$JM%e=him0u54gs7A;{!@e7HVfWEha=aVcC=-=aH zWEc3q2W+~{+F0i2g50`c|Azd_&;E1i9NJ(k67NcK90-h3_?L1zY?h*zM{vk;tr@~) z*g6i?4Wr;AyxoJE+xx`MhtCU%z>YyCBRY}~mLE3inFz`CDBPCRr8DGQzpwG)a4KqP90FhYGSxx$iWc>ls>0)0()72$Z{#W2pveTIPwj3FbG|jrzWC+ zhxUeA5{Z;rMQX4M@n~--2O%Fr*5Pq7vRnodbgKcoXz;i)918_s@tBTqI6B=pA40*X zb7+47?I$o_Amar#uw5OUk=m2e8yyVuBI4 zk00FR?(WHL9~AGtT5#a;Uhr?>@!i5#28#8XRG1@6=98XscPJTs9CEnji%^c2Edn7M zD;B2PBhKy}(SCmrX>%mPuS91Bbx<(*i#o8@2mx;+^?m51lDK_4QtybK9VJb@vYx%(WH=VrhD0cUsaNXpRbH{JT zKeX%pEjH|LW5s#He}Qlx_Wf1skS;KTf^rPkXeOR(;E1SsoWpd=n|c_`Pypx}pp*;4 zHmM8Y7?Q%GbRC7qhjZU1w>`Z-9KFu5xo^vR%_YCm`7`--{ETegbaJ;x-0m#`7C)H* zH~BI*e~c{pm+(L=RtWjD0@e}8RmYMMca%&D3KeVK8|JbfulzzEnFD}Zzd6tZ8n z_imoZp4^ZL&16wHm4W$Q8H7p9&M z*K1I;>Fsy!%XD8XG6P}45SIo{9>6y53}^d$2ozk#+@8=l*cT096GSztT4ib|f>v@5 zF#pC7>rNybCc(DF5@44m4&7%P*~E)gGly;zDoiqY^~wB(xg_(xn%TN0$CLYSNqZYB z0B_sO&(wNQ8E^D2T1S7=?|}@eT)cClf&%NCnM?AXpts~k!EA+FmwWQGr~=Q_HI8$1 zS$Z-tRT^=jc=rO$ok%6vB~>eco0(94P()hla^BO!b%LDXWNQxUCAw7r3O7LyGFDQJ z6Koed+upRaej-@jHRh?DHPXm~3f{T-v3HVW2ty_GMUo437TL?5QzASOQY~e>K+y!q z%uoeK5kM(|PnjyGauYFaOG|cTCI=Xv>Tzm6ULcMnk^;;E4~N*<=OZWuHxcP6`;6>N z<+q~b4vAdF^@TLFN47|mt*}iF$yRrDV*PCIBqVC$(PJ)WdQvRtLkpY95N}u2K6hT_ zOl2jLE5F+HTq4qHQX?3{%F2jtSgcTi<8D%#HFJS_BIGTdL&*=6WyMVqvm1e)3jEf~ z@HG36MKd0KogMeALtM|({DES?{@PgUkO>&xf5#4jmZ#()Fbr!S5rcrY=FaMUJKG(x4`g^q%rllG^yX)U7L zmru@0yQ0b@l1z)P7vRQoHgQXDp+Hc>@zNs291E4K&!n4(`k^_ogXhXR49jRZ+M7 zP8AiOttx4?+2^5~KJ24wam5b1iOdBp9}|&PiG@QWG3iUupWFUmqZW52y(SuqQk)y< z(RTy3lLS-n zHKUK*mkYw_KZRm~nL;v9PQ_|sNdV0Z^u5Pjvm}^oAx&+T>2MWM4E9ja=&$^Zi^ohu zC5@&m8RadKZ1swp0(hK7w7;n=?6Z))9cyYhA4pu-SXxBidkZ7Fl{T(W8o9S-s&i0pGsd|uhv`)9%6((&?J67#VuY>rvWtD> z;C3!U-bag79(0A3hEytZfKOrIUy;+)2BSe%1e#9_f|hWvFd-x@O68$ZrwfFA_r9)2 z!|Li!-r_y4^0j1V*Ko6kTAk^2j$eRUXuwM`cDT6;d|=4ve=He2p_iP?b{F=Hwpit^ zJ72-6bnXd}6YJyn6tcp4Api5qw(cp7T*AG8%!sV*XO%Nfh8#OmmGdeWPSHI#XDvk6 zlar!vdjG-15KFao18(}~azBiH9(?7)?ZNK#;`i|J`T6(knUtH!vYV?lv}+Ub2;k1o zYzOdzI7S*9jR;(JjqRoiK=G)t4Bepy?@rsktHGEl53{_yd0M9s+jmu-98D4)w}W+S z0t(tPC)55TsFyCE&calp(HziSBJ$@5g$ML$6VHNAvh|A$--H+*cma9(yBytHc#_QE z{~1PUQGjS2`id23qhN19@BhVJo3NxnlQHXfl`?b~KbJjFpc^spd37}^k6P4gM`uu_ zzngtr_t4YbvDpuE92!GunIX-LI=s`ySDfc@EmJn_4%dFO@E_%%St(agMTHRv)MNz@ z6!TU-)++XRk9GXFLb}X)<&D76)khfhE{V8QL82iZrgh| z9a$=C!;(T@Px`}YpJWPQIlDQxm?^(oUzYhIodEz<&P z%FqX;AkQ}6P(Uf-4K+!gYTl?geT(bi>Nz9_55k2mIYC6(EYVf5K7w7M|w`1g!=hRttGLV~aTM3is3Ddl2}qU)WX zvppeNZI?M=NqCXskVHcP_#^Q|ts zSEqNUdZYTS?yu!e7aQ!>YG{DXt1xtdr}n0Io1GZcnsKn_N~)~)laZB{;N^wwZE_E( z;qcj)60*9uE#|w70#*-~ZI}wV2WBN6<5CKJHF2v}l-92VCF2oPUhng79T;Iv}a$eF2GbJu@n4hW{j z9qH7WK^73?$*x&=8wsTjl|Dd@%zzYh=(!uHD^wjZ2-l3|>OhMJ@FN}B>h$xw!UYUHf&?y#1kw>C|vU1g!D52+RqR=Z|# z-$n;{22b=TuWx zE`%0;NUq_`EC>~e<(b3-Q+GMR21|r^iB^!WHhPQ%<><>CLJ0`;(mCb{R=LND(pWNq zm?=@V*wU~{kEgu`fW#4yxWZBgDy$4O)vpGjE6ZyM$+<>eG_%q)HRpA7(&A!-t=qzK zw7-z%*g!=3@4Th|Wlie^f@Wi(wiex(3e5(*<Zhwn~cUnF)`I2QaR8gLo50iQ~~s;t*SKwzd5ou zjgzkS7HI8QX#e|68CB8BxCEibl^(;O+O4xNx)r1~IMEixy1t3lI-a9_E3r|Lj|-kh zX0)Nzd+X|@EsK>5&S0O58OBW0A?hu3hm({d!-!vwl)tri;-tsMG7zq z>M15$m)uS6-)6GX$N_Ou^YnZV2jA`)WDQF7napyF#P-Zd>SkowG`G=u&_H$IqzRc~ zCy6+0-oPrN(g_4*v*zM+V?OZ(*b;3%siu7@P3H0{HIMZiH`P0x$LZn@!3s))H zMC?sCa?eo6Qe-(HXGw0r3*M5@aJ2Aacix2RuR>R5YxgK5n(i{=FKL-J*TMn6csJiJ zGW&qXp%^wr;&kk2$KLVl@`%503TverO)=^8Yel5?y{7bV-M?7B2=`f=|OS`-2(vB-)Y%{*A?H&rjk%U6_=#bJk?=PWBBsy4~Qndjc6#!>@RqHHfQ{- z>e`-g>N~@|?d%;>sua`q60dd2yk)tYi^Rxa-D*(PW_L2yUFnNKQz9c z-$y>4;;4>}N;~UQI3JI;IyJtYnysnu_Q!)=WPH6pHy@AL*~09Po2hfU^LFZBdWzLP z^8Ve|DSP*9Kklvrx`_R$dw~Z(;DNtXU5{;lKy*FRm{Zd)+|K(Ji!~PSZ$dhKa1JGC z0nXdD_AWi~N@zLQ21zL)7YdGusa)cK*=vr>~EBGR0**9m7LwGq@g1 zwz{=EnVPMs+>aH~;0)S^4eFYYH3JQu$^ zU@v}mGrAcdEP!)b^|`LDj_V^=i^QcDKobEStVou{K0e`eSD{aR3pBo#7 zxf~HJBHJ)Vea^T>+iiTFl?$JN!Vc%t&qI{CsFmum^TTjiM&JZEmiCMah}207+OrF(;_K zsO}?{0(PgvTllD4W|+MSrt50u>l*A&QNLsiD*0eCR4>{xDqK!PuI-u7P1mSXqt@l5 z(Sr5OInRAEy9f}e(}8!mPGnFb8Wp}k4Nb)n-oG~K2BG9kjNndo)_N1woO!KSImKqf zja9%9PjI%6Y}2YYQrwaz&BVMz$0RGL0+FYa4y{`HUj`<(A(+`kta?eq@vyM5}@ zIs2E@8~3c-rxkKnAlY}7yGZt-U6zw<*UfZaXv1}N!;;yRr=GjLPdIOKz%<}-TBgz> zkAL5u=Kq%u@MdHZVa9#l0&rU$62Ni#0=gmS8}kq*$Z%oVrWfGN$_7%x1cWU>I?oZr F0|18k!b1Q6 diff --git a/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json b/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json index 66d3f3ad677..f91cea274c2 100644 --- a/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json +++ b/Solutions/Salesforce Service Cloud/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Salesforce Service Cloud. You can get Salesforce Service Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides the ability to review events in your org on an accelerated basis and get event log files in hourly increments for recent activity. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the SalesforceServiceCloud Kusto Function alias." } }, { diff --git a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json index c92e65aa314..09f73ce3244 100644 --- a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json +++ b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json @@ -650,7 +650,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" From 17ca80c3e3a7d5bc2b4988bad3f11d752091fe35 Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Fri, 22 Sep 2023 10:38:03 +0530 Subject: [PATCH 7/9] Updated sortlink for parser --- ...alesforceServiceCloud_API_FunctionApp.json | 4 +- ...Solution_TSalesforceCloudtemplateSpec.json | 2 +- .../Data/system_generated_metadata.json | 2 +- .../Parsers/SalesforceServiceCloud.txt | 218 ------------------ 4 files changed, 4 insertions(+), 222 deletions(-) delete mode 100644 Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt diff --git a/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json b/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json index 8d9ea5ec24a..de8cbaa4c27 100644 --- a/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json +++ b/Solutions/Salesforce Service Cloud/Data Connectors/SalesforceServiceCloud_API_FunctionApp.json @@ -79,7 +79,7 @@ "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description":"**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." + "description":"**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://aka.ms/sentinel-SalesforceServiceCloud-parser). The function usually takes 10-15 minutes to activate after solution installation/update." }, { "title": "", @@ -131,7 +131,7 @@ "instructionSteps": [ { "title": "Step 1 - Deploy a Function App", - "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files." + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." }, { "title": "Step 2 - Configure the Function App", diff --git a/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json b/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json index 1d73718d7ce..34b1a4eb4d1 100644 --- a/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json +++ b/Solutions/Salesforce Service Cloud/Data/Solution_TSalesforceCloudtemplateSpec.json @@ -12,7 +12,7 @@ "Data Connectors/SalesforceServiceCloud_API_FunctionApp.json" ], "Parsers": [ - "Parsers/SalesforceServiceCloud.txt" + "Parsers/SalesforceServiceCloud.yaml" ], "Workbooks": [ "Workbooks/SalesforceServiceCloud.json" diff --git a/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json index a82320c116f..0834e9ec209 100644 --- a/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json +++ b/Solutions/Salesforce Service Cloud/Data/system_generated_metadata.json @@ -27,7 +27,7 @@ "link": "https://support.microsoft.com/" }, "Data Connectors": "[\n \"Data Connectors/SalesforceServiceCloud_API_FunctionApp.json\"\n]", - "Parsers": "[\n \"SalesforceServiceCloud.txt\"\n]", + "Parsers": "[\n \"SalesforceServiceCloud.yaml\"\n]", "Workbooks": "[\n \"Workbooks/SalesforceServiceCloud.json\"\n]", "Analytic Rules": "[\n \"Salesforce-BruteForce.yaml\",\n \"Salesforce-PasswordSpray.yaml\",\n \"Salesforce-SigninsMultipleCountries.yaml\"\n]" } diff --git a/Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt b/Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt deleted file mode 100644 index 36527634a05..00000000000 --- a/Solutions/Salesforce Service Cloud/Parsers/SalesforceServiceCloud.txt +++ /dev/null @@ -1,218 +0,0 @@ -SalesforceServiceCloud_CL -| extend - RequestSize=column_ifexists('request_size_s',''), - ExecTime=column_ifexists('exec_time_s',''), - Action=column_ifexists('action_s',''), - PlatformType=column_ifexists('platform_type_s',''), - OsName=column_ifexists('os_name_s',''), - OsVersion=column_ifexists('os_version_s',''), - Timestamp=column_ifexists('timestamp_s',''), - StatusCode=column_ifexists('status_code_s',''), - EventType=column_ifexists('event_type_s',''), - ReferrerUri=column_ifexists('referrer_uri_s',''), - UserAgent=column_ifexists('user_agent_s',''), - BrowserType=column_ifexists('browser_type_s',''), - Time=column_ifexists('time_s',''), - ResponseSize=column_ifexists('response_size_s',''), - DeviceId=column_ifexists('device_id_s',''), - DeviceModel=column_ifexists('device_model_s',''), - SourceIp=column_ifexists('source_ip_s',''), - ClientIp=column_ifexists('client_ip_s',''), - Success=column_ifexists('success_s',''), - Uri=column_ifexists('uri_s',''), - Url=column_ifexists('url_s',''), - ClientName=column_ifexists('client_name_s',''), - UserType=column_ifexists('user_type_s',''), - UserInitiatedLogout=column_ifexists('user_initiated_logout_s',''), - UserIdDerived=column_ifexists('user_id_derived_s',''), - UserId=column_ifexists('user_id_s',''), - UserEmail=column_ifexists('user_email_s',''), - User=column_ifexists('user_name_s',''), - UriIdDerived=column_ifexists('uri_id_derived_s',''), - UiEventType=column_ifexists('ui_event_type_s',''), - UiEventTimestamp=column_ifexists('ui_event_timestamp_s',''), - UiEventSource=column_ifexists('ui_event_source_s',''), - UiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''), - UiEventId=column_ifexists('ui_event_id_s',''), - TlsProtocol=column_ifexists('tls_protocol_s',''), - TimestampDerived=column_ifexists('timestamp_derived_t',''), - TargetUiElement=column_ifexists('target_ui_element_s',''), - Sort=column_ifexists('sort_s',''), - SessionType=column_ifexists('session_type_s',''), - SessionLevel=column_ifexists('session_level_s',''), - SessionKey=column_ifexists('session_key_s',''), - SearchQuery=column_ifexists('search_query_s',''), - SdkVersion=column_ifexists('sdk_version_s',''), - SdkAppVersion=column_ifexists('sdk_app_version_s',''), - SdkAppType=column_ifexists('sdk_app_type_s',''), - RunTime=column_ifexists('run_time_s',''), - RowsProcessed=column_ifexists('rows_processed_s',''), - RowCount=column_ifexists('row_count_s',''), - ResolutionType=column_ifexists('resolution_type_s',''), - RequestStatus=column_ifexists('request_status_s',''), - RequestId=column_ifexists('request_id_s',''), - ReportIdDerived=column_ifexists('report_id_derived_s',''), - ReportId=column_ifexists('report_id_s',''), - RenderingType=column_ifexists('rendering_type_s',''), - RelatedList=column_ifexists('related_list_s',''), - RecordType=column_ifexists('record_type_s',''), - RecordId=column_ifexists('record_id_s',''), - Quiddity=column_ifexists('quiddity_s',''), - QueryId=column_ifexists('query_id_s',''), - PrevpageUrl=column_ifexists('prevpage_url_s',''), - PrevpageEntityType=column_ifexists('prevpage_entity_type_s',''), - PrevpageEntityId=column_ifexists('prevpage_entity_id_s',''), - PrevpageContext=column_ifexists('prevpage_context_s',''), - PrevpageAppName=column_ifexists('prevpage_app_name_s',''), - PrefixesSearched=column_ifexists('prefixes_searched_s',''), - ParentUiElement=column_ifexists('parent_ui_element_s',''), - PageUrl=column_ifexists('page_url_s',''), - PageStartTime=column_ifexists('page_start_time_s',''), - PageEntityType=column_ifexists('page_entity_type_s',''), - PageEntityId=column_ifexists('page_entity_id_s',''), - PageContext=column_ifexists('page_context_s',''), - PageAppName=column_ifexists('page_app_name_s',''), - Origin=column_ifexists('origin_s',''), - OrganizationId=column_ifexists('organization_id_s',''), - NumResults=column_ifexists('num_results_s',''), - NumberSoqlQueries=column_ifexists('number_soql_queries_s',''), - NumberFields=column_ifexists('number_fields_s',''), - NumberExceptionFilters=column_ifexists('number_exception_filters_s',''), - NumberColumns=column_ifexists('number_columns_s',''), - NumberBuckets=column_ifexists('number_buckets_s',''), - MethodName=column_ifexists('method_name_s',''), - Method=column_ifexists('method_s',''), - MediaType=column_ifexists('media_type_s',''), - LoginStatus=column_ifexists('login_status_s',''), - LoginKey=column_ifexists('login_key_s',''), - HttpMethod=column_ifexists('http_method_s',''), - GrandparentUiElement=column_ifexists('grandparent_ui_element_s',''), - EntryPoint=column_ifexists('entry_point_s',''), - EntityName=column_ifexists('entity_name_s',''), - Entity=column_ifexists('entity_s',''), - EffectivePageTime=column_ifexists('effective_page_time_s',''), - Duration=column_ifexists('duration_s',''), - DisplayType=column_ifexists('display_type_s',''), - DeviceSessionId=column_ifexists('device_session_id_s',''), - DevicePlatform=column_ifexists('device_platform_s',''), - DbTotalTime=column_ifexists('db_total_time_s',''), - DbCpuTime=column_ifexists('db_cpu_time_s',''), - DbBlocks=column_ifexists('db_blocks_s',''), - CpuTime=column_ifexists('cpu_time_s',''), - ConnectionType=column_ifexists('connection_type_s',''), - ComponentName=column_ifexists('component_name_s',''), - ClientVersion=column_ifexists('client_version_s',''), - ClientId=column_ifexists('client_id_s',''), - CipherSuite=column_ifexists('cipher_suite_s',''), - CalloutTime=column_ifexists('callout_time_s',''), - BrowserVersion=column_ifexists('browser_version_s',''), - BrowserName=column_ifexists('browser_name_s',''), - AverageRowSize=column_ifexists('average_row_size_s',''), - AppType=column_ifexists('app_type_s',''), - AppName=column_ifexists('app_name_s',''), - ApiVersion=column_ifexists('api_version_s',''), - ApiType=column_ifexists('api_type_s',''), - ArticleVersionId=column_ifexists('article_version_id_s',''), - ArticleVersion=column_ifexists('article_version_s',''), - ArticleStatus=column_ifexists('article_status_s',''), - ArticleId=column_ifexists('article_id_s',''), - AnalyticsMode=column_ifexists('analytics_mode_s',''), - BatchId=column_ifexists('batch_id_s',''), - ClickedRecordId=column_ifexists('clicked_record_id_s',''), - ClassName=column_ifexists('class_name_s',''), - ComponentIdDerived=column_ifexists('component_id_derived_s',''), - ComponentId=column_ifexists('component_id_s',''), - ControllerType=column_ifexists('controller_type_s',''), - Context=column_ifexists('context_s',''), - ConsoleIdDerived=column_ifexists('console_id_derived_s',''), - ConsoleId=column_ifexists('console_id_s',''), - ClientInfo=column_ifexists('client_info_s',''), - DstBytes=column_ifexists('request_size_s',''), - DstUser=column_ifexists('delegated_user_name_s',''), - DstUserSid=column_ifexists('delegated_user_id_s',''), - DstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''), - Data=column_ifexists('data_s',''), - DashboardType=column_ifexists('dashboard_type_s',''), - DashboardIdDerived=column_ifexists('dashboard_id_derived_s',''), - DashboardId=column_ifexists('dashboard_id_s',''), - DashboardComponentId=column_ifexists('dashboard_component_id_s',''), - DvcAction=column_ifexists('action_s',''), - DvcOS=column_ifexists('platform_type_s',''), - DvcOSName=column_ifexists('os_name_s',''), - DvcOSVersion=column_ifexists('os_version_s',''), - DeliveryLocation=column_ifexists('delivery_location_s',''), - DeliveryId=column_ifexists('delivery_id_s',''), - DocumentIdDerived=column_ifexists('document_id_derived_s',''), - DocumentId=column_ifexists('document_id_s',''), - EntityType=column_ifexists('entity_type_s',''), - EntityId=column_ifexists('entity_id_s',''), - FileType=column_ifexists('file_type_s',''), - FilePreviewType=column_ifexists('file_preview_type_s',''), - ExceptionType=column_ifexists('exception_type_s',''), - ExceptionMessage=column_ifexists('exception_message_s',''), - Ept=column_ifexists('ept_s',''), - EventCount=column_ifexists('number_of_records_s',''), - EventEndTime=column_ifexists('timestamp_s',''), - EventResult=column_ifexists('status_code_s',''), - FileSize=column_ifexists('size_bytes_s',''), - HttpReferrerOriginal=column_ifexists('referrer_uri_s',''), - HttpUserAgentOriginal=column_ifexists('user_agent_s',''), - HttpUserAgent=column_ifexists('browser_type_s',''), - LogGroupId=column_ifexists('log_group_id_s',''), - LimitUsagePercent=column_ifexists('limit_usage_percent_s',''), - LicenseContext=column_ifexists('license_context_s',''), - LastVersion=column_ifexists('last_version_s',''), - Language=column_ifexists('language_s',''), - JobId=column_ifexists('job_id_s',''), - IsSuccess=column_ifexists('is_success_s',''), - IsSecure=column_ifexists('is_secure_s',''), - IsScheduled=column_ifexists('is_scheduled_s',''), - IsNew=column_ifexists('is_new_s',''), - IsMobile=column_ifexists('is_mobile_s',''), - IsLongRunningRequest=column_ifexists('is_long_running_request_s',''), - IsGuest=column_ifexists('is_guest_s',''), - IsFirstRequest=column_ifexists('is_first_request_s',''), - IsError=column_ifexists('is_error_s',''), - IsApi=column_ifexists('is_api_s',''), - IsAjaxRequest=column_ifexists('is_ajax_request_s',''), - ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''), - HttpHeaders=column_ifexists('http_headers_s',''), - NetworkDuration=column_ifexists('time_s',''), - Name=column_ifexists('name_s',''), - NumberFailures=column_ifexists('number_failures_s',''), - NumClicks=column_ifexists('num_clicks_s',''), - OperationType=column_ifexists('operation_type_s',''), - NumSessions=column_ifexists('num_sessions_s',''), - PageName=column_ifexists('page_name_s',''), - Query=column_ifexists('query_s',''), - RequestType=column_ifexists('request_type_s',''), - ReportDescription=column_ifexists('report_description_s',''), - ReopenCount=column_ifexists('reopen_count_s',''), - RelatedEntityId=column_ifexists('related_entity_id_s',''), - RecordIdDerived=column_ifexists('record_id_derived_s',''), - ReadTime=column_ifexists('read_time_s',''), - Rank=column_ifexists('rank_s',''), - SrcBytes=column_ifexists('response_size_s',''), - SrcDvcId=column_ifexists('device_id_s',''), - SrcDvcModelName=column_ifexists('device_model_s',''), - SrcIpAddr=column_ifexists('source_ip_s',''), - SrcNatIpAddr=column_ifexists('client_ip_s',''), - SessionId=column_ifexists('session_id_s',''), - SiteId=column_ifexists('site_id_s',''), - SharingPermission=column_ifexists('sharing_permission_s',''), - SharingOperation=column_ifexists('sharing_operation_s',''), - SharedWithEntityId=column_ifexists('shared_with_entity_id_s',''), - UrlOriginal=column_ifexists('url_s',''), - WaveTimestamp=column_ifexists('wave_timestamp_s',''), - WaveSessionId=column_ifexists('wave_session_id_g',''), - ViewStateSize=column_ifexists('view_state_size_s',''), - VersionIdDerived=column_ifexists('version_id_derived_s',''), - VersionId=column_ifexists('version_id_s',''), - TriggerType=column_ifexists('trigger_type_s',''), - TriggerName=column_ifexists('trigger_name_s',''), - TriggerId=column_ifexists('trigger_id_s',''), - TransactionType=column_ifexists('transaction_type_s',''), - TotalTime=column_ifexists('total_time_s',''), - TabId=column_ifexists('tab_id_s',''), - StackTrace=column_ifexists('stack_trace_s','') -| project-away *_s \ No newline at end of file From 35e0dffaa1f1d96332d410164db1b24a8287d408 Mon Sep 17 00:00:00 2001 From: Github Bot Date: Fri, 22 Sep 2023 05:26:10 +0000 Subject: [PATCH 8/9] [skip ci] Github Bot Added package to Pull Request! --- .../Package/3.0.0.zip | Bin 17390 -> 16942 bytes .../Package/createUiDefinition.json | 6 ++-- .../Package/mainTemplate.json | 30 +++++++++--------- 3 files changed, 18 insertions(+), 18 deletions(-) diff --git a/Solutions/Salesforce Service Cloud/Package/3.0.0.zip b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip index 38ee1afbc805a1bcadebfd6bf3464584da317459..e33ae14ccc7dfafb7018506eb7d104215f3c42c7 100644 GIT binary patch literal 16942 zcmY&fQCv;Ge`gcS`q*N^naCQmM)g|c63(G_IA6Pw)Wc`NWXjf zf*$Y@xEoGMMIEA!yP|Eo+q4UNpxG|b!Z;u;BHKL*MN&#`%X+_Ge8N&qG}GB7vfHD+ zk;GOU%sJ`iW)<=A7*{{DW6+6@d&+Ct9O>KT$Br72N_h{R5~8O>zl97$QLb8j&Bwv# z3|v?zVl<^1vH948xgJlCp&64hT$Rn|u7x?@ys^L5uCKcG5=Ce{(kToim#s0eZC`%b$kZNW-nv67hGn}Z6 zw+TkIh-_?3ZlwzUCS2rbBJ*djm@)dG&X#JUEDu2eJI2Wfi#?b__=}foq+}`>Yd}K9 z>0flV8BeD+FxwhARyH7Pp7<;oQ)hO7l6?P2{^G?$6P`h<^Z#X-B-{M`?QcPre|y_J z*%ZPURPviG3(D0u^-5*5v?aV2?O#gNAGAkMr!s7%Iu}_}20sFv4t2!wn>wAbJVje- zT26A9a3bwMor%a~IBb<5MCgJhW4`K8+Q86Fa$1PU&0iBYE+3*H^~MC4XlyTcl7v93vfj>y1jkn#@mt%<`>)69sBksnOey$WIp)f(!OCC$(X z+B(98XwwuyW}d`=_J4cZH;H7p%z|ky<3)ZTTE5Q;q43}%G+%)0zly0*r@nkgjo^?L zp&Ou%uE(q$l3}h*(eq4Ze}~0X0@_v{e2zIc`0%2iM2=v8FLdde+4zv02o9U}1uAtF z`kiABhUK*87~e87OoQMw zA0Cl}Y}erX^R1R$UAd-ym1?|kx;2^cqej4I`N7!8<4@W#sUcN4Qr_i&i`bburT0aZ z4}R@$lP#Uvv(3@a*a-%V;k$rcS2&NhO!itUh z)m4{!taT%7Liek~D^oK{m|JhKitX%AaZeI2SOmsdY*+Rs82DZKZVP}pruPtL)AB2p z3;N4nc35Rf+$TEbLJY^K`86(7-b{kb%93v?sf+NS)>|YuVT=Yv)KP_n#uTlcTEmv-Rp@ zO$-HZGYXm!0up)sspIFqH#1Q|@Q5s%#0cR9#AoKu`Vbj?Nt-&gpV?*B@kLyE2Ja0V z7PlMjxK~uy5s{%~XT|T*^XJ)&5PqVyJsc6@EY8`P5tK}rcC1BybdgWQ1&%6ga`JF- zad2bc`tWgaZUwh(|EK~dDkiLIlT;Bet~vHlQkYH6-0J10Xv6=gsMrNgUa_P zE3$T-wDaT%=nB`&NmGrYd}^6jA%ewFHoigwUBPS=9@qeI}&30KH#(J)wQTElX|BqM60kw_PQ zPTK=O2+efRH|7AWP!GvwRUSlgB+pjgnS~Iu^4u=00A1Ua!Yxwvy4^rGGhxgLejy?J zSN95^6o9v10y7c=sCuYrYP@W(j?-O?T9x|n_g3A+ulX&)jq^UXnxdmdLtQI4RqT13 zNuajQ=h(XEY9esw5$a+Y2dK@jHVI=4R>BmuvA3QW^jqKnHuTs>o`lGFqJ6!wKf_#w zWq&kQwi`BNk1dPQ_9pX*^SMv0y;NN|Qp0iB0BZucF+C|^_uy{YB&g9k5s5Xmr(ZHyP~&>gt&KyD3Ul)tMdlbT0x64+wfjYke5ITGF4lnpz?%rK*@#+)kZ=SZ?jTsdFI$mqJ!oF{7K4kLN=ytB$3B>Dnu87 zF=h<4MucL3F)Dd8++!Tzv2Yb=O0!fQC4z1l&iSi*l*Vo=L-_<9p#V2vp6?B+Vb(Lf)`n*|w z$Gh-`C&t^`^eZ3IuWY%n7QVKU+QN1#S#PV`{d6nc%%|>~e(+njI|DB>oyvtmuj)vq ztYS=gyvf49tZh-;=Cpll$*0G2?d^o#T6=@Ywea3~c|~4qlU_0}v@Lgf6W-P;w~uSf zUhhxUn?YH@iAGs&Kz@DQ+tQa|!M=i(dxaJ}--`J=kB|i+&YPf}ka$A@BhKH)8@=?d zL^dziQb_&unUeln_tEsRcqvHO&h$Afcq?D#fEN+ax>I=4Ym`&fTWTdE40!6>1f{Os zUYZ{^^n%z23)TNzp7|k9;Sw!&OiGq*xeU{=kwlg}g}{?xG)4P~Z6YtF&)_W80#pg% zcDR=|+o9r8J4c3TN=!!cX(G0+Akj-C_SeQd)ap)45@ra)b^|9^8LbK!fN-&z!bikQ z9l}LJstgJA&&i}?l0X>j^4j5G;JnW#T#Dtm(@ju2%8QA#MXY~z_E3AL$P9yPBJQ!+MZTcZ~%5{TqT0U zYZi8f>&E%$aM-`a_Q=1n0Ye;iN1#IyT?kMhf`rnp;~xt}*aRb`_-{WG7ic`j;qn_v zVYfs6k1TGueezQ4Ul|#g`}->T^fbJom`yNN7xi3L(ZoSjJ_2k@q!Jf^SG))b7uBOH z$KcVG>>xPhPI;?kI{P^zT@yKp+xazo^i6nwTZyUxeegstzTC{*w~C_5$H61Y!fzvg z>|J4Nq0`Z^-9NAHu#3mediFkKu&zGyJzC*MuKmYeeieGC6}+o)fBpK9`n9C(e8KPC zKUOib-rjp-gH_>w$VNYnp%YyusQ9rGS?%$5c|L&^{+~8{hSU_2WCs8^PXq)&{HG0V z4K3|dOl=)({wc)&s=^yzTla0YrSrERRF56+_!}L`Hj}ef**Px9rO!3V?+rPx+el}X zs1Or73Z;{1TzmF;`+jEN01(N5A`@;$Wl!%Wwm?9z;LO1p0O0Qr__4KL^`pF}%I4RQ z+T8LB8qcOy(!S?1xpSHKlyJ-W4|lYuJZxE0%_i23TmD^wB6 zrsX-mewm{9OPR$@cSB9?Z=Q7CG_!pF81*D_8k-j5`IeM!uqd{-t+HyS!;F zv`!6zUb+Cj$9HLK^qV0cK}AIVou#!Sr1LZrOfS6$AUq$YUUosu;>UAPja-3*j>CBdAZ0zW zX0MGgL>J5b(6@EXmTHdJ#eKFSgRp3t3Wr*ml5}S1b2i+?0%QqKq7dPDY+_Y(i6Dtl z^wobhRaLts`3gj0##h6d*=X252=82sdnq*cRhat0uvXzC;$*e#GSru`OX9V(J@@TL zbY_cv0ShY6b9DrTLudRELyi5N4qm2jCQqkoRjsZntVFSfIQs8-K|Z36(2ZIx)>VN^ z_G(MBU_n=b{=%Rp5{xVH<9J{@K3sXxiS@QK<0WG`1OW$R3ST7&pb{q9i8rJwYrBAhy=z&vZoVtgfS0o7&{Q)P@z-x}OTV z^R{>IO$z;ukAc2vTC{u5P7{>4y*)#V$dp;q;fx}tcXqZ*+9;bN*Ao&>Kb`xr9r5mM zzU{nvhDJWmhj=!{R&xN_U3WyRZNX|gpJ!{gx;A|TxDoU`LFN+QplUsn_lIiL=jPPgax+Bt#0<3GQ(ix=Nrd^K2b z#eWcw$Ghf=$G_#^qT(RQmL%-(`2t33Ur<|Yzq2@| zuNk2D?jO^CC{`7#=ca8yJl3Vz{$tc#>JilIATtLVLQ;yZEw=% zkIskQ3i4?st8_G?GU}P1S~HFfyc>w!QU>}@(E0jltfo4edA(GdqoEY(?~ZGH8Kgwp zBmP)B;N?FoNbiMl3Z6f;!^2X&I`7EOl~nml$tYY)`^(2+dF|3s0~{%9i@s`y(^mmG@yUB#d}-Jf_b9%Xs;F)0 zQlPJfO8V+r1`6tJV+t1T!>NO6|3kH#`pyZIq zquoOH0AUn4Ok>c$ZW?$b$lK-*iQkeTa$XZW$Uu~;;K*ru?~_Ycq({`< zeKvM7k&Hz%^C{iY2>`Xu0EGAHg)7fIx(V;8ze%6PK_{?F)CmiDPT&jTmjsOgUE?3a zX$e#^plk{F0w~`PR_TC@DDV?AE)*_EHLwQ8*%+;08V^|`bGP69qWvr(6@D^IVhaM| zh^DOro>-*=EF&orC_HHfH>m=^e1}4W8Nju}Xkl)KB*4Tzt1$K;e@34lixSzR0idyT zGC5OJeis3N+M;hH&3lHd9w0Cj{}ok-y+{06VSeaMe}lb1a544km3$|qP7?WuW!K3d zWFM%j86*-#=u0GJIH8=QvYp01H6P3HCJTN6M4K*9&_n&4iy^$G%4bhvkv!R|2##{Y z@U7|9e6OXRXhKLazQK>0b7 z&^D3T+=4=|t9%)^A$amWA+tQpvcst;lV2pTtYMWcj?oNtDbLql3scjlD(=1@Gd|VJ z58@5481eL-h2nLI+?i{M=yWe#5;zD$t#xVAMCN5}n_6rpZi+V2B>>Y;P?L;2X!4bMDFdR*n)bSxWa z#y!UF#CD^h39}lMzn0b~>Zj5uJYLxOwxk5$kaLT(CX^c&;%=;~%V- ziFksXuf!y?o;RYMZ~cfu_*5M80>`5zW(^1_%5+9VriG}ifw%{-0GWy*sTi}q?J{+v zC+HZEvF**B5;!`u8OTXEcsh&<+>e*4ptRsGsGRt|{h`IeMQw;TO*+7e3l8rDcmxp= zXkYQ>)84A^TMFQ%D}>ojZaa}bCsWqkFR{I27<~Ymf^Zp~ad>}-(3hX=(8hW$TU?R$~n4_)jCjJziwnyMa`%bc{|@0 znP5Qrk86xjBK-3p$EBuGGm(jbLZ>J=!u3(RnPlV!Bk4~VTo_a|KH5wpknoCJ;(*4F zaZkYt)>ssU@FdPhEbPuX0pEvau0xf62!cer;_w2Z*Z2#j>n2ag%h^G>RY~DA;uN5| z?4s^X_ngv9vi#Ku3n)H%fgmg33 zBCJR0HmE5n+Z&|3u4!1b6!-rs!@7N0d5h2Z3FQob@GfTn>6lTc2S!; z1u#)+T;F7;i@N0*c#w#CRWcovp`7HOkR{GUOG|T8PKcHeB$GJ#LY=0qlN0tc9D~=# z@8RX&_HvF|`p=CUO>B_3Zu<#W4$tL67eYtHupuCel)gKld?}On6}>nQgZg0+ZZYf6 zOU{V*ZVtAdB?VuclBnunnRX8|s2uAtM-e=2O zI=}9j?B;lY=gl^u^P`P(+CxkX1S_!soR(KgR^v;|Rz^HVTeyXS@Rgk22m*K;?}yYR zAqOJbM^s^1`|}pjp6C_;kF8e&T9fuhxKwu1^A6USP#M9h*$>q5@@Sw zFn&34CJ<66To%*F605Wns4Sia{w>A-y$Y`JprT%jF$lE6O0533@at?Skr^y5k!fm^ zrzFaD%vp$zb3oMuZBmpMK@9z27N&e-fYA}Z-Bs3nc)LAR7+CU(42!_&u3HzO9z|Dn zIjb8W;HAE!)jeiGKx@xpTPBywdp58PbHXIQmVjKuo!a} zSJ!1alim~F46~w+R~Ev7foWQ-Hq3{$6+rJB-upVoX-Z~!`i9^bIF5bz_0gzhy(dBz zq@^!NoqcavosTvm^QMwhKMW}xOM|M$;kOqQsa3S50R3r|X23g_f^%XL;GT7OJO6G)1O-4Jj4 zT>+k#wx&YWe9op#lDtfy*-y?G+=W$4=Nnpy3|fk(u1f-obSXq zz>QSm;<|uyj~x(FYHUOk3)6$WI%s5@m>|nm78k+fgBs-%7b2@OBg#}M!sy=07a=)6 z*f)sSE>Lk@+@hH%t4b)&I7!;c8#%?&(91sZVeX8pXHrb_K*Q;k%0)$m*aUyM7R6X9 zA(qXa{MqH%k$GJionIYc0x)e9iONl^Bx%FjykcXx8^|7qLoAehD%-pcZyagI9YKxi z)r7af<-H4dWCXQRsP~&xBBKVEr4+nM1cZSBqN@9J2?l|r1E#B3Zc*gl;k|q5oGmL= zD>$_`-g)C4$9ZSB33N(e1Uog4-_W~7tL4P;w)xI@bI4@OT$m%7lHiF74z4vwU4I}h zP$~BOg4OiA($MSTRppl)d2Yii_;jvHWD&C50y+pNK8i_=d(ooGADFV;UHk7@{af`YK+JE z7uR~>Rtuau>L~6GS8`yi5p6MWZa)>47x~4}?&L*m&n}1KiV;O{-vG|X@%1bk{53M| z9C}|NKXoko^7Iz**mpD@YtcO==(9eaaYA{;^GW-Y8Q$1Od@x{QGBm=88Hi_u1t41y z-c(s}VHBAm(C5i%th03HwXJShg&cKij2si#7Qx>>EoX!~J3`1V-01#;g|z3F*>J6^ zeX7=}f9qh1)9xK&p98O{a0K!t!88sPqNY&`pLZ9QmZm_3F?^1<(rE>r1p31SGk*yn{N1qYVrv~?^+&WHbQZ(1G zX0CZ*j{KG|!VUfCfKcC>@D?b+Gt>||wqm}iB}&JsJz z*<7uo3GBIjGO@=q&U!Y)HV#f5E`#l)3+vPBV|TSrP~IAAphxWPn%eBe%~_55&`{Ur z3|}(KtfR(Ru|6l5+b-WT#rkvESq3dPNmc%Qm!{ms5M1LV-ao&yIGXxKCEj8hckaa0 zHU;{F)>-hxOdG?eA59a*CK>tU%wwBQ)H-*;qJOc(w7US{Q~f6+J)1Kf%h`#sUOeU$ z;0mX(pO;UYfW7<>uY7wVRp&&a&WWV|7-!P7PP#i(XX1_q+$nKqoKy1z`h<%v{dj{c z^-|0kOT9CuT4(HzExl1RZ2<|$9hft^T4z+X?ubhLVeW)#PWsjQ-;6J|O`8{ODK-^8 z?^17}i@3y5U-ODEYeaXx9dai7TLE`DmP}xGHOMj@d{UjhWOrZMvV;epWhm1__4~t< zq~?41z1jbv@%a-s5ERRXr!1h7T;%eSO<96#VeOCJYqxA(!d5~iEzEn{AY@hW$Rt80-_|A*3uE6(gDC=zBNEW+dbp&jBBl|@ zTq9BTIyfS^4md_Q1wuN!X;yf>oUQu!Zw(M~;|5#VWeTY9g3W0Ii-o&G&3-O~TXnb# z90SZho;bQkR2CxkBv7yrS(&AC!CpDVrPf>a7g&pjDV#53hr2p)bR0LF~^WpvX126>1-( zWHXwV%1pYrBTCx>gB$i(;4`JJ7=FQZ6W@ihx)dDUeAEH6QL=3WC53=GP@#xu>gWy< z`zFg}U?#PO8M3jn80CtB>gA6t5^+Zqu>eB_u|Xyr$)#wc_PM1&GFC-PO2BeFhY^kf zYGr_VR4|B+iltSqM!*QC1}c}4!L(*!5+a3x_#_*IV){1@fN0o&{wL~g4f5YrP$6x2 zr5_mu4Gt1*GN3bGCc2HtcgdcUULS2t3MPLPXWG#&l?TW^7m(%$giEnpjZRr0>EPsiO<( z3prGn5sG%BAug@3*qj=IcBip0xnz21?O?6vhGhR?DEdbDC~0ezE;@f zt9+&Q#{NgyK2o20wcL(Eo^o?6H4@bIvCuPR#!^xY6vi#7B4a{Iz*rCOB%j0y7o}nv z6+mIz_=5^!L9(_zkDdpcgX1bTKt3OvCn)dUC*T+pjckLeqB9EPS!HW_2o1f654#Yb zJkI=%&@TusBvaD`^%prQnbaegRKW5O1k?hhb!XgWkeNn_f@}lfkHXtsI3go%VXBz} zF=^QWm7BKxB^NVnC@>Xpvd15sZbJ5K^0Kl~T57tWNBH`>D=RC93eE7E9sDBVswdw(!lu<5#cPG z*hHjL4(#GGDlT(SdEn<$1H@fhgEEBnEHaHNBH4@4nr5L+=9!46o(P@!FiQXg#8g!v zd^Wln+v(!MHEu20>DXq6qAa+l(3v zxbm>0640^4q*$@WD77s>QVBS^mcEI6ha64TYZWxe7yOd=`lV#aI(+wG4Q2{Wdx(vN z0>Ok6G_Mc~<$aE~^sNfoUe5~Du-3IJ61l`jByoj-?^~CulXK#U#?eS0R2nBY6is1u z6bH87g{)2CIxuS#{h&OWNff2gZ;7 zI$hj~8+QV!!@vUhVtT#e+6=#907l-&7~T!EJ;Xa3wuxGjVjNm2;$wH6SpC%($;S~E znD>JKID85Qcm=Zo2a-B)``Vs44qps`6Upkpxg*OlFqEal`&7nHBNjM~7_V#G2B;no z3gKZ!POY*vm}=%_qEITL9Te;_o~;6Yc;svD^ga(so|!lgq@i5@+rKy=lHo5}j3o(& zbkzum?=j}$1R!vJ3d;WT)`G2+G}X1pPK!-3B}8(>K_`(F6*mg7FXMx?udhV%>i(%p;Qak zm)pqH<+fV&*NKn4@I=59mzp$@sC0#!imtMp*)7bXq=F;mZ7I1@Ky?=D68+X=%z|DN zZvJ1p$V@Bq9Gl0-r5;06u{Sdsw?&xJY(D@WyoOn{)fm_W;P6NzGB51dLjZPXU1Gl(W z=i<>VpJp73vb4!MQq|l>qxUZJ)$X1vVRyogr9VDkv(=_X+q=fzAF)q=08%jG5;zRW zhfUqL>fDjI)!vr9sNezw4)zaJasdjIU(V#LIW*C^!JB#KnJ+}86}tjFj7i!GgdMv^ zO~5ibDBp8~KPekW03_2~rEs|4_Xs%Z76QttV4|UKV`fjJhW3UE8LnU*;O#vaoLM`f zo*>MxZ?`Gzj|v9sYV4By&UPNal26kWZn#y!2x6ax3A93Hoj2SK@(&6WjRujug)+^; z+T@M%*Cthm^2gp93WKboaH`_CLYd@l5Sdg`u;iAZlA1v(8@TT424yCw2($t_7f2wL z8`cxkQe_~t-hE`S`8YLkhz+y5UWU=jbbdiLuw+s|rol4qYrF)W?VqsD>7Ffh8eQ)( za5DGWrr?k8FCjCnW$kxjVMr;P8%gW5>);n5u{@JtPP0;9DqXW4?^3neuRgbSzfbJ| zJT>+mQ9Bc%79R#;C1Nq(>2f*)sq5{e*eJ{Xbnj)mPMd_MIy+o<8kPR3U!p+sb&>;U z_p_eMqc`@HE#sV)8e;3GYv1X1yxA+!?xkz@(zSc(+QFe!@KviT13{CU&;DzbGhh*U zcC-c9wx-6OjcqH}n3KQKsZe(w+h1!oHKSuRg+4Q)Lj>%c>e)HfqhqSq7Kd2NM6aHi zu2!IRqIz1|7^-?|D*LydiJsb^dPcg_XA{)Oy`>TKXZ*x-G3QvQavpfS^o<<`L9jWjsIUkT4(>8Z@Et%*CN$3vxbR&`acEW z8vMfpX`AX*G2Hww-11+_zgn&k{-gf~0PLRXsR{U3pY+L|oP0;ixfT{vjWpy0EfbY2 zX3A)nymN*7Sj)~tRoSu=;XT-lJdh;W5Vv5g}FMg-%Ui?q& zl8$MAA9s0*Dl;yy`HD5s8GaIuc-;=kF^S}o<6JX<>9mrX zswsxUhkboIH}Ulkn-7~I6oVayOh$GjA0j65uL&&pxUyT_l zNZ{5GpT_UeS4{%AYrr9^06B9aVmUe*E^EF2fF2;?XCxE`J6(q$$8|&xmlfe?2gyg- zk8u>UR7sP|R66}JgNz=+8=e#dX-LUqa36q+EtE8m0wnhdJ6ekOvTzjd|17YuibZsyN2au5WKP5nsR*$Lqi&m zw_)%J56%Vy_J+T`<=xP09efGjhQF#=?1ZRg%_!@0XV-W}f+f8YLl zaA>ixj~Dy(1`cxdNZ>(V3gY!oKh06ttC6s#fhVHlaS`JwVA{bkbJ@@_NHrybZPpXS zH6(#S?LPd77wg_Ru6sV8E4sUfd+(0>o;kh&`t$VlKW%s}yt&yU?DiG|i+N9jnSh&_ z@TZZbP{cWRYG+OhF6&f{=C%z#L6-j92|jEN zvcRV-FU%iV^&%Rm=8e4e3jddfn|m5JaHI2D)?jx=Ow$n^suM867AWih&ER||VgIt?3=${bJD$jtqw+aTP1 zJ-=h)fmDF?PIN-8Pp>z+_*|iY$toP|KSls)m!)2VI~C+rtWEx*lQLV}Gsjro{G{ak z=R^tg+0wOZFco5!V7CPAU{2;-*cbgN7w-{Lrn9X{=*Nk6K?vMLUC1~|HE!^A z?3CN{0y=6<8Ta_xQnm;yZz^`X$H$&2@}Z}4=#wNn>J+kf9j7JOItcZI%|azJKocch z93=>?Xg=lD%xY~^NxQl-E7SQvP*m^Z3-LUW1$7i)cG%b?j$S{Zi4K#o|3lA9?gXCt zmCjLUS504Oa+^iVM%n7BWN}S3R*3J7j!Z=)Z(R9QM}|#lW_BxK@&TjH>&B;ytGsA# zE;SKQ;lmm{)Y@%^%10d?jf82>0su%kKyEf%ds-edw#-VK|8YB`F2{*7@>0Q^hPhc1b}B>3EHk=NN4*S2 z3ArvRPU16{Wl0ocUfG|CO)9AKZj-J$Q&|1VAo5Pg?7wK zQ1dZqqG?E1H_wmDp_PPAgTyrtoLyNkW8h?BD9x&AhDf{!ods1*SXR=pY7*bVy>r;w z6xt=FZee7As-Y{BOBZJ+$Tt-`{Fc`nIp!GcgVTo%5s7X_@;kPieUO${JM;wL9A$Tz~u|#EV zB^U)*qj}hbAYsP+NQND1#c)C=0H1R}d_(FXs0u7IRSHm|MgNQ=1zNxasXgyCgNan5 zT&PnJ9hb!0jl2TwL;1|$G#2s$D~nU0uCZvSlDgL=F$~qVK1+3;fQx5~mI@8a=E~>L zl`dZXOk`ATl}JVJT~DE0c`S6{cMZATQmAU$5~~-&v;(n8kt{H%-#&7CRsq5Y76v)1 zad8CMpXgnO<K^A+6?NO=P*wTS zCYye7xf$~9+cvfyQwX{LJCxJ#ITc~KR5&mumtGeQ≷_Y;kMWbEuI}f`2K!!}Y}R zFnrvWJZt*hSlFW7xC;c_kI+S=lQrO$-4X}JU#`P>W6M|UKB{u!y3XZHJzkA+)pW$e z5xacgTcM<&j+79wYnhfnG8{h+$=7$uBpC{0SZBN41e8HMl@oL{{6>bBEg+Ib)0PkN z6w5Yw22X;0P9WMo)SGl#3Z9SFwmnXyH*78}B8lI?%I>61u9*a|ZrZ6G+aMNOpJ|V| zzb3sn;m(c;IBwQ-%Xj@1sdmw%O+mN(+S;qpnb9h_b$hu2@>4)t;m8VVWWsaisfavk zQAZ+&xSSc!l5u;$X-9I$Vd*Z=PMNS zs8;n}M@VUSsX_+;9R~gvQu^w^6v(QelOvjGImNQQ(LKY>6xqA#ClCzX zXF~N)bg_F%5}|$XC4*~dyGo;%052$eB5d24rVP`EN6w_>yljOP#81uP`RMv`QgltP zKj;`@=@xImb^lzhiSf_<%{;h$nEf7{J|2EQubzFgQgd50Gxf(dt|O0t?fi^(z<#J? zs4>!rz*g7TYN~(~kDA-i9ZK--r0KgDj+yc>%Zt0GWeTx`ms_yA5Y$ZBP0-dEo4-Q;>pm(2G7JHKIBc!({M6tp%=u`hY^4|$~iA?^FWfzM= zmldcxCZOG-p#i_gNBD%qWeEtG+m2W2@q;+Vtf4}kiorkES2?*<`LA7_z{<0qdo}*C zU#lmhudXR2HZtL9og~VdKfYJAmznjiE|)g${$Fsl^&W80H3z zRg68U`YhF0gzovLsZpmgRmV}(znCWm$D9tANf&7kxLIe`way=~&g=TjSwS4@5KQTH zV12alO&$3MabGpjqEpx5@TYY*V)jiMp0d=NzF$&nj9?q(bLPId-}^;-?eSgo}S;CwtV`s%EyHnBk#C3AGqWdDBqWvl`a2S17a)=o$$u>MJU@~~Ay*%mS>D@5 z48!L0L0SEydZoxyUYFAtOj*WGtpoc)^2UE-{O|T7CgqQ^w%(t3&ori8IMMX)@-sB2 z#FZZiEiV!*(HszHD*%13+4;(J`sjv-!JvAb_UY?YC+F1}`unAq9u*77-S0KmZuRPP zZ$$5xwHN)@TI=BfURlfyG5Q*Wtn$`g_Aj#%0W{^A?mE-0YJBBoAf@#7&iE&_0Mzn3 zX;}^YR?|Q0qL%MR4Y+EZN38{B@1Ko)uCvyCuj`kYk4~ecD;_U}PQhsUpGiR<@@drP zqrZ0AV7S1W`dXV0kex)qo*cj&0SX+xuG5ldy<+1 zgRGzkGu^Z7w$us~)P4}TG6T|3p;zvZF41(}F?LCajyPNanJ9%Wa_ghd?d=x|{atgU z{Ul@qELaFUWO1Bm<4r@#U45Z&!c;LAVwrz%;e{Vqyv_k42hoB*CTvNo555xxU3x7)S@)1V(d0Oe?urv zebtt$qr3%7Z9iUvW)NFfP}2dR7p2=doNt&yT0eyD+H1EF3h^PXavdaNkTB^QX9 z5@m}mEvxc)TO|OJIzkXvSfYXoEk#T7twQR`^IS%7u9Ou`tu#vud_9@CxEf~(wUXY| zQ$lgNNIu2OgKyT?s>BZl#q^AOL6jQ}I166Vz5UD{PbM$oM=L#Dulg)n|4!#z(w|i^ zdJf-f&r<)zT+RyMp2H=^BoX0r1!%Gz3JQtp`G(Gb8W~>EqM;9<;%s-V7X8l9y>8`k zu!Kctu%;Q%_%X&+v>H~0U<*TsX>je|Ss2xdS_`zs9^H!encO0tt93WAN$EZ-jIYFK zbCdu2`E~0a8v(nvHV+HeM9U%Vay5plz|G0JPYo3H`J{qAXY;oH6JiGQ#+a%YP&LGJ ze7X>si|q01gW}jB?dA57iN0O_#RDqYC^k1m6-S}4=y+<7WmcG&s&&rk?5it}l%0-J zN{H04B~)cgc)~~B#rNt?aPp5BkQl#T}9rtX^~il#Oru zZM`{U1x!-kwgq6>4cHV_B%OdAQPi#ovntUgOTQySVc=)88}LN*@FF^ZzT&X2oa5UN z)x2+#^Yia@+`t@n=IGq&KIaPGJ9fyHwK2=|r9Q(-9cVrB2M{!_`49ujo@lZXA6jT* zutku1h62|EOHn`za?`Ib5=#$9Nyk;B(8-%=hGw^RjsYV}?t#8hmni`5uXD@Qvacg> z482`TAQGh=ji6`pw0!pai{f5Ml7`qnuX05sc7&$%StCkpU%dM)4N|}_ek!7PVV~7^ zXV!(8ToiE854^Ibql%-){pru%;o$GR#oeDj?d{`V1!&SI(mc*xVsQz??8Lx9&CF2 zK8Eb*sIIFvQ#;~tvrB9A{?V!$V~;A#UEIhcI6LyN)jhlpy}i1q+hC^-s;@xpEAPmS zySigncI@Untee4;HXc0c4IAM14rgfl13Tp2%9thk#vNs7S+3da;}~A@g-bvkG5~7l z#zy|9LDoceCkFH=MI02ic2B^Eb`{7P*mLHoj&Ci*o^^LjTJ~LTnP{G67M{^6aJc-h zaTL84o&yz-_a~&pO;RgoU^R%+KX+mKu}^KFXYzweZe+`FDMySE9QD9_9vaaipFr30V?b%?9+gNJR3h5! zJY*tX$gk~)csoAdC-s;(uDr!m|JK8lD#?=>Q6~33QBr5K56Q9xB|Tn41FJK1qKvkB zwS<|TE$XC>DASz;iSyY%Ty$6ddbGJ(q8>w@CaAtb`>qp@GU$F9q&XdSLW}4v9TrBd zpmF=z8WeWx!j*Ni4az&@yU~~FhR|~Eg!TZJP2TG=`m_ELrDcD<*}R|B5(gCd{C(Xz zIlt{>|AxHJ=XFYsfD9g<<7@KpKrSXfZ4u1ezo&$0#O>P@7&PANTaROr%8S;g1jCr3!PknL#m##}+me31d zme#M=G$Dirb56Lu)6>&>j^${Sy8I$&B7*`gk*B)omVKy`Z&K|5#@izZuOHA>80S^; zz{rGUA-bZNNAMGmB()kcM`4;2!B8(`ULPGRD?QMHW10 zRz^dU_FO#Z&9+=43o?>fJc%fgL1A3c4=x1o?+Neo345*2y%V!l8p;tP{kxYTzGo@+ zfV@ai_^yJuQ4_wlK}ErA?+kfg|NUa@&&k7MbU79jG39M@cL^v?&aed}gMG)Cr1YTP z#4;!BO-#1=DcIl~KS-q-?(;gCYbz?4u}2a{wOnWs>K|4qB_u#&L1m z+U&9a%~L2+pZ~T+xg0&WZ>hBT?DgGSB3~?3 z<5}rsddQ^DCF8won}Kr2(*p4g*WGSa)jr$${zc3qt}RCc^7|}revE(cZ|PH`Gy5JI zoY|>+T6V|Jw!;SR-|Ih5Kb?4{_iN8z3(x+R;vM>YH78bl`J4A2I2s+ISMGW`(>wCw zPxo5gY35h2PhBPcFmm!Qv7@s-uO9KQH000080H%&5S1*)=cRLCI0K6pt02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH-C65y8#fmIzrel&q3*(xA&q1Q!7hwV3pYvIV3V#9JIxQv2&fs3#P!T@ zLUN?ISp$8RzQDdypJcy7&Q%vXj+3<5ATTuK;W>wg-?@?R|NJM$dVewDLZrNR#Ci*B zb8|Ev`;j2!8J~+(WH#VG7g_|NO3OJjo&*QM;V9Q)DaC61SPO2&t7lI{EHi1P%7Pa~ zV&zY1@Nc8CuX;l#Yr(T95t?MZkfBya#Wpy0yjvVf;-%0AjEJ}+tenod=BcnC0>yh8 z!eFSfSk9XP3`z4^{>*iR!I&pT4C|R0H!?JBVhl#Ygj(jdl>85w&Y98SqiJm&%~!!( z+C?!djL?v1$wFisw-f(&bc#WliDV38LCNuRHCJYAcp^-!bST~=7zoUAKJBrUjO+pu z{`N3`htGwO^M$Ryzn*5(Y=8epWyR6{K08SSH-c#q3(c%zb|F}-l0>a!HfJ*d?t;n8 zSe_&_Li0u?1?}jFO*NZl?6+TjWiOpEJJam^rSRNIn7QazTlU-Cy+^Bss5W|9GBe}T zdb58$oSX{1l1Avl;i{jX*6gQJ6j0sAmvxs3_HKf)GA}rn4+x^zXUvC&QgJD z1IAH%;sMKrwj6LIBaoe>VU==2mT#Id-LzgnwueIOyx9yZx5C^;8l6_FRnVNTGnUN8 zxmHmTTGG|68ij8AYDu5)oIzuKtYfuXu*$ehWPAp$>`E1+D6|sBc9mda32K8m5Nxst zrW&?o{_p<&t1J>axgxtXv}Yn*WD1~^5CvdIgf&{>R-KXYYDF!-1QBPE$OU+1;T5CN z4iIgN-;lxYu{;$_#Y6|g*K0|h0KRYx<(W$W@x=Rj>%?7@Nb9KKVo{OjO51TF<~$jf z;bBChi3?ji83B>N35;wJT^J0Ul5gSI4Z;&i;!)({6;Ddb(gs1NfF52>gvwZRvXx4Oh`|*EAspm6>wahpIpHW!x z8Sz{WD#^22@^?iRI>6szAP*8Vjw|}{R~7OGfsZSt-dX1489MfZAy9I{HI_Huua&-> zDRtS59K$wOR)*|l0esT%17dmpTyUMSlst*gRAILua>J9I_LVyi*nik2mpZWAyts}9 zF#4c3Y=w4H%-XTN74X+;t;50{&JD!KKr(ccF?`hY+JqO)$93Cei3<5vb0PC` zLhAYiC3zXauPJ%{AR`I|6_X)b2{spSJIi9NQWr6Rc|->fB*SV`bhNwfY^t}EMj|3s z34Mp^)q#GmRgrJ#&nZqleJA1X8Py9`7i~t>&+2WUMidL(nyGp6#OwulTE)vHwp~8pFt{RIOn3G#3XipT_$ha>{ z8!%@CW&{Nl5p{T@fbkKKxS!8m8K(P*$mVv@?-;Q^2xy0c;bd^p>zev460Y3_l7*te ztM~oWvo11GzS)J72>F0VzwMk5B%|S8%Nst_fxbbw9F>LRqr=JJWHkBvXmYRzg}0q< ztzzITuQUe^Kk2EmfZ zhpeO2dJ&y*^PX&(?8BY{Vh_#<;D_~`>eT< zN{AiFaDYeMy`uzYq!_C;V`bPd4(}n)`AjC#UbTv6nSo8}!bn+Mpt#m;0qyed=HePs z0M7Zsd)L#`Gb;T8>SA`O)Y8Y7tc?V(hthK@s5$^O$2?dlST%(u~0Xp%VJfcOS#&D2Oh zP02qmWW=-374W_+YFY-`X3*;%?{)jLo8vzWf+Oeq`ildx-c@Np>V>>2KH?&FW`v{E zlz+Bcp|y^^u`4)E)PGq zSxLyYiFUNx=mbh7$x057K1XcSzK%+V3;*v&^> zR^MJ}Y*g>v+F^4V1=I7AqMM=72O~Sf6|17|aqZ27sU59CFGrKxUH3#~?K-@Z@VZ%M zyM}koFSTZ0*rD538?{GQ%Jj{E0`)>9xx0axqh=v0S9$uJKvuPGvsPcRvUP_aQyAR5 zi@7cKVp!W&45$?Oj8U~QymQCTZ1}sm{HJkhTOg!Ko>W&YBg(VR#qZ|YcQWU}hg^+Gk_ME~le^+f2Tp^j7C{q<6=GTXq8$JloO{PlfgMk(H@nq?fB*+~oi& zpLLwmzw7m(wSkNF=iTFSeJ`;+E+225{@A#@RoFe_@^%gH8kcL${s?iod&^v@#&kgy zsz}jM(}TioK{j;P9PR41!^wQcVB1*p|3278!crxL1_{59JI=^J;q{igjAc#D7E!~CBzIDe}P>w*=cGPfwAFBzvg!B8Ft41uF^joO z=uV$aGxAaNRPaI=rCo$V%(9)JD4ks*?SwX?<-ihx{j&X;U?^ee+scgtjxG^X(B6gZ<82H$E z$tQP)!{5yrTJSOmr{O~Qn-_wGAOKTtvJPl;V*`}B7ZBIf+6B+p!9%v>TB^dmzG~Be z`C$nJhmcsix~O_RG4$n|)Dq&-T}IS)2c9bLfN#<@MR^X!or8~7Ul?HzJ|V(hQ8+o3 z^Q<;$B;#0Uy6y^9ky$ObyrA6|XAk~xIBNw(7h&n)Ju^EkQlaa?1lYR&@i!k$W$k~| zci*b8dC`4OXkJ)Gt#`)Wc`UWD{f~TBKv?bH<7r_i-WEvH)e84EP>EkPlGolK+&e}NRG!vD$gIZrIdN)UrT@ddoH z(&QqDu<9Gvj)FLtCallmGz^0%`O93rLxe;l)Xf}Gh!N^E@X`c2V~IqFO@oM?S{{$# zht1h3kFH$!{{t^boi%LXvp^=aA`1`#Tnp%Ufo&xMcliolCO09+zTzZu{h2}o$K(31 zxj#!TpmdnOcKFmvz2rB`O9}2n#N!|ZWPXl= z#(w9__2YzF4z|jY3(o#}9YmLLXxY54(EKaAzHsde=Elt7k$VMQPNQH>)nD(k3}8*+ z{aO6@tR}49WH7n&V1k8NtoTOFP0aehcO1C_nFzonxwRe#I}L`fQ62Q#+sTi#9L+A+)}k2uSv z?G!}G^|^=B8}lR$8;3Fpg3Dnan_g}Tjgr|aRo#aFRt*}NQz2X%Q9%t{S&?f^0I7l& zP|R`UV3VW~V@V~UAN%UhzN*@fvw_88Ty}9-YvXd8AF^)OALJzuHZqN{2CCQfh@_3W zaGcdEHc2mwt!3T66*Jd54>?3Zn{Vg39BQQQLEul_*^x6WwL>gxs z3Ve{gAUY6hOUKR{K#Lt4su__`P4G`p6RC0{wa1aO9_2qDWYRTw7xIXdgykIp#Oxx8 zH#3zGKj^WdLdgn1qx4vzl~Zn~k(=CPO_Z?0W(tEc4W87Lo%R1zSpURho0C_K=O;j6Ix^`wdAwV0P=TTk8(Eu$|Fp0LTyf*Pgg zjan|e_hT2+oX#yWvyEfl? z^0dz%Kici@Y)vQq$<}Dpx1aDQPj+{#r;oR-oTTPBAO?^xT9`cJv_xIdaao$}r3*5l#uNejD=I^@qA z-ACU(yN|lDdv(~FD%%~|o$76GJ>B73+q-@K$m0DSXP5V%?2dLp#ZRB?@`?R;I32aH z`*tUG-!`-R_Pw+Fc4v0q{zln-dl7cu{`T2@yBoXLhOK(94ta?Y$KKK-R{JLP!Pe?B zU8x+M92|~K##6I+I*jLo7;`;L+}U*xqu|PQps!6yu1sbWK~Wk)w-BTpZH>0Yb``k5 z{L1Cmg{m@eZH{!+Y^8$Gv(o<1+6S$8^z&VTBA~-V?mO{2KPL;l|N5as#fO%CY0av- zsKgB$`7X!Dd}J_1fLP)dBj|F-rO3P~;>?i#%vKY?uHED!-_5%c6U$1WXKH?KxxSjM za?kAkw>q0O+)R17Iq`ZRt6) zX2JUQmSdtkkoopgVqICTCl@Z0wSn3pv62+0YG|PFnj0TW%k3GPT3*a`^*-y7fMsp& z#%K&0EF-F=4BTUB)-_G0k#&R_rrcTS4o4}R})+QL0gVG_hO>&UMzx{dOyI}clqAQHX_9l4I ze$u}NA1Jtve+VWC_~ZTDb#k3P2tgnE*jS3QTZ#DvnA)I?L08P`g*eCG|T zV>9b2qa$bA-}z)S2EmMrywymiibZ!~R%XCk6^9XDfeV3Q8!NZp_rnm6mM+Dsl@2;H z>r_E(0`uLieo#bKo*_GcL80pi>)+;*RDSrdU^HW!@4+R)jvhYjv0CA=6~`cFPOVS{ zYuH(E$^BX}7#?85fUgCjWiEt9BAz^aSe!FbKe;Qs$OIlA-Jw4V*w~j~mP85pt_@Rb z5Io&$gMEVM;-i$f=rrNsQYLF`1ak|%V$8`vkM?^9!^MO5K)~pi5mDbDF;km z;~L~+)aFy{9O@a!5OxLIEe@B z;DXzigwTg7&LOzWh*SuxLq72$&{`H(SreE777h@dg2)oP$@iu?HVN+{ld=9Tl;gx1 z-hgQ#3F6)j13es-R$EYkNLrDu;{IK5JS=YO@dm@S86^&X1N{U|K*-o{c=UZxeNhM= zv6wn!b8cT)z8lYJ-KV~>#|T3ZAT-z!BWDJv|KU~OdBHW(KNjg5l1)3Q$1v>2!p|xG z#$~#Hg~;_IJ_S$E2dicSk-@Z(D*hCqxBLpjqN2aI*{VoRB|s=QS2_li;5SYz#*_G` zP`F}+1eca*6DU_kaXx&jn3iEi4bFWj)uM+{$I83Sx)@@Gm`yy(;XP)1pyCPwg=`Sh z(bdcbv^?;jnci=u`d$Ewb{#zc7p;FlUq5G-8BAw7Ats?2760}XdYcn3m~76$Q{~a7 z+BS?g^Zx&Pv?Wo1UxdY`I3ZcAR77%+d`dP%L^Z=OjZ@15!NZ-;m<_l3!$+W){1j~$ zm@tY$l3_6gH1g~nWPgAoaokKp2e)bNj|WfBULLa{>oXB`Pa~NggzG~#J>8V_!-wbo zxj!5*wU&PHT>tX^)=FZGX{I?!dV^3G20Y?gF*o*0D$mZXodG-dM+5dwIJH0>p0M{} zxjqOiQis_WK@f{dWFE1j!&*ha{~~Y(=l=G9{l6e(a}ZmlD@80F*cao*uG3RLW3pCy zsHVtZ>d`nuX(0(sg=Ip~iaU-mn!V-TZmQ5fiX)DSo6B_|pyd78>v^twxH_Fs1 zF1{eExHAk5WV#Fq%|!*Jn2h1p2}e*&790TkacF{(ZbxzYP=G2KaXABCUtd>QPxc)5 z)!MCA4@z~~Bp%xYR+1S@#8zYr-uGHAC3A$5DH!eD+n0HcqF{TZMslqZ0Ozy;5oVT_ zObbj(yFAECq;caouw4o+m)ATY#W3kdZ;s!cobA6o!k_WWk0GW#x>5M~=~V5Rb`6SI-(ygL|d$158t6 zqh@~-pDez85QH~K>DSbO8KkMXuSH+Um%x^HM&1Iee^Kh1icInMg>~3hk(TaWZT_^h ziBEpUK)6(7Bnefijy172bnqr(>-#5fHduCYr-c!y^@_TGAESaq&y_3&T4%s93+8hB zFW2uaOJv235T_u}u{n7|2%GVobQLFdm>sycr< z_k&O2h!{>ADsQQ}%5nTIq|6_43{nlG zLG-6?6en4Qes}|Gh5rL|M6MR?iik*~V5%$7Xdb4(P6MIs(Zxr)A-4~d|3hbNT;VX{ zL0MQT{Zs~%Xmxmpk*QaK=TJM_rBx#dLgrzIDA!Oy_!L|qh%N>mQ)^de`O~i0^5-^; zJ1T@`gkrio?gcjZImkD?j={mTye#Nb+U>H7(IGKQM}DnZPfbM)p6)Oy%+_Z^3E%f3)nQ?AoBK)9#i zxL2-2%DE>GZC`K~&ke>Q9r)o)q=v}IH9D#>-JAll2c;X&&`?UwlUzp7P^i8``=I(x znFeGTR14MG4|aj6NLU4;Gdqj|%sRe(?Mm}P{a zD*pAb~-)D3me)$&5hY=y+a_YS5uuTNL+jpG^h{h_;N5 zZ2ef!W?lgc7sJ9~B(nceEM^|~#0WRz^>t1W>*6LMWREJYrL2i>pkli{}quBy! zM;XW+rC>OE+4#orIeReK(aMu0WCFOWvqSm{H1c9$KqEZ zm4;@kDm1oEE$JIlxgn(~($>7XP3n+rLy+6#US!Cq-8;jH`TC({{oP;{u+mi*rrfcQ z8pWa0L-~b}`k~a$I2n-AUW+!)?nUc}jNHlSjt!Wf5kOcCRPJ`MTLlQDG3qjG+(g8B zS<;*6qvAp7hTo=Si+>iBbdhYJ7$}GE*9LY|bqon}_59M0I%suBPz#EM2DnxxEy74$ za7wv>rd#leHJ8>Js)1kIl*XDfkhRe0Fz3EFId?lwTFGsBv{$XdV98sE0IFTSQ{Yqe1`-jRap#LFeQ@16pF8|_^d+d`X5 z>#K%TZ?i756$+-*?z>9O?v|3hO2z&@Q?Xkzo$KL{B{G|r%V=IMlez3_R9M(DCgs-0 zxkM7~H=KOiL>4IxZArG~$XI()ZBsJsGQ{~RNwgokle8r_zD~-!&xOC+9QdZeHfIEz zGl82kfXgA3=8WG?nZDX!} zs~K&{z-^n{f2+*fMKf;igZWxAYuloc)#Ia0nX@_;yG5q#ze9#>H#xmcChRH$b~!hq zH3POPD8)Z3>v8)5vsNQ#mC<_pjMnz;>s99Jm(N^Xcve;!s;dmuB{Ni);I&mI>UWxn zx-c)SGENuBI9-^!tIX2LSIjK!kd~o$FT12%bjob(kTGgXWn3UbRDU3|bIzg;{J!bZ zn(5h2mbT2!+ft?asv7)l)dly;eeK>?{utW8=YBFTR~eV9jLX|bPrl`hOY;f%MMUi` zGAqBgjLHs5Gk+S0jZY^SJA1(?!PEOsw^F12`dhU9&Gdk*vn7c#*?0P7!D=l1d7T4`!ue4b#VZzTvu%k;sNVAggSmU zM*b=TzKd~g>L5WpMsBZGmW-^eFEvaV1VypW7p9EyaDQaMwmI4R%TQzzZw=0x_9hW zSm1#6Wpw~z$F>G=n%bZZV@(I5pfZKJ8Lv-tq#0xyc{)_}G9;0$%h7uyH>7%2K!773 zj8b&BUI()vHL;(oYGJ|(RMWKM9D?Nv%Z8~1XY7ayI#@GMt@2CEq%+i~EW0|0p|*yC zk=ry5m`md@+y-5dx?_{NP;h2_mILb*n`}WyLj$-J3N0+IF5s@dP3KJw$Xa7Rook!X zPNRaZPUV>wA4fqF0E9*xdGR=ur3S@soTZ#hYNC=-16DNSh_OdTrUsrWj1h5BrK)uz z4G`vBRO*StBzlI3MWKctB-m>VDVpIZ;;04umEV}bF8NIr2u(c7@6kbF;h3zM3Yc?g zT(M*4Qom#a(0&*;!dYS11Z$wB1k^0Wsjpw`qSV(IMklah0!yM|*YOoDsK}I}yasv@ zq&jW_D6lKiDi@(2DSS5lprWi?YhnmXk*pRSth5z{RigvdNvZ;?3hD{RgES3lF`^1a z&8Xm;04o4KHssGtq>;s1%6PPtK}{W?Csr^wuFZxWM2@LDEYtRd1^RIjNOfHQo4ObQ z(n#7LvZPuc1W(t#kjQHDn0AFnlC=g#C=16mOGAOZ^b?FC>kWMc&8d=x80A)UNLSl1 zp-+k8pET2#HDHSxdT>w^daEe|M_o~0`2l|Fe&Vrodi4XK8sk`2sWd>>R5YwB;vNg* zx^irsI{mc4TiVXjYd8X;6P6l9cicAJ%~Rbx%}rC>IKAenZJbu~l)j7HnXB_D>3y~C z%<|=_G~KX*LV0amU^bmlW`RZ-qpc*;4&oZngh!{rAD+x8)xts*Fx>v|#xgFfYvYy6 zJ;w|_rD7f6%TG3^$loj1!|;u<39c$)syf!xwRS+j=0?POE$EBXzT^h#A?QSumqFjq z!6Q9ah(k#lo)ADrfJ$A*we%7)$0ChvfDh&Rrghm1i0w41GJ$C=Hvv<#+kQ!s&@>c` zr;c^w`8l$DCu~zwv%Hp3SAqCPH^;bRSBK|VHm2>o8W1Q2{d`Gu)0gPSf+m~7YMmyTh$~Cia z5X{5C=f*gTD%S9&h|d_E85yF{`Z6*KrI~aUg{n;Ufg4`HN|CyW4oNB;$5>hcvpg?I z4fcU83N;j!QAOj>RA5m%HVLe!r-H0ga~~Q5c?2&?A8fQl`52w4dc4u-8S1@4qbZ@c zBKEUw79E7Ervm_)P;x6Msa=EpC~<91-GZoN4@=a@daUwExrKIk9k6NbQn0$!OM*6` zTtqb+usQm$F*jQBI zo~&D?M;d(ST-TV~=t3(k;2H#AO%6QI6dks+a;=gy80=bG9ZwYn$O{c4r5X+6lr1!Z zN)Q}fX?~GD{xmS_Rw%3!=rB%R+$1^^+`R7wF#6CkUV$;AK!Ya8T<8&@PhIWWUuvMX z_Gh3*8rNH>kvc=fN-RwS@V3&c6<MXRI$$3QDqHWk;9w#qR>hUxE`!gesXxd zBvDIO_99!SQ2pI$y=udrDM2i-ZA$eQ+BwZ8oqIsw=tgB3XgP>#jMX-NrE6KNH(e#D zP8A)>M876hkX6i_khReaThq5P^6sPtIC)M= z1E0C`h7o2?d;{nka5%uyYJ#4NDwPI8ohuk78d~CRkRezu-Th!HSKx}FL7*>v$Gn5B z*&ZVx5uT~T7&rcLF7&o2tppQXE$U-Kw_NT2i|CW33Fw&*0U&&K5Ww7k=|DgUybh*6 z5}jt+lEN7l)|BFFckaS+1jroo$kul2VHH@2kY_?ssoDnS7@H%5A_v(J z9K=i2j5-jn?$evQuPuL;Y8l;=CFT166HIi3`CBllk>n^g9vg6hXLKhA0EF(&&_hsB z4FDt1si#w*2%}1?U~l=g7QhFMQmOhTn1B#yYtN~u3h+AcXD6wTdHQmjNek>jwQ(fs zjWheI+|XY(YOr5=qqCjKE0T{=UYIX4Kw3X4dt5*G+^{ELh3(D(Q zDTx$Gn$B^4!9AUP>IV=q+Ly%eGt(xV<5oEh}gnAP3J7geTul1D2hH)UTS^)wG&b6MB>(JVT!{e5dL4 zSk7o2E>tsE2Quu_S2pNXZOM41T}{Ds`n5o8*&gOcgLMti-fiLdaG5qI9Pg1aZHiN2 zbzeO1o%U(XMwi;iZ7{x+kKeFqtz3MgYlQc>8O{$tiS7V_&06%9x00OGBcn1D3L>lBe2V&J;qcLwGr+7JPz zD%L4+Vc~g!{1!qDoTxI+FR9Zuktqvv3%SCmHNYLbM8VA0;*!ZR9Ac9g+&DI`wCuNMfsDuOrDT=nysU`RF!$ zGO}1&!#A<&hA&LHeF<3VOq3YQ#+VeV`oQz=^7iJwb#2`+_Hf*M6#uxGjIpMzdX*(a zRPQCG;>4O6Q@~BPa^T!yf5k)@L)u(+A+{-5KnJEtdaEV8RlmGc>A#*)g44fH!pCx- zw;N&N)|dReok&4y_~4DmnrZ!@ogvXHD{sogsaCIFYtx?H5*EK{vrHmcIYY;sR#wUr zD-C4f&)o^=gU;W%6LZxfri)}_N#K?*+bNDSU4Ee#-mV|STllLr>e1z^uD)!i1zLUC zt_1zo(qsoJP%QjbzHHZ`AgZ6VtLulw)B4)KSSOIGR_pSqx{i>Yb(w;>yM${)mS%^{ z(8W?tmrnOIryXn4JC~XN=5)?w(l}S?o2&HARr=-vfu>dZ<|=*D2vn=QO5fDBuu9*o z>3=m*tMtuP`eu3YTBUEA!K#9~O5a?iZ?4ieSLvH|XzesNO>yJ&ny0pLTFq0sO5a?i zZ?4iebD&lF<|=)YfLH083V4;iS)=GGeY0A9mA<)3-;|QOO5ZF)t6@$c%~kqlsf|_o<|=)&)YK|{ldaM>wQIvFeX|C!O5fDAu}a@urEe!ojYNZT}|YiiRpD>+GB(lQrH$1LRhWEnqqm#NW|Ub#S8 z_q$zVYW%taZB9K0NvL*d-!KBK?vm{HIb^5Hx zwrt4mS&*g93|WthWIHaD<=B?pxOi6Mzv!1dvAanST&}+5`DMT5`Mab$%YJ-MAM{jQ zWl(?YOMTL_E^;LfLKJo1)oc=!mdyL5B_(S>tpUQ1(Nw5OJXk4D^j{p!%pCpw2USkx zNlafVMkAIX5$N;XbcP^yj~`bcP>-de3~lYt zbF~VeuRS|odmAJio7o%=w$9gj=WF23&SNP002PrX;O7utOCE;5;5{-qLI3arGp(5vm2Rku>dO&Cu1fc;kPY7U-(A0+ql}$l(NR!of9WG55f$AbtQoae)^ZIzA_sKjVnIIK(Q-u_bt=cxQ@J zN~5~A{Ddk8b{ez5A26I8L;y?a>+2R6uMsq9%`uRLAIpyO5yqtvVn4l%q&O(-El3lg zJXK4?z7gWt!=4hHAXjj23ySSV4bWoo+`?lU1-QX8MvN0DHy$Uhz#|XmYoFmA zvL?O4Z4}mLBYd4R*3&9u6*=?QKfKHjI|8Q6I5d|6$)>JD06W8xwe{56>hJDYyuY(M z-054~-tF6ysr_{Hczg0>G@%AM^^&2UO(eaRnD3yZ#PXx)*nJYE9Ggb}O^ihy-+Y5; z4xen{^I5h4+9N^U7c~WOQFs1^;A&W<2DT-9_5D-B`>exSL%Sx3ogG8T&i2Sq@?_Tp zGkiQUVK931)YRVY){Y5kINEw@LVdI|G&Y&_rYUGPsMyar>wBnUa)z@h?eH25pRXYr?7&d{;@qbyak(tm=#hNH)m z(Qs=r9X=Wntj#^|Hz_61GaW3jCRwv0S+YEctnjrp;U1OYrZb~M>;j`WofII46~qx% z(mzKPo6yK?`(6Y|8!_Q?eFrZ(?{D+t=*xsbBE~eA0IK=v(_Lx(j)t^ zG@(RsoXefcT#lONQZ4SZ&7Mst?W<=T#$h2u)g!c(_h+Q+}SWtWdvP3$)M?*_F_kWR(-J zy|MXTR(e3Y08~die}yJd4bSC@lC0$f>x>9O>78u6Do+FN+SuG zY9a|jHr&e0kbHrXbDArgGf@+*(pW@xKtM zLY+fCwNfw1og{FT1wLO!f5G6$sE~@a$|6LngCZAHg{+V?Qv z=dcM%q(60MDF$dU$}B*RpkvQ-XL!|A4owTA0;T9H_8&74jZiAAX|SqF=1#?afZJ=yjdH|~jyLj3xrUotmz=J* zDb)LsF;%rmmFB&fl_}P7pmo=`g|pmKs#R2ZQ$ov+n{x&GFESrLIcQS+UMU=)Db&Y$bioT3Gy^T4j zsQRUhl&uaL(P#-~^W7C&GmauyNA7=R@sShNphJaIi7ytni$>f33Wm}CX=WM~#qa1) z3g3~_I~2z%-=CIV%eTEkn|b>^5FkAJ3*uD}*d9|io4`x;v&Y^=GitYd=}u3bSf{e= zqOzVkA}m_T|4^f#{30e5xz;KpO@O(ZS8j6CXOax-!dTldYX>w%m^%l-h4oJ?G`Wt@ zS!@{%+Ke{I<_#tr=p#$C#lMi{RtP&UZnc$1zJ$$&u9Y~nuW91GOtvNitk+<>8I7|= zjIQlFu`!m_0`Y@#oq~;l;<8b9pNjqytq+f`opNx+ZFf*J*L zFjl5hjz>9Boc2rNM8P})o{-orr31d4On!mozhObuE!m}cyr(|QTIFuqFYwjv8ppT` zdGm!i%I5@~`09js<;_#^zJR2JsZ%)z%o!g1CoHXlmkC$^&BQ?mRSczPAf%y{JuOTu zjScl_|C1YQy1tR`Kjf{`E_^4qb;o3I?R-rY+EIa4^`KOP`^QJv+#Zux1@)M`J84h- z5N`{YKe4^SA82sFi%dlx9KWaJ4tal8k9v_-n);c=v%pPcqpdcJNv1JRQ#tLK2_>zB zPKPaeUrb9bviANfFpelK+$hNY>%xlHAH06|^U>S!+jrxaCnxVt9&}l$S=YsxmHh3V zI1r#VWZD+s_kLXAm>4mTwyt({C6E%2m7VZ!iotr{;xc?E4zsRdn)*9v``(sDIr6TH zT0Wi}LcZ&;nw1bNEM~F=9OO-9Ke^zBluH%}m-HweP6vhn{#>n*`mJMAT;fqS!oYW2 z!Ti6uu{&`+Qs!a;t6pm9a24K)1iD3qf!+A!A0Q)Vfe@I?aUGtQ55ApXG=)RCP=jh- zRG4|xYf!tlI4xB^-*tCKq?+};UjJ%$sLPA(n;=ful#VHLNv2*&{eA6C>CjbsI(4>t zw54OYue846$t$#{&{P!+aE?c@8a4v8{^m={y~glXc4e(snREOP4xFesniO8KcH$Qh= z+qK?gzVhl;vPb5XtfvjI&#h0zb@0DMy{{j2Urs3%)J{kJ@>1%TZ%w02FabJSIcoE{ z`^7AiQ3V4q5u}AcOpMV&l{6^X788qHpL_l0EJ*4{<}MPPI-@MkC)1(iEQfD%KMXxr z9QN(2e7?SFD&CxU!9<-_7ENZ!egm-w|M^_|rPN|7_pqFGnN^7mIn~)D=IN}a{57dT z=-Y;hKK0bP@{4MwU6)kH&e_HF%Mh|wyI+csfgpDfb?iI2<3P=;`IZAUxvig@ZqH3D z=R^MGPt`PjRiK%Jf5fv%0bY1W;i)`@jXw1@h_7ZpvO@EFZMl{|QnDLrkob^NsJUR;=E8}$W@ zlhos@OK$G}lAHdEC{6e)GJVy@Nh}YkALkz{VfgoVb>mHu&5WkqSG)D5#uxh@%xY02 zx?Y1*9H(v4oDyE=JnAJk1If%WuU7Jf}-%hFe>dD4;Hd$*!95Ff|9n zkcp#{`B5+bj4pwp1C|P7x|b%t2s{VxRvB*f6uOmy9`%(J8Yp0kHAY)(?)pH=c%XHJ zDl6=ZBGnVT5Hq7WQQVHWBZi}4X=sl7$jQiLbl6Z=g@}iJVd8-tE`?gpvXSk;n#?Qr6UYfSUSOQzE%o^s?>1VdG?J{OdzdhZRHo0 z%G&bd5Hi`+P*>biESPFfC#b%;@JvufH6OC^J7D*g(=O#Ot3vY z!Af}_#cXhLU34a)7~kIlP!y#r-Ro5=2GYUL>!SDmld(OGZ2f?|dzbhnfJXmLZm) zum4elEk0=L2`n1}6gpsyQ?Kh~EkTRHHjZWOAX~=viI+8<>D%S@h3{h4hq39i;c&Rs zwLMO|Xm6|#kIpPSXLPSe8!$e`kPJijR+?YLysuJ^ZsIowVQBtv>r|Nxs74GNV2Hvr zum;aQe?^RMlN!DiD~NsDL!N*PnPYMVdyH(-T&3wLu~yWH#Ka|~*aVa*R-$)B+3Es~ z)mN*{E4g`?PSu_7Vwpn!Rc~B#e<(BWwA4^ubhl*zN0Q}!VTqvHnudT@ zC;wbFvD$j6)?018EV%X3rV)#Ou0r-*L-w6?Mm212R2g>^S!fUBYtUXOn7;1v9*Zh4P{20Y$$ppA8?8g=aX;ZLUT!&7u7zdB>FEQ;h zS`YtOg&W^pafOX5uH=CdDSRwO>62?yr(pSU)}|6*MiR{SsSRxtiw4N0gIEfEKf?QR z7KwKMQ)Ts0T(KJLu4e1$6Z?Q}|70q&k1CFj-u|}#`si?cynlN7`@54vP?e?f)6;k3 z&#NlJ;o6k&htjgFUa2 za)DswqmHpkL%mg~Qq)_8Dm64-g({0r_fVyb(CM8^2~mzzDz$M>(aNLaTQNenKqaY0 z>`nZr*J*W*D}8q{ggW~q-(R?J^mW38Bdz}I7B1A=m26?x-`LK5gbR(Gt-^)XdaH2Z zDqL8HYh}_R%)NyRt75!#xNrgA>UJT*8paET2y5^Q>O2Mc{e%d&S0Tc?4-wM+e}4Q% z9&{w17QfT>Zyqh&u1FvIZli_ukrMp(9xW`K(xq)8c}IQa>O@d{*ImMVv&TlOuT~M$+eA#azfQz-TdU)` zMNIX!HCs6PVQl9BMtmaPbbyz_}tk z<>Df?9&1&O#r6M}WKPQQr||htaS{do>^WY!`|PJp`4{_%&!3->bBX!Z6V86J82Cri zy*zqhU0Q>Ays7SjQz9N;`oXpD#&L=_13ss}nE3OjP3t+sDX?50jAT5amSA{Fk+#P| zOe5zEIs%!aVm^o7r+9V^>o^8u6hR#n%pUvK_nXME|z zy8b;KNlh8TSAUxY)e3(;KJly>WAf!I0^hQxh&Zo4&n&!g^^ChLnveKTe6m<65%FkI zyhbzES2ebqJFZ;W^WCvxkMxp=xW7EL^BESG&FTAS`SXb=2lJ7$2FGUq|9B*>Z2Bc$ zHq#Fo_f0J z`1I{5pY9&tF2}k@cRl|no;j?=g*slWFNJ%yFyDN>BC)|e$>;R(;_kj(_Cc4V-MPPV zZ4YZ&)HnIZ%q2b#3`3F{mb2C#;67j5_hsF}_bg>G2j{t|{Cj(z`9oB5hVTo~;D~kn z>t?w3mB@=oZQ0xZ^@em{|KFmrvNHx+3`Sb7H~xLBEHn2=j<7-I0e5e|gV7(KnS6a2 z?E3K;f7e`Np174pZ?Xg4T_&`@Oc(&;ii zNps)M`R@Cw&0|3cU(b8f?Mm@7c~j#Tt??8oJa2zSYR#3DWyccUm7dj(6@9+>T1u+P zTB)?(4vK+mZyYpv!IRZJ^_6G9<3)7bE^=|EM3SAAjJ`mpn7t}N{i;14l9eAR_5 zc;A(_El%xEcLGb{~jYYs39;-MZdrp=#DT@gLh+Hl1m{ z@asT#uk&NUI_G4=l&>Z7r(fKb?0$I0@%zS{>|;THE{j;t+7&oQhI{*`fH@u$89%uH zeVAA28yZ&~$}c9ipNZ?JZp)i&W~sZcSt^v=HrsDfo3l9iW^QK5(T6MM|J?CT%j$mJ zjSeeu\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides the ability to review events in your org on an accelerated basis and get event log files in hourly increments for recent activity. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Salesforce Service Cloud. You can get Salesforce Service Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the SalesforceServiceCloud Kusto Function alias." + "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." } }, { diff --git a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json index 09f73ce3244..0804b2b57ea 100644 --- a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json +++ b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json @@ -192,7 +192,7 @@ "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://aka.ms/sentinel-SalesforceServiceCloud-parser). The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." @@ -241,7 +241,7 @@ "instructionSteps": [ { "title": "Step 1 - Deploy a Function App", - "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files." + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." }, { "title": "Step 2 - Configure the Function App", @@ -418,7 +418,7 @@ "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Salesforce%20Service%20Cloud/Parsers/SalesforceServiceCloud.txt). The function usually takes 10-15 minutes to activate after solution installation/update." + "description": "**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected which is deployed as part of the solution. To view the function code in Log Analytics, open Log Analytics/Microsoft Sentinel Logs blade, click Functions and search for the alias SalesforceServiceCloud and load the function code or click [here](https://aka.ms/sentinel-SalesforceServiceCloud-parser). The function usually takes 10-15 minutes to activate after solution installation/update." }, { "description": "**STEP 1 - Configuration steps for the Salesforce Lightning Platform REST API**\n\n1. See the [link](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/quickstart.htm) and follow the instructions for obtaining Salesforce API Authorization credentials. \n2. On the **Set Up Authorization** step choose **Session ID Authorization** method.\n3. You must provide your client id, client secret, username, and password with user security token." @@ -467,7 +467,7 @@ "instructionSteps": [ { "title": "Step 1 - Deploy a Function App", - "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files." + "description": "**NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-SalesforceServiceCloud-functionapp) file. Extract archive to your local development computer.\n2. Follow the [function app manual deployment instructions](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AzureFunctionsManualDeployment.md#function-app-manual-deployment-instructions) to deploy the Azure Functions app using VSCode.\n3. After successful deployment of the function app, follow next steps for configuring it." }, { "title": "Step 2 - Configure the Function App", @@ -515,15 +515,15 @@ "properties": { "eTag": "*", "displayName": "SalesforceServiceCloud", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "SalesforceServiceCloud", - "query": "\nSalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s", + "query": "SalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s\n", "functionParameters": "", - "version": 1, + "version": 2, "tags": [ { "name": "description", - "value": "SalesforceServiceCloud" + "value": "" } ] } @@ -580,15 +580,15 @@ "properties": { "eTag": "*", "displayName": "SalesforceServiceCloud", - "category": "Samples", + "category": "Microsoft Sentinel Parser", "functionAlias": "SalesforceServiceCloud", - "query": "\nSalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s", + "query": "SalesforceServiceCloud_CL \n| extend \n\t\tRequestSize=column_ifexists('request_size_s',''),\n\t\tExecTime=column_ifexists('exec_time_s',''),\n\t\tAction=column_ifexists('action_s',''),\n\t\tPlatformType=column_ifexists('platform_type_s',''),\n\t\tOsName=column_ifexists('os_name_s',''),\n\t\tOsVersion=column_ifexists('os_version_s',''),\n\t\tTimestamp=column_ifexists('timestamp_s',''),\n\t\tStatusCode=column_ifexists('status_code_s',''),\n\t\tEventType=column_ifexists('event_type_s',''),\n\t\tReferrerUri=column_ifexists('referrer_uri_s',''),\n\t\tUserAgent=column_ifexists('user_agent_s',''),\n\t\tBrowserType=column_ifexists('browser_type_s',''),\n\t\tTime=column_ifexists('time_s',''),\n\t\tResponseSize=column_ifexists('response_size_s',''),\n\t\tDeviceId=column_ifexists('device_id_s',''),\n\t\tDeviceModel=column_ifexists('device_model_s',''),\n\t\tSourceIp=column_ifexists('source_ip_s',''),\n\t\tClientIp=column_ifexists('client_ip_s',''),\n\t\tSuccess=column_ifexists('success_s',''),\n\t\tUri=column_ifexists('uri_s',''),\n\t\tUrl=column_ifexists('url_s',''),\n\t\tClientName=column_ifexists('client_name_s',''),\n\t\tUserType=column_ifexists('user_type_s',''),\n\t\tUserInitiatedLogout=column_ifexists('user_initiated_logout_s',''),\n\t\tUserIdDerived=column_ifexists('user_id_derived_s',''),\n\t\tUserId=column_ifexists('user_id_s',''),\n\t\tUserEmail=column_ifexists('user_email_s',''),\n\t\tUser=column_ifexists('user_name_s',''),\n\t\tUriIdDerived=column_ifexists('uri_id_derived_s',''),\n\t\tUiEventType=column_ifexists('ui_event_type_s',''),\n\t\tUiEventTimestamp=column_ifexists('ui_event_timestamp_s',''),\n\t\tUiEventSource=column_ifexists('ui_event_source_s',''),\n\t\tUiEventSequenceNum=column_ifexists('ui_event_sequence_num_s',''),\n\t\tUiEventId=column_ifexists('ui_event_id_s',''),\n\t\tTlsProtocol=column_ifexists('tls_protocol_s',''),\n\t\tTimestampDerived=column_ifexists('timestamp_derived_t',''),\n\t\tTargetUiElement=column_ifexists('target_ui_element_s',''),\n\t\tSort=column_ifexists('sort_s',''),\n\t\tSessionType=column_ifexists('session_type_s',''),\n\t\tSessionLevel=column_ifexists('session_level_s',''),\n\t\tSessionKey=column_ifexists('session_key_s',''),\n\t\tSearchQuery=column_ifexists('search_query_s',''),\n\t\tSdkVersion=column_ifexists('sdk_version_s',''),\n\t\tSdkAppVersion=column_ifexists('sdk_app_version_s',''),\n\t\tSdkAppType=column_ifexists('sdk_app_type_s',''),\n\t\tRunTime=column_ifexists('run_time_s',''),\n\t\tRowsProcessed=column_ifexists('rows_processed_s',''),\n\t\tRowCount=column_ifexists('row_count_s',''),\n\t\tResolutionType=column_ifexists('resolution_type_s',''),\n\t\tRequestStatus=column_ifexists('request_status_s',''),\n\t\tRequestId=column_ifexists('request_id_s',''),\n\t\tReportIdDerived=column_ifexists('report_id_derived_s',''),\n\t\tReportId=column_ifexists('report_id_s',''),\n\t\tRenderingType=column_ifexists('rendering_type_s',''),\n\t\tRelatedList=column_ifexists('related_list_s',''),\n\t\tRecordType=column_ifexists('record_type_s',''),\n\t\tRecordId=column_ifexists('record_id_s',''),\n\t\tQuiddity=column_ifexists('quiddity_s',''),\n\t\tQueryId=column_ifexists('query_id_s',''),\n\t\tPrevpageUrl=column_ifexists('prevpage_url_s',''),\n\t\tPrevpageEntityType=column_ifexists('prevpage_entity_type_s',''),\n\t\tPrevpageEntityId=column_ifexists('prevpage_entity_id_s',''),\n\t\tPrevpageContext=column_ifexists('prevpage_context_s',''),\n\t\tPrevpageAppName=column_ifexists('prevpage_app_name_s',''),\n\t\tPrefixesSearched=column_ifexists('prefixes_searched_s',''),\n\t\tParentUiElement=column_ifexists('parent_ui_element_s',''),\n\t\tPageUrl=column_ifexists('page_url_s',''),\n\t\tPageStartTime=column_ifexists('page_start_time_s',''),\n\t\tPageEntityType=column_ifexists('page_entity_type_s',''),\n\t\tPageEntityId=column_ifexists('page_entity_id_s',''),\n\t\tPageContext=column_ifexists('page_context_s',''),\n\t\tPageAppName=column_ifexists('page_app_name_s',''),\n\t\tOrigin=column_ifexists('origin_s',''),\n\t\tOrganizationId=column_ifexists('organization_id_s',''),\n\t\tNumResults=column_ifexists('num_results_s',''),\n\t\tNumberSoqlQueries=column_ifexists('number_soql_queries_s',''),\n\t\tNumberFields=column_ifexists('number_fields_s',''),\n\t\tNumberExceptionFilters=column_ifexists('number_exception_filters_s',''),\n\t\tNumberColumns=column_ifexists('number_columns_s',''),\n\t\tNumberBuckets=column_ifexists('number_buckets_s',''),\n\t\tMethodName=column_ifexists('method_name_s',''),\n\t\tMethod=column_ifexists('method_s',''),\n\t\tMediaType=column_ifexists('media_type_s',''),\n\t\tLoginStatus=column_ifexists('login_status_s',''),\n\t\tLoginKey=column_ifexists('login_key_s',''),\n\t\tHttpMethod=column_ifexists('http_method_s',''),\n\t\tGrandparentUiElement=column_ifexists('grandparent_ui_element_s',''),\n\t\tEntryPoint=column_ifexists('entry_point_s',''),\n\t\tEntityName=column_ifexists('entity_name_s',''),\n\t\tEntity=column_ifexists('entity_s',''),\n\t\tEffectivePageTime=column_ifexists('effective_page_time_s',''),\n\t\tDuration=column_ifexists('duration_s',''),\n\t\tDisplayType=column_ifexists('display_type_s',''),\n\t\tDeviceSessionId=column_ifexists('device_session_id_s',''),\n\t\tDevicePlatform=column_ifexists('device_platform_s',''),\n\t\tDbTotalTime=column_ifexists('db_total_time_s',''),\n\t\tDbCpuTime=column_ifexists('db_cpu_time_s',''),\n\t\tDbBlocks=column_ifexists('db_blocks_s',''),\n\t\tCpuTime=column_ifexists('cpu_time_s',''),\n\t\tConnectionType=column_ifexists('connection_type_s',''),\n\t\tComponentName=column_ifexists('component_name_s',''),\n\t\tClientVersion=column_ifexists('client_version_s',''),\n\t\tClientId=column_ifexists('client_id_s',''),\n\t\tCipherSuite=column_ifexists('cipher_suite_s',''),\n\t\tCalloutTime=column_ifexists('callout_time_s',''),\n\t\tBrowserVersion=column_ifexists('browser_version_s',''),\n\t\tBrowserName=column_ifexists('browser_name_s',''),\n\t\tAverageRowSize=column_ifexists('average_row_size_s',''),\n\t\tAppType=column_ifexists('app_type_s',''),\n\t\tAppName=column_ifexists('app_name_s',''),\n\t\tApiVersion=column_ifexists('api_version_s',''),\n\t\tApiType=column_ifexists('api_type_s',''),\n ArticleVersionId=column_ifexists('article_version_id_s',''),\n\t\tArticleVersion=column_ifexists('article_version_s',''),\n\t\tArticleStatus=column_ifexists('article_status_s',''),\n\t\tArticleId=column_ifexists('article_id_s',''),\n AnalyticsMode=column_ifexists('analytics_mode_s',''),\n BatchId=column_ifexists('batch_id_s',''),\n ClickedRecordId=column_ifexists('clicked_record_id_s',''),\n\t\tClassName=column_ifexists('class_name_s',''),\n ComponentIdDerived=column_ifexists('component_id_derived_s',''),\n\t\tComponentId=column_ifexists('component_id_s',''),\n ControllerType=column_ifexists('controller_type_s',''),\n\t\tContext=column_ifexists('context_s',''),\n\t\tConsoleIdDerived=column_ifexists('console_id_derived_s',''),\n\t\tConsoleId=column_ifexists('console_id_s',''), \n ClientInfo=column_ifexists('client_info_s',''),\n DstBytes=column_ifexists('request_size_s',''),\n\t\tDstUser=column_ifexists('delegated_user_name_s',''),\n DstUserSid=column_ifexists('delegated_user_id_s',''),\n\t\tDstUserSidDerived=column_ifexists('delegated_user_id_derived_s',''),\n Data=column_ifexists('data_s',''),\n\t\tDashboardType=column_ifexists('dashboard_type_s',''),\n\t\tDashboardIdDerived=column_ifexists('dashboard_id_derived_s',''),\n\t\tDashboardId=column_ifexists('dashboard_id_s',''),\n\t\tDashboardComponentId=column_ifexists('dashboard_component_id_s',''),\n\t\tDvcAction=column_ifexists('action_s',''),\n\t\tDvcOS=column_ifexists('platform_type_s',''),\n\t\tDvcOSName=column_ifexists('os_name_s',''),\n\t\tDvcOSVersion=column_ifexists('os_version_s',''),\n DeliveryLocation=column_ifexists('delivery_location_s',''),\n\t\tDeliveryId=column_ifexists('delivery_id_s',''),\n DocumentIdDerived=column_ifexists('document_id_derived_s',''),\n\t\tDocumentId=column_ifexists('document_id_s',''),\n EntityType=column_ifexists('entity_type_s',''),\n EntityId=column_ifexists('entity_id_s',''),\n FileType=column_ifexists('file_type_s',''),\n\t\tFilePreviewType=column_ifexists('file_preview_type_s',''),\n\t\tExceptionType=column_ifexists('exception_type_s',''),\n\t\tExceptionMessage=column_ifexists('exception_message_s',''),\n\t\tEpt=column_ifexists('ept_s',''),\n EventCount=column_ifexists('number_of_records_s',''),\n\t\tEventEndTime=column_ifexists('timestamp_s',''),\n\t\tEventResult=column_ifexists('status_code_s',''),\n\t\tFileSize=column_ifexists('size_bytes_s',''),\n HttpReferrerOriginal=column_ifexists('referrer_uri_s',''),\n\t\tHttpUserAgentOriginal=column_ifexists('user_agent_s',''),\n\t\tHttpUserAgent=column_ifexists('browser_type_s',''),\n LogGroupId=column_ifexists('log_group_id_s',''),\n\t\tLimitUsagePercent=column_ifexists('limit_usage_percent_s',''),\n\t\tLicenseContext=column_ifexists('license_context_s',''),\n\t\tLastVersion=column_ifexists('last_version_s',''),\n\t\tLanguage=column_ifexists('language_s',''),\n\t\tJobId=column_ifexists('job_id_s',''),\n\t\tIsSuccess=column_ifexists('is_success_s',''),\n\t\tIsSecure=column_ifexists('is_secure_s',''),\n\t\tIsScheduled=column_ifexists('is_scheduled_s',''),\n\t\tIsNew=column_ifexists('is_new_s',''),\n\t\tIsMobile=column_ifexists('is_mobile_s',''),\n\t\tIsLongRunningRequest=column_ifexists('is_long_running_request_s',''),\n\t\tIsGuest=column_ifexists('is_guest_s',''),\n\t\tIsFirstRequest=column_ifexists('is_first_request_s',''),\n\t\tIsError=column_ifexists('is_error_s',''),\n\t\tIsApi=column_ifexists('is_api_s',''),\n\t\tIsAjaxRequest=column_ifexists('is_ajax_request_s',''),\n ManagedPackageNamespace=column_ifexists('managed_package_namespace_s',''),\n HttpHeaders=column_ifexists('http_headers_s',''),\n\t\tNetworkDuration=column_ifexists('time_s',''),\n Name=column_ifexists('name_s',''),\n NumberFailures=column_ifexists('number_failures_s',''),\n NumClicks=column_ifexists('num_clicks_s',''),\n OperationType=column_ifexists('operation_type_s',''),\n\t\tNumSessions=column_ifexists('num_sessions_s',''),\n PageName=column_ifexists('page_name_s',''),\n Query=column_ifexists('query_s',''),\n RequestType=column_ifexists('request_type_s',''),\n ReportDescription=column_ifexists('report_description_s',''),\n\t\tReopenCount=column_ifexists('reopen_count_s',''),\n RelatedEntityId=column_ifexists('related_entity_id_s',''),\n RecordIdDerived=column_ifexists('record_id_derived_s',''),\n ReadTime=column_ifexists('read_time_s',''),\n\t\tRank=column_ifexists('rank_s',''),\n\t\tSrcBytes=column_ifexists('response_size_s',''),\n\t\tSrcDvcId=column_ifexists('device_id_s',''),\n\t\tSrcDvcModelName=column_ifexists('device_model_s',''),\n\t\tSrcIpAddr=column_ifexists('source_ip_s',''),\n\t\tSrcNatIpAddr=column_ifexists('client_ip_s',''),\n SessionId=column_ifexists('session_id_s',''),\n SiteId=column_ifexists('site_id_s',''),\n\t\tSharingPermission=column_ifexists('sharing_permission_s',''),\n\t\tSharingOperation=column_ifexists('sharing_operation_s',''),\n\t\tSharedWithEntityId=column_ifexists('shared_with_entity_id_s',''),\n\t\tUrlOriginal=column_ifexists('url_s',''),\n\t\tWaveTimestamp=column_ifexists('wave_timestamp_s',''),\n\t\tWaveSessionId=column_ifexists('wave_session_id_g',''),\n\t\tViewStateSize=column_ifexists('view_state_size_s',''),\n\t\tVersionIdDerived=column_ifexists('version_id_derived_s',''),\n\t\tVersionId=column_ifexists('version_id_s',''),\n TriggerType=column_ifexists('trigger_type_s',''),\n\t\tTriggerName=column_ifexists('trigger_name_s',''),\n\t\tTriggerId=column_ifexists('trigger_id_s',''),\n\t\tTransactionType=column_ifexists('transaction_type_s',''),\n\t\tTotalTime=column_ifexists('total_time_s',''),\n TabId=column_ifexists('tab_id_s',''),\n\t\tStackTrace=column_ifexists('stack_trace_s','')\n| project-away *_s\n", "functionParameters": "", - "version": 1, + "version": 2, "tags": [ { "name": "description", - "value": "SalesforceServiceCloud" + "value": "" } ] } @@ -650,7 +650,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -772,9 +772,9 @@ } ], "customDetails": { + "EventStartTime": "FailureStartTime", "IPAddresses": "IpAddresses", - "EventEndTime": "SuccessEndTime", - "EventStartTime": "FailureStartTime" + "EventEndTime": "SuccessEndTime" } } }, From ece522943746628a9b37612e5d7c8016b56dd0bf Mon Sep 17 00:00:00 2001 From: v-sudkharat Date: Sun, 24 Sep 2023 19:14:30 +0530 Subject: [PATCH 9/9] Updated CreateUI file --- .../Package/3.0.0.zip | Bin 16942 -> 17410 bytes .../Package/createUiDefinition.json | 6 +++--- .../Package/mainTemplate.json | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/Solutions/Salesforce Service Cloud/Package/3.0.0.zip b/Solutions/Salesforce Service Cloud/Package/3.0.0.zip index e33ae14ccc7dfafb7018506eb7d104215f3c42c7..381920a886db388b37bdbfcdd6d44dc83d17a7d2 100644 GIT binary patch literal 17410 zcmV)mK%T!)O9KQH000080HaYhS1*)=cRLCI0K6pt02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH-C65y8#fmIzrel&q3*(xA&q1Q!7hwV3pYvIV3V#9JIxQv2&fs3#P!T@ zLUN?ISp$8RzQDdypJcy7&Q%vXj+3<5ATTuK;W>wg-?@?R|NJM$dVewDLZrNR#Ci*B zb8|Ev`;j2!8J~+(WH#VG7g_|NO3OJjo&*QM;V9Q)DaC61SPO2&t7lI{EHi1P%7Pa~ zV&zY1@Nc8CuX;l#Yr(T95t?MZkfBya#Wpy0yjvVf;-%0AjEJ}+tenod=BcnC0>yh8 z!eFSfSk9XP3`z4^{>*iR!I&pT4C|R0H!?JBVhl#Ygj(jdl>85w&Y98SqiJm&%~!!( z+C?!djL?v1$wFisw-f(&bc#WliDV38LCNuRHCJYAcp^-!bST~=7zoUAKJBrUjO+pu z{`N3`htGwO^M$Ryzn*5(Y=8epWyR6{K08SSH-c#q3(c%zb|F}-l0>a!HfJ*d?t;n8 zSe_&_Li0u?1?}jFO*NZl?6+TjWiOpEJJam^rSRNIn7QazTlU-Cy+^Bss5W|9GBe}T zdb58$oSX{1l1Avl;i{jX*6gQJ6j0sAmvxs3_HKf)GA}rn4+x^zXUvC&QgJD z1IAH%;sMKrwj6LIBaoe>VU==2mT#Id-LzgnwueIOyx9yZx5C^;8l6_FRnVNTGnUN8 zxmHmTTGG|68ij8AYDu5)oIzuKtYfuXu*$ehWPAp$>`E1+D6|sBc9mda32K8m5Nxst zrW&?o{_p<&t1J>axgxtXv}Yn*WD1~^5CvdIgf&{>R-KXYYDF!-1QBPE$OU+1;T5CN z4iIgN-;lxYu{;$_#Y6|g*K0|h0KRYx<(W$W@x=Rj>%?7@Nb9KKVo{OjO51TF<~$jf z;bBChi3?ji83B>N35;wJT^J0Ul5gSI4Z;&i;!)({6;Ddb(gs1NfF52>gvwZRvXx4Oh`|*EAspm6>wahpIpHW!x z8Sz{WD#^22@^?iRI>6szAP*8Vjw|}{R~7OGfsZSt-dX1489MfZAy9I{HI_Huua&-> zDRtS59K$wOR)*|l0esT%17dmpTyUMSlst*gRAILua>J9I_LVyi*nik2mpZWAyts}9 zF#4c3Y=w4H%-XTN74X+;t;50{&JD!KKr(ccF?`hY+JqO)$93Cei3<5vb0PC` zLhAYiC3zXauPJ%{AR`I|6_X)b2{spSJIi9NQWr6Rc|->fB*SV`bhNwfY^t}EMj|3s z34Mp^)q#GmRgrJ#&nZqleJA1X8Py9`7i~t>&+2WUMidL(nyGp6#OwulTE)vHwp~8pFt{RIOn3G#3XipT_$ha>{ z8!%@CW&{Nl5p{T@fbkKKxS!8m8K(P*$mVv@?-;Q^2xy0c;bd^p>zev460Y3_l7*te ztM~oWvo11GzS)J72>F0VzwMk5B%|S8%Nst_fxbbw9F>LRqr=JJWHkBvXmYRzg}0q< ztzzITuQUe^Kk2EmfZ zhpeO2dJ&y*^PX&(?8BY{Vh_#<;D_~`>eT< zN{AiFaDYeMy`uzYq!_C;V`bPd4(}n)`AjC#UbTv6nSo8}!bn+Mpt#m;0qyed=HePs z0M7Zsd)L#`Gb;T8>SA`O)Y8Y7tc?V(hthK@s5$^O$2?dlST%(u~0Xp%VJfcOS#&D2Oh zP02qmWW=-374W_+YFY-`X3*;%?{)jLo8vzWf+Oeq`ildx-c@Np>V>>2KH?&FW`v{E zlz+Bcp|y^^u`4)E)PGq zSxLyYiFUNx=mbh7$x057K1XcSzK%+V3;*v&^> zR^MJ}Y*g>v+F^4V1=I7AqMM=72O~Sf6|17|aqZ27sU59CFGrKxUH3#~?K-@Z@VZ%M zyM}koFSTZ0*rD538?{GQ%Jj{E0`)>9xx0axqh=v0S9$uJKvuPGvsPcRvUP_aQyAR5 zi@7cKVp!W&45$?Oj8U~QymQCTZ1}sm{HJkhTOg!Ko>W&YBg(VR#qZ|YcQWU}hg^+Gk_ME~le^+f2Tp^j7C{q<6=GTXq8$JloO{PlfgMk(H@nq?fB*+~oi& zpLLwmzw7m(wSkNF=iTFSeJ`;+E+225{@A#@RoFe_@^%gH8kcL${s?iod&^v@#&kgy zsz}jM(}TioK{j;P9PR41!^wQcVB1*p|3278!crxL1_{59JI=^J;q{igjAc#D7E!~CBzIDe}P>w*=cGPfwAFBzvg!B8Ft41uF^joO z=uV$aGxAaNRPaI=rCo$V%(9)JD4ks*?SwX?<-ihx{j&X;U?^ee+scgtjxG^X(B6gZ<82H$E z$tQP)!{5yrTJSOmr{O~Qn-_wGAOKTtvJPl;V*`}B7ZBIf+6B+p!9%v>TB^dmzG~Be z`C$nJhmcsix~O_RG4$n|)Dq&-T}IS)2c9bLfN#<@MR^X!or8~7Ul?HzJ|V(hQ8+o3 z^Q<;$B;#0Uy6y^9ky$ObyrA6|XAk~xIBNw(7h&n)Ju^EkQlaa?1lYR&@i!k$W$k~| zci*b8dC`4OXkJ)Gt#`)Wc`UWD{f~TBKv?bH<7r_i-WEvH)e84EP>EkPlGolK+&eJO*MI&8 zV{88_wlDbHT6@CQE|MgSpKNZ5H-ow5TQffAeloEBkw$!A2Xk2#Z;rNxkNaCY{jK4q z!$U8)#(HOb9(q>72Y-(P|EIMcbzld60%h-c6uW_s{R{_N_&-@b=ZWQ531aXUzJOO& znp^}CR(&Q6x|t&iF+!aNUYbB>ERhJYX%Mkf%i}Tp zusJ*B(WMLjzwZU9vxY5v5y*sAWC22eYXKcEu&qSkE?>dRvN^l<{9tSBP^Gg(@;rhlv_42XUR*g2Yt=Nv-P~x=qCP-Ks zbEn59X~KNY9qzCsV4)Sq%!=myB>4oSh!gh5k?f>@dJ&|a(+AN03*P_LiX1xtus;Tj z{mz-|#|gI_Y?UP!oc(bXM4#f&vUy*j`3JkYaP14`#?0Z7dkI}mqhLvwu%__- zB7S^P6IO4s8-1&UT$o%RfFq&9^?N6LMobbg!NM$7e52+jW_{p0j$DCEgyU1l!fTJ) z`0HLT=bH6e)tmxkOhGBdYz8uIU|Kjs6XBn?NwjP3cBcb&L)40FjN&T?rx z1yOQ+?&0*tJW0dGp-h6{)3A?CFE@oo$!wLXZo_}0293|8&ef4KwRqe;wz+y2jyEv@1ak5Cnlnqwet5h$dTPP|bjk65} zKFD4W?TfXgV`mMZ#f}Ztj7X>^_-CkzR5_8_Uf6E+^!NB{na&CQY2}g;4B7^fE78Y<&bW+E4Wc3`;^j9HkuYi! z5rLRdHbk*mD5~IQ{^%c5)hYqaI=PNnjrzACgkiL_5Q-7irLT^8P3+2atq@(AD`v8* z8eItgyE1;Nz|FE$5+JNzSzYQV+|!NWo3Q-Vq>1IVn3rT*Pu>qLqc0Dhu*uDW8l~rr zS}U{On@j@@#;tjG(V|&wzEa$kkYV&*M>oa7v0Q zGHB}D(EB%$MXPc7F^-_b-I`iA;&5wuouB#7h)bQ#P2;Jtx{jCI*?rWJ-KpO0jx*fl zyQBWl8b0jrSlbW!kGb`*KbkzA^4;my!{P8z3%idxvHQr(?xQTPd5-r-x@yM6w^;{6?Gm-ip-j&?!CPao~_iT!Xm9ksCg zb|-ew-2;L>%VuT4p=OlA~8Q5r(G5TqP!jkd*h6}Z6s z(&bl$sxokGj&#**rGn72(*Dre2d#MY^Id@=pu9vBWJ#(B+Uzk$F?ZnIZj|ttNn7xyePon|CQDmX$)!)co9XeKlL< zp4r`Rb!Ht&>J|9U$XdC%_p#DQK5;mZFXh6lIZc^H*wph^`OhNnw`uq0wV}uz9U{#I z1Zr|R>~C#r4RTTJAjsK< z@k?OS7=WMw%|2*y5e4b&f_gi7d3wh7jt>V65!Rqoz(p`|-nzgch-M72g8yurdx!;h z*u;w6xW{HZVIK&9dBKcLUBLI_y3$w#$hylEw#6%V-IPvZed));g_ zGQdsJP4(9%wLFHF$Jp}t0`T#!$H65Mn_mqslKBSWDc-{`J0isx(*|n9ZN$q0X1IhA z4h-{aIgTsndcyxqUD3h|3kVg-d5$>)<0NvCTEJgoCB&wYEKEd1ksv@8dh=Tv12q*J z$_;xcv|_9bU{jhJwKACyn?+W5@!z83x_VTPR@Csp{bmqqwO@J`B)~bum`E5r1flPj zU_CzLLO1ARv*Z1v256)OB7WW6fFAyf?)67KiDC;@Hhu#dRhIZ83uMtK)i047kAm4N z;6?F=Mk{Ac|Jh7{bD#YaSOC~za?Q@%IVUAdvV}<90&#Gz&tUmkiZE)eU1s`0tP|Yl zJCS_W&I&+`!UJ?k=W|#k{=tbd>=~O|pVv!7+NgqvQz35b2WWaF*HnGu7RV@dCh3rU zFeQN3tffe*Oo78#uIh?1W=dYlQzwSLsLm2ZMK%XMR`b(|zOZ2Y9dKp^>;bOY(sO3b zg7xh!$3%G`^UbHky0lzRE?g#S1GPh9B`HqT&_LleH$Ik@+Y>gmyqN3iebFNU%i7$H z(HJyXMpR1~xX040Ynn_W>j*PU!FRSL&5Tt>|GvPY#=p@HCy}JM0R%ofRtL z@}`a@i6dIL9!6r>bPVg5>Q4?pcBYo4Y`>@xIJSduf$9pQ<1SMqVQ8>WD~VFx&^8nF z=~U4HYbk5fTvN;WRA6lWwmD@pzJQr@e&g3SVwxhWfCVHPWuKtc(up<=>#z@}TpZs7 z(=bH~OxVKEipQ5!FePsDVF|a=_#W z*B~FGHpfySXA?yE0IBCO7d&}z{*952fk0!9P2oBC)Wb*$%RPGG?}``;&afTCNjzZt z7u^0t2z{vH9D>V?NQJOE zF4O%>M6Mt4DR_cDST!4n45o!t@uvvA*xWvX#E5F`UUCyWDVwE!%B4ehI5>Pt{Wl}nzfw9spWyd z;ErX?hFksN15hY_iZ%xjnxcnf5KO`I&$DijZ2^wNXfq8R++Mjm-Z?#cdCZ2a&qTC5 zjbvI6>h+AQ-IVM7`{(|-KO8W%27d5d|I^*AaWtXROyW!OPN)mR8*#0e340|~W#?AP zfSvoJ0edT)QJ@Y_*t@V?9|R4l!|aP7h(#qbYuMpIts>xm5jcZ$e|y0GUy!mnh?~-J zA_fj@hw)z5>8YPFSs6W4FJ$QSXq=(6Y=nlvGNB+vfE_gKo$*LvX+9Lo9T1eX3}u3e z0DcxH2UZ4c%;wg$GLedlCde4>=t2XT4njh6Q9&sbW0-Wp5fqdB2EcwCnqZ`pQJg*$ zpi0J9&VW}}S5?-NJ;!~u<|?gEDN38fW1GNAGSi6Iifp*MUW27%j!-fMqrH9eGS4j( zY>(7Pu2kaQoHh=^%tDgsd`W3{26>4zWgG{#OF`lCS|y|yCjIdB@!ONLy*Fn#^Dp>R zj2fGyZo6+%_1J}VDKtXnkD{<3D*21!$eml!HLa!VHn7wL(GJ~WMrAhYjUFySR~#%k zE3V?wDB(SZ@dOumRfhUJ-r$25P2EP{v(YhP`ixp*<*Dm=zq^#=*U+J?oKf)5G1~m% zG5OZ&Sp#ZtuM{?bX=-fL>?h)r#ijRy@ER$7L>-txnwtAo^p$)GYF$l@PfMHlOl5&;5|B?N+Spjwo+e?Im1a_mKICtAth=;A@&OB4!+CWwTC z+8HoBL?V`Zj6zI;&x}+KkqZ3tS%h}E2$#U<=fZ;mUXeBs!(A@-OoHvlehc=M(~Hm>f-l=)+hy`Xn@1$G5pJVO2mD5?;5qTZiUjG;>esuG~j ze)YxHL4WE-agtT&hu5%H_&-5Mb6_m^(jZN z)GuPRQPB`pS;sMn75e=tO120T?1^|#YTG=Hr>Un|{)<%UsThdQKPQF2jV%K@*u0yx ztLpq|SK9e=6QLXx!cIcz-kxLvi~kbj8*#_ryaVT`fL3V-&Mrp21P31awQ4;RcWC=m-zl?)te$G2vTMNRF%=1mN0jF7?m^{6)_@nxvY7I_$Ytw++{?g| zM}0KiShWi92_F57Ff50}#1p3~VI?M;j{8m+xPBrxU>qbcD0&JLp~i|B|4c^)dsKrC z0^6dvhkJiA07A57bd2n2K~w({T)sOMwV|g=Hwt_dci;z@8+UqLfOY-KbWiDc?-TZi z(tbbh(_T4VxbS=sIPo9|U3oA=p6gHJKghOw>)RMJ_w+17QJV?pKA;2|i90F;k9H|p zh>Pfyu2l`rX!Yr;qw=$H72AUxgiZtKfO;#^Ep0TycMJn8I>3d)0lL?ky0vVi|sS2W$sSFE|T)=&-n)}}Ppobtg+2o-4M>dZ`1Z+F>WV7dRUmw9t`baPYMeB@=*I?aj9Kb~!IbM4S-ODrrp zMOeM<&|)(zXe%skBb3$^y-m<&3v{;uN}UwtR3~08 z$$j^<^qXk!ve*{dTv}f>q@SC0nXOPTrJLVYx_GxV@l|^GkC`6cl6_qdhb)n8y{ za@o~oSEIthmN8MdKF%c)gTLd1;3l$2X=qFQHAlwU6MdT!e3v24H%aXM*qx*;`TBKI z-hO`m?dIh-4YoN;*_@r+oRwS-sWfLHcgjB21|yfqA+3|TjNV;l884Mx+%W-jk;KdP zEaKMe;kK;ddQ7R-%x%qROIC2(72ulI`0TjjSGxZOZ1=vDgi=cmEx- zcDu>xO|o-WS-H!(5v^IdRY58KSy_+U56`t4Ijbz&n`ha!Z(pynX}^9p?ZUIN%9{PR z%bHz+M^@RfKWKLB!o0A`f?XgBc46wSvRx z{Xxpkd6YWvyQWKP_Gvp=+Okb=N|oxXYS6Y-7u+fLwR=tZV`u}PyU7M!Wr41;KyMoL z_@1*s%_r9v5w+XM_WaSZJUb}O{AnOIKAjY4q52{!HGf*$#piajHdoo2t8C4T{6Ac_ zW^-DQc$N{m+sMjXWn-?gF<04`-(NOnYbs+)B4eA*Svnc95j7)H1{iJq7B{ym!maLZ z@z2V!odv&A^gVn(Cda4!l=2Nu0NZ!=1-nrHmHE}D>u&wib){V+w9~)?CjR@8zFHSn zK2raUKUY_rQ-NBYyECYoB#rvREuf61>cXNN!xH42(zc@Ryx!6hmNn3t<;>5l8990S z^DCxAydu|XA#(%W~){3xE4~G{d=A`-MdJyEk{Ym`$u5^{gaWJail4Tiv*98 zQ}-YInGFIy_s8y(e|F;p=p2c{aSWwnPzU$!ZS(}#%g@}#)2MYA4khCRipl_cG^%=a zaY(FOS8aphA@DkcIwChlek%jMjd8B(AVEAv?ypvsjIFINHBK1>M;s?$Bi2C@RaAyJ zrBk)&_|-wgiQ6$o4l2aOv%>npixh+U$WKIMGXhIkH;tlj4BEa7hUWhso;0ij;eP0t zP9c^-UPQqaE{& zY+a7t8Mz_VvjPGf`e3A@`*jq|g4D!*uBwGeHBe2{j&lH(EG#3Y7M!soD(GO%K()#* zG272jpE3dKAcoo+3Px_zIAAV~!*CmPMe2@C>O#Sp^;r(AS8TEcAq@@SQYf^rxVnJ* z`X-$>H6Uw^{dBHvMmvoPx;m9-UVIz{NdOQUZREw{P?j1Lzj2mwGO3A5N)1@ij3dS# z8J!wp#xOd86%$wz z6}yhFa6v_;6y-J0{UFtG6F`Aokyg0~{Yv4(=?4{MT^&Flt5x-vn3z@UbC(W+II&)>6i!r3`B706npSxp8ea>>zSX-C>!w zFD%fHi$JR5`tQ`mh>%9o{*)!v`XG3^_Ju@No5$2JJT|R0FhW^4u2~ui>?L?a$+f}I zSJ0d)X^2s7MTc~?4HNqN=)iy0OkdW3Eo$h&K~3nbrVJc)MSbN5_^JDu$I=Pb4}fZn zV_Bur09~cgu&#)^HjL}av2p73(*|!(@wBL3!x0djCe4>>4p^)%4_2Sv+0DgA2iAsZ6%Q!5!ZkwJUR{j^kmkn z78a_2;r6FDmT_WT8?RjMIcD%F73%9MA+wS59MHzM9^ zL0_cyCvKn~f=)zv8T2(BveI*fIDn<$2?1mTsMK{_OD`dFEYipZ_)xBIT9>_m*iN%5 z6PVU=6EHQq?bjp;O+&%>>R30PUn0wQ!ZtNE%WD~R6^MUyeT+MJb$E_tW7^)U0fAD` z&zDpf_4yJ&Mu2kN=~V2!qQWqQ#8j0r>5aN-Jdpd$bx=o^RO-w0RxOvvsHKKaM8rdy z>2LZPRSGZ`mXs-w+hKTM5Kc9?2mUU-51Nh1vaGNGa} zfUygG`|>b}(T=vWa?LF42lFuSxiQY7iZy&G;xk5PMuup#zKo1QX(nAop(>NT?}it! zQlxI8Ly`)|F_u=qEYAy4gMDC&LJdV_RM9vz6I&!2OBL> zK1OG%9&a>yhI+5iXiDgR|`l-vqRYR_OVN?hAhH#O?m!xA;J9;?+*EJ?Ly3k4sxCQ}OlLOB)MThOIT&pAv2D{c) z$5TcD@gw# zS`MNbW3{bc=~@=+O;-u3Q$+_dsj-O_WEC?fWNkD9*E(;Cd1%8OWk6kjnn;HN!po-g zebJqC_4!8tdB0NwoIE$BfzRA|!w54cz5(<#I2>SUH9^lsl}ZDl&J_$34J~mu$Pg@- z?tUyF;2+!1Ej2r(r7kXQiR)Ptx7WJ{ATdwy1MfAzi1oX^@ z01!Sq2w-l&bReJvUI)`32~fBn1v5G{spE3INO6XRHKlmu&RtlJ0GVSR+1hSBtO5%W z@=PcyRolRPYI9^zhjpVN_`q>Z5)YuMe;Ql+HL5HOW+ z7oxO0ls7!VlYZvtSUHZMdea*-dW%@bvMtvGZf}TY%L>{C$iXuN;mNntfMq8m^{Zxf zeXeHJgdSxG&(Nm~-)VY1mNQz13)KwPfeicfl?{4TTQZ($S5q*Zek~ANwg>r9VO;~X zcUw44T&B$l$GdJ!o8nYh-51Y$r+r$p(WN$W8;mdI<2P(tD;MAB8sS}YhVuhZqB}rf z`JXhE;cdCzX=EGSP2;IL00M)5fm3w?fKJuvIj!MjU1T4Idyb>giiV?g0P)63OhB6B zb&ALhF>qb*I|FkQZHNHVGV7GMu<*PvsH&z4(OGKgWG_5GnOPB(y`|c74u zlGtk4>qznnIz-KTKDrH`j4YPc@J+0`;R{o4e*!FZCQ6KDW6V%iec<_bdBb$yy0Wer zyFZT4wV!dyj^ZB|(=*nzRWGv?iIJ{2v1Z1EchemtID6P%F?Gg}NS9sPy{5mbrT(&( z>{k5}RHdhSHVIDkLdhP>eQs}rNn2m@b9*8+qu~QQB4eiY1AB%fudKW&3#VGWeqB#{ zW=mN7#?CTHWaaD}b4pn$N31lEg+IS1p!Yj}cdsFhCKt#>GO;9Z%a`^P$C)nm(2Hr; z5A-ek6&>~Ha#dGf+S3B9zO+|@eq(7e0~IJ1elK6zYf%u@Pwdt8!{RA@?O)InNL8zK z`E*`K$j-V84AkdYV&?wW*!U%>SaPoXezeu2MHwshiqFzE$ex zDs^*}x~YLR1Jx?8Qa80NtWq~?`d>}dDs^*}x>;VlR;in2u&SW0Qa4wro2%5#RqAFP zT06~6Q`|Vc=BaI*R`ZmuQa4wro2%5#9B7rgxk}w6;8p6T0$!zV)+oA4-KKpRQa8&`tJF=+!nR7?G=Q#BH&>~ftJKX^>gFnSbCtSTYGakUxk}wEHML6JWUJIo z?b@(P-K;^ZQa5#NtWq~ushbM9RqEy{b+ZCmGqkbTx9q;V%*q=iOqnw&yJsC0 zf%KV^Evb(SCR8q-Az8|*(`Q7sWkPn(fGl-p$aq{N({Z5;$F|JI#WNcJMZe&Q-A#hv z)9M?ZU-uiHze~Ea?8lGvAy36s2KC3j)~7t{B3I%dL{axW%_c!<$+}-!QnCir8X$ZY zO@*4ogO&0~|E1B)%+cR{P~}vf#Po$?G*}rDfj-+!=LKRnu73i%p1j_E-$Es^v_>MN z@vx7b8*d!|-^B93zi|%4(ANGsSF7;(+LQCOH$lR&na$x~>wK+uz6P%AJcgnVP!U-I zeh%Ta-o9g@Au(f`0wn(jhVunO(Oc9coNJwP%_FtAniNs z(v4F@oF*UZFbmwgIAPa8ir+eS@#E6&^cuf(9tMaSj1wj#;#PuRwa0pq4mt5Lbt`q; zgyD1#*!yx8Q=~JMT}}e4kus}4sI}uxd$Eu@dNOQ3%tnC z$vLt78Asg3fmKnCEx{|rJ5!ue8r7BMCsaAG)0hSRfZ^mI0$564UAMq^ji517_*Auwgep}7=D zHgz2W*cpzjt;g0@e|N{?{hi(6PT%78Zr`3v?Z=~s+mlD52{q8Emkjl6BI&indU=FXp@ZDAbL*B}Mci@`0ioNjNZqie&x-un?l^5!%g7 zBo;(qI`_|%2^O2|gY709K*5&SiCA8YiKB;_;z@mH!k*DR6cMmDu3YPKukT5mppnpH zGagX<(si;|*riK{r10c~<~0HoUQH$6f1DRWnPhzY!hO^j-03lOM*((Q>hipB|HnZ(pI<*4(yJJL zgE{{XE~vA;=+ji)w(&&A|d zFgMw2E9|phcrc5s@WQph4(+qQGPB`{hic%9l&@^PcohZn<6LFb3=RGnV<@=sUa@v4 zlj=>;I?3juY#wEGPB@*vmzpChmnvXLtJ5v6L_O4#1(RBUTcOaW;Hf1Q^XDSCI^r{! z^7DLUh5F@MpoI>}u7t)UtDJ!Cjm`J6(tV2fQyuO66`DjfJeQllS^3^<7U7vyh4pDV z7tIrTuQ_N3TL&x3P0*+^0ka?~kH`ltM6W4zPS>oBrKVOBH8U5$gNnTJ_c7>^BoV~` z&HWQ(jxS%3vNjnpzq?LyLFErC_AYTk-Bw>x$(uA$UZn>YRx>bL(@x4sAhEEqOK}hMEO6mtmt&DD4mBr3IZZEa`-| zmpD>>1vD(IqVlXmyr>?yYr)JH|5@ZZWe&w7!d6nyJz_`gH7Z#GF3t(HkwHN5qwMdu zp|l^c(Yfo(p@ao4l{aFc_LR1)IEh2>0xOUxTjY;_ z1$^tg`n9kgKJ11yt{oBRZ#-U!V8Sc%sva(=_!mLs5XMu>i@8=6Z5ve4qufMpXqT3b z?@DDAv`XD>VneW-P(k!m%1Fpm6G;%V;Z|mbKyQ?m3m3;B!R0e@cBCW3kF9KmgH=^BcPjP+ z++Itrl_P$5ypdPRHQe0##OW%VLcOPqsj5w?H1Ex)vslwY<19xMoTc8@2=RIaTLKia{nufkDRCm9V(nk ze6hG)G}``GFpTz2Gt;OjeuoEA_zs=kfjC0>?zHq;zU>v-%-ipQ0O2`b5U+y3_L#cG z1YWA2J@z)5QM=^}c6#b`I+bOYlJ(SaV9`qchZ+Ut5;3XBwN@Ev0?gCAbd&2olVn&I z#@dEiJD@4T+&Ks?tbbym$#sOzV#{dIX0%B*Z!pmyNpnRP>){l`gA=@*-_s z+nbe(UW?S-uJXc90)AK))F_yPu`-=D!0>qfv;}XIL2Mbn=i~!J}2nJS0}_PZ=Q;!blAfs_;%(ugC-$uH2O3=PB2$t3$L}bSL*A9uqh6$yrhaDe zEN~OqXsgX)k}1p6R8D(lLP;y3(_xF=SJRS$*6zlE2*(2LjZFOxptd&W|e`6C(!F*43`A1XAL$vJ?JYF<9?= zT!wGOVb(QFQ-2F>-`UbAN8WW&%g2*L$afu9vl4=Z#Z0z)YWk{-pw z>A(=cpQ|-ezjbViOFYO%82FAWnE$;SyA#(VWiBSL>ZO(rSK$pvpj%WJ*o|NQ2{LjP z2!Y8Q*Wr2j;M)mCQ#h0hHK^uAg_%da2DN*G(^BR0UAK2cs#)Lb^{;k^y1dxF4&sDO z>6kK?Wa^dF-?!eB4qdgUQ)jyeTRN8eM(Zn{yh3{lO;y1F=XeyWVIxrMZ@#2FYYcB? z*VC#-$la%TrJ|NewP-oSdBxgz@|(J3Ma%d*n&%s>bLc2j`tQxxjNaV@nR)R-;hSTr z_bBsQ4eqLkTk=_(h}>y&^GnCIUF%KeE3a-PdthG4dfEW{-1=Nx2miOI_wA$Z%PFOT z+UclYUP}G)y=jyQCO~H^M{PcLznWz-s$c*ng0v8bi7{HJk_IK)Vqy_~{;%Jh1xfwL z+(m*@XOzYHWIB|bdXw zC*|PT5R;FeGSZiY@t2b#pJqwRbiEXPB_O#lkc$NHDJblTXcTc0Y*+yJGHCghd--Y! z6DutGRc!^luWGb@S6fYfn=)A_HClql+8ZLW;*KB5R>EkSJOh|X%NcKuP)|K0n6198 ztp~dMZ)@v@?-Ue-kp{v_p($J2dvjnw3?wwcRP41{BEEXGt>aUcLcOZc_e#);`46Ou z)C?XU9RcvU5nAK@qmGzmTG@o2?)As|%hfm1@8lclt?FLE{??%Fm%q+HwQl}ix&p6O z?DEC*&aextQVQx{>w+8gwTqL~ngO$7P)VG5nphZE0U zOJ{~#Ta+lEE``ain(;6-2gHzxqm%hjFaL}#fuRGI3S+vLCcX$f2k%xHZuJzpm4Y7i zl@uB%V2d?ITWs$7K+1Tab%ZJ_?297R6TJK~qd8IBj<_R+qhV=ij{C^T$YgZbP*;VB zhkaqe)iaSZ5yNQL^J5RdXSJqFME)rFj$|u9bRyjnk?LM#AEQz*Rpu136N?TVhQ^CA2rzGgSMW)vN1rR1J*e8x?a{2v>0sTSl0HlWo(al zS<{)mU2b3aE@pign?4&3hg)6S2&%1V2xxWk&t(&qUkh7Mt2zzZ+aNhqO=V&+~j!#h|gA9@~8^xN{;@Bv94-h6^9M4ZRv zAIO+C1-r#{=md*#@EHFR(=Ma+@Sjz<@!b_y*tp_K9w?E*$6}N|xi)nQmLF$rDgkCB z!EBG(&^EDXfLywvrO@{Syf0^wX!rl9tUih>R)gKuY(0HqAJFZ8n9A&DQaJvjhXSt>t0eLFt>{Xo?d-_FWU6Jy|jf|<`85p5O0(hU(~Ee397Ne_dz z7?I7xxSC7S9?UoL5oCR^=QUC;5UhOAF;;1)w+dB?daF>ShQ_Nlrc z%8^Q?Htr}|d3byyM(7r(B-Mz$i68Ykt0>`^w6H!>g8$K@g@sePv`r-M zsIOd|Xe)70F~aSwx$Acd;?ey*C|y|uQq!!qp+!S^Ng;+elE+tt9Djdbv%-&A-NmP@ z@IzLMe8;LinpucZKKmbCC^OW5;VO?I7Eg8-?xcHK{qmJx`|y?NasZbU!Ypx%U2ax{b#RoB4nSvs=!rZwr|q;+iAA=z`V)OZIOuzhh}jY`5ab& zpFhh*Vu4ufcGrWWri!a*tf;q&#%gHX5{*6d-8%}!ZasX|wLSjbg<>s7C{exZE@8gg zW24nqtBC1MBBtBlCStm+)p6Y-rh40&EgbzYwsRK|Q)6eVh-tOnDq^~dnAYK1nY0LV zXA#q?7%v?$UD%PmS=_XS_kwZL8vKHqPeI;c+*HN)ax@nSn=TtdF-He4o7k>NtuMg6 z6{hN<{nx^D;<+)ncn4+RToImfaS>aOwJOKr`u}S(C*}Ba`26QMi2{H29IxDc^7E$r zi~Y>!&(FxY#C+=sXFppE{G;i!JbGb$vIg^bQ{4rpL_GfF2Uoru$0^+AFzI7URMSIE*IRPjhP`u)UvQ-Kb^Vm7n*Zpgsm-OF$_3Tw&GXF}_s%yz z{QS8c598%MuV2K*#`1ppea1t1x7{bDF3v^1A@6T{eDyse?{0RRrN=ke`NrzNAfB~$ z{60t4C6&o8>9AKg{dh@ILT7i~LLRLvvn5g<2L*pV$Nuo+x`|1ZUyZ-iGWFalv^w_u z$>eYa9s%>i68Zm*3s>Ka^|~%`<-p?F%LhI;Y0sMIv|5SPj_+AXF2j{>OYM7ykL=*q zS3at+K*rR@Y2)ipyEMX2`}UvL$qznNE`PsDqsHR_os9FuzA)14|g?buC%*kIue)Wx2oT(b@KzW#c9*o~<}0O@8ZTKI>{HHj-Dhz}Yrjk6WQ|Aj>Svio ztUT${d+^TdS>e01&ZVzCc`75y^vt(Lr$td4n=>y+UJ=v2dj4I_u}3HBuBqzyo>BSt zR{Pbe4POEcxEJ3a_K{pScw}ofeD9M8^1D4 z{r6~3+}e3FS9*&te78EQZFMKlvYM5=nXP=Mi+la6_xSR_a|h%1ri!UmL}x+m9*#={uHm;?+yLX&1j6iyfZX{4V+CwVtIv zmTQ)olrFZg6w7Cv;Ge`gcS`q*N^naCQmM)g|c63(G_IA6Pw)Wc`NWXjf zf*$Y@xEoGMMIEA!yP|Eo+q4UNpxG|b!Z;u;BHKL*MN&#`%X+_Ge8N&qG}GB7vfHD+ zk;GOU%sJ`iW)<=A7*{{DW6+6@d&+Ct9O>KT$Br72N_h{R5~8O>zl97$QLb8j&Bwv# z3|v?zVl<^1vH948xgJlCp&64hT$Rn|u7x?@ys^L5uCKcG5=Ce{(kToim#s0eZC`%b$kZNW-nv67hGn}Z6 zw+TkIh-_?3ZlwzUCS2rbBJ*djm@)dG&X#JUEDu2eJI2Wfi#?b__=}foq+}`>Yd}K9 z>0flV8BeD+FxwhARyH7Pp7<;oQ)hO7l6?P2{^G?$6P`h<^Z#X-B-{M`?QcPre|y_J z*%ZPURPviG3(D0u^-5*5v?aV2?O#gNAGAkMr!s7%Iu}_}20sFv4t2!wn>wAbJVje- zT26A9a3bwMor%a~IBb<5MCgJhW4`K8+Q86Fa$1PU&0iBYE+3*H^~MC4XlyTcl7v93vfj>y1jkn#@mt%<`>)69sBksnOey$WIp)f(!OCC$(X z+B(98XwwuyW}d`=_J4cZH;H7p%z|ky<3)ZTTE5Q;q43}%G+%)0zly0*r@nkgjo^?L zp&Ou%uE(q$l3}h*(eq4Ze}~0X0@_v{e2zIc`0%2iM2=v8FLdde+4zv02o9U}1uAtF z`kiABhUK*87~e87OoQMw zA0Cl}Y}erX^R1R$UAd-ym1?|kx;2^cqej4I`N7!8<4@W#sUcN4Qr_i&i`bburT0aZ z4}R@$lP#Uvv(3@a*a-%V;k$rcS2&NhO!itUh z)m4{!taT%7Liek~D^oK{m|JhKitX%AaZeI2SOmsdY*+Rs82DZKZVP}pruPtL)AB2p z3;N4nc35Rf+$TEbLJY^K`86(7-b{kb%93v?sf+NS)>|YuVT=Yv)KP_n#uTlcTEmv-Rp@ zO$-HZGYXm!0up)sspIFqH#1Q|@Q5s%#0cR9#AoKu`Vbj?Nt-&gpV?*B@kLyE2Ja0V z7PlMjxK~uy5s{%~XT|T*^XJ)&5PqVyJsc6@EY8`P5tK}rcC1BybdgWQ1&%6ga`JF- zad2bc`tWgaZUwh(|EK~dDkiLIlT;Bet~vHlQkYH6-0J10Xv6=gsMrNgUa_P zE3$T-wDaT%=nB`&NmGrYd}^6jA%ewFHoigwUBPS=9@qeI}&30KH#(J)wQTElX|BqM60kw_PQ zPTK=O2+efRH|7AWP!GvwRUSlgB+pjgnS~Iu^4u=00A1Ua!Yxwvy4^rGGhxgLejy?J zSN95^6o9v10y7c=sCuYrYP@W(j?-O?T9x|n_g3A+ulX&)jq^UXnxdmdLtQI4RqT13 zNuajQ=h(XEY9esw5$a+Y2dK@jHVI=4R>BmuvA3QW^jqKnHuTs>o`lGFqJ6!wKf_#w zWq&kQwi`BNk1dPQ_9pX*^SMv0y;NN|Qp0iB0BZucF+C|^_uy{YB&g9k5s5Xmr(ZHyP~&>gt&KyD3Ul)tMdlbT0x64+wfjYke5ITGF4lnpz?%rK*@#+)kZ=SZ?jTsdFI$mqJ!oF{7K4kLN=ytB$3B>Dnu87 zF=h<4MucL3F)Dd8++!Tzv2Yb=O0!fQC4z1l&iSi*l*Vo=L-_<9p#V2vp6?B+Vb(Lf)`n*|w z$Gh-`C&t^`^eZ3IuWY%n7QVKU+QN1#S#PV`{d6nc%%|>~e(+njI|DB>oyvtmuj)vq ztYS=gyvf49tZh-;=Cpll$*0G2?d^o#T6=@Ywea3~c|~4qlU_0}v@Lgf6W-P;w~uSf zUhhxUn?YH@iAGs&Kz@DQ+tQa|!M=i(dxaJ}--`J=kB|i+&YPf}ka$A@BhKH)8@=?d zL^dziQb_&unUeln_tEsRcqvHO&h$Afcq?D#fEN+ax>I=4Ym`&fTWTdE40!6>1f{Os zUYZ{^^n%z23)TNzp7|k9;Sw!&OiGq*xeU{=kwlg}g}{?xG)4P~Z6YtF&)_W80#pg% zcDR=|+o9r8J4c3TN=!!cX(G0+Akj-C_SeQd)ap)45@ra)b^|9^8LbK!fN-&z!bikQ z9l}LJstgJA&&i}?l0X>j^4j5G;JnW#T#Dtm(@ju2%8QA#MXY~z_E3AL$P9yPBJQ!+MZTcZ~%5{TqT0U zYZi8f>&E%$aM-`a_Q=1n0Ye;iN1#IyT?kMhf`rnp;~xt}*aRb`_-{WG7ic`j;qn_v zVYfs6k1TGueezQ4Ul|#g`}->T^fbJom`yNN7xi3L(ZoSjJ_2k@q!Jf^SG))b7uBOH z$KcVG>>xPhPI;?kI{P^zT@yKp+xazo^i6nwTZyUxeegstzTC{*w~C_5$H61Y!fzvg z>|J4Nq0`Z^-9NAHu#3mediFkKu&zGyJzC*MuKmYeeieGC6}+o)fBpK9`n9C(e8KPC zKUOib-rjp-gH_>w$VNYnp%YyusQ9rGS?%$5c|L&^{+~8{hSU_2WCs8^PXq)&{HG0V z4K3|dOl=)({wc)&s=^yzTla0YrSrERRF56+_!}L`Hj}ef**Px9rO!3V?+rPx+el}X zs1Or73Z;{1TzmF;`+jEN01(N5A`@;$Wl!%Wwm?9z;LO1p0O0Qr__4KL^`pF}%I4RQ z+T8LB8qcOy(!S?1xpSHKlyJ-W4|lYuJZxE0%_i23TmD^wB6 zrsX-mewm{9OPR$@cSB9?Z=Q7CG_!pF81*D_8k-j5`IeM!uqd{-t+HyS!;F zv`!6zUb+Cj$9HLK^qV0cK}AIVou#!Sr1LZrOfS6$AUq$YUUosu;>UAPja-3*j>CBdAZ0zW zX0MGgL>J5b(6@EXmTHdJ#eKFSgRp3t3Wr*ml5}S1b2i+?0%QqKq7dPDY+_Y(i6Dtl z^wobhRaLts`3gj0##h6d*=X252=82sdnq*cRhat0uvXzC;$*e#GSru`OX9V(J@@TL zbY_cv0ShY6b9DrTLudRELyi5N4qm2jCQqkoRjsZntVFSfIQs8-K|Z36(2ZIx)>VN^ z_G(MBU_n=b{=%Rp5{xVH<9J{@K3sXxiS@QK<0WG`1OW$R3ST7&pb{q9i8rJwYrBAhy=z&vZoVtgfS0o7&{Q)P@z-x}OTV z^R{>IO$z;ukAc2vTC{u5P7{>4y*)#V$dp;q;fx}tcXqZ*+9;bN*Ao&>Kb`xr9r5mM zzU{nvhDJWmhj=!{R&xN_U3WyRZNX|gpJ!{gx;A|TxDoU`LFN+QplUsn_lIiL=jPPgax+Bt#0<3GQ(ix=Nrd^K2b z#eWcw$Ghf=$G_#^qT(RQmL%-(`2t33Ur<|Yzq2@| zuNk2D?jO^CC{`7#=ca8yJl3Vz{$tc#>JilIATtLVLQ;yZEw=% zkIskQ3i4?st8_G?GU}P1S~HFfyc>w!QU>}@(E0jltfo4edA(GdqoEY(?~ZGH8Kgwp zBmP)B;N?FoNbiMl3Z6f;!^2X&I`7EOl~nml$tYY)`^(2+dF|3s0~{%9i@s`y(^mmG@yUB#d}-Jf_b9%Xs;F)0 zQlPJfO8V+r1`6tJV+t1T!>NO6|3kH#`pyZIq zquoOH0AUn4Ok>c$ZW?$b$lK-*iQkeTa$XZW$Uu~;;K*ru?~_Ycq({`< zeKvM7k&Hz%^C{iY2>`Xu0EGAHg)7fIx(V;8ze%6PK_{?F)CmiDPT&jTmjsOgUE?3a zX$e#^plk{F0w~`PR_TC@DDV?AE)*_EHLwQ8*%+;08V^|`bGP69qWvr(6@D^IVhaM| zh^DOro>-*=EF&orC_HHfH>m=^e1}4W8Nju}Xkl)KB*4Tzt1$K;e@34lixSzR0idyT zGC5OJeis3N+M;hH&3lHd9w0Cj{}ok-y+{06VSeaMe}lb1a544km3$|qP7?WuW!K3d zWFM%j86*-#=u0GJIH8=QvYp01H6P3HCJTN6M4K*9&_n&4iy^$G%4bhvkv!R|2##{Y z@U7|9e6OXRXhKLazQK>0b7 z&^D3T+=4=|t9%)^A$amWA+tQpvcst;lV2pTtYMWcj?oNtDbLql3scjlD(=1@Gd|VJ z58@5481eL-h2nLI+?i{M=yWe#5;zD$t#xVAMCN5}n_6rpZi+V2B>>Y;P?L;2X!4bMDFdR*n)bSxWa z#y!UF#CD^h39}lMzn0b~>Zj5uJYLxOwxk5$kaLT(CX^c&;%=;~%V- ziFksXuf!y?o;RYMZ~cfu_*5M80>`5zW(^1_%5+9VriG}ifw%{-0GWy*sTi}q?J{+v zC+HZEvF**B5;!`u8OTXEcsh&<+>e*4ptRsGsGRt|{h`IeMQw;TO*+7e3l8rDcmxp= zXkYQ>)84A^TMFQ%D}>ojZaa}bCsWqkFR{I27<~Ymf^Zp~ad>}-(3hX=(8hW$TU?R$~n4_)jCjJziwnyMa`%bc{|@0 znP5Qrk86xjBK-3p$EBuGGm(jbLZ>J=!u3(RnPlV!Bk4~VTo_a|KH5wpknoCJ;(*4F zaZkYt)>ssU@FdPhEbPuX0pEvau0xf62!cer;_w2Z*Z2#j>n2ag%h^G>RY~DA;uN5| z?4s^X_ngv9vi#Ku3n)H%fgmg33 zBCJR0HmE5n+Z&|3u4!1b6!-rs!@7N0d5h2Z3FQob@GfTn>6lTc2S!; z1u#)+T;F7;i@N0*c#w#CRWcovp`7HOkR{GUOG|T8PKcHeB$GJ#LY=0qlN0tc9D~=# z@8RX&_HvF|`p=CUO>B_3Zu<#W4$tL67eYtHupuCel)gKld?}On6}>nQgZg0+ZZYf6 zOU{V*ZVtAdB?VuclBnunnRX8|s2uAtM-e=2O zI=}9j?B;lY=gl^u^P`P(+CxkX1S_!soR(KgR^v;|Rz^HVTeyXS@Rgk22m*K;?}yYR zAqOJbM^s^1`|}pjp6C_;kF8e&T9fuhxKwu1^A6USP#M9h*$>q5@@Sw zFn&34CJ<66To%*F605Wns4Sia{w>A-y$Y`JprT%jF$lE6O0533@at?Skr^y5k!fm^ zrzFaD%vp$zb3oMuZBmpMK@9z27N&e-fYA}Z-Bs3nc)LAR7+CU(42!_&u3HzO9z|Dn zIjb8W;HAE!)jeiGKx@xpTPBywdp58PbHXIQmVjKuo!a} zSJ!1alim~F46~w+R~Ev7foWQ-Hq3{$6+rJB-upVoX-Z~!`i9^bIF5bz_0gzhy(dBz zq@^!NoqcavosTvm^QMwhKMW}xOM|M$;kOqQsa3S50R3r|X23g_f^%XL;GT7OJO6G)1O-4Jj4 zT>+k#wx&YWe9op#lDtfy*-y?G+=W$4=Nnpy3|fk(u1f-obSXq zz>QSm;<|uyj~x(FYHUOk3)6$WI%s5@m>|nm78k+fgBs-%7b2@OBg#}M!sy=07a=)6 z*f)sSE>Lk@+@hH%t4b)&I7!;c8#%?&(91sZVeX8pXHrb_K*Q;k%0)$m*aUyM7R6X9 zA(qXa{MqH%k$GJionIYc0x)e9iONl^Bx%FjykcXx8^|7qLoAehD%-pcZyagI9YKxi z)r7af<-H4dWCXQRsP~&xBBKVEr4+nM1cZSBqN@9J2?l|r1E#B3Zc*gl;k|q5oGmL= zD>$_`-g)C4$9ZSB33N(e1Uog4-_W~7tL4P;w)xI@bI4@OT$m%7lHiF74z4vwU4I}h zP$~BOg4OiA($MSTRppl)d2Yii_;jvHWD&C50y+pNK8i_=d(ooGADFV;UHk7@{af`YK+JE z7uR~>Rtuau>L~6GS8`yi5p6MWZa)>47x~4}?&L*m&n}1KiV;O{-vG|X@%1bk{53M| z9C}|NKXoko^7Iz**mpD@YtcO==(9eaaYA{;^GW-Y8Q$1Od@x{QGBm=88Hi_u1t41y z-c(s}VHBAm(C5i%th03HwXJShg&cKij2si#7Qx>>EoX!~J3`1V-01#;g|z3F*>J6^ zeX7=}f9qh1)9xK&p98O{a0K!t!88sPqNY&`pLZ9QmZm_3F?^1<(rE>r1p31SGk*yn{N1qYVrv~?^+&WHbQZ(1G zX0CZ*j{KG|!VUfCfKcC>@D?b+Gt>||wqm}iB}&JsJz z*<7uo3GBIjGO@=q&U!Y)HV#f5E`#l)3+vPBV|TSrP~IAAphxWPn%eBe%~_55&`{Ur z3|}(KtfR(Ru|6l5+b-WT#rkvESq3dPNmc%Qm!{ms5M1LV-ao&yIGXxKCEj8hckaa0 zHU;{F)>-hxOdG?eA59a*CK>tU%wwBQ)H-*;qJOc(w7US{Q~f6+J)1Kf%h`#sUOeU$ z;0mX(pO;UYfW7<>uY7wVRp&&a&WWV|7-!P7PP#i(XX1_q+$nKqoKy1z`h<%v{dj{c z^-|0kOT9CuT4(HzExl1RZ2<|$9hft^T4z+X?ubhLVeW)#PWsjQ-;6J|O`8{ODK-^8 z?^17}i@3y5U-ODEYeaXx9dai7TLE`DmP}xGHOMj@d{UjhWOrZMvV;epWhm1__4~t< zq~?41z1jbv@%a-s5ERRXr!1h7T;%eSO<96#VeOCJYqxA(!d5~iEzEn{AY@hW$Rt80-_|A*3uE6(gDC=zBNEW+dbp&jBBl|@ zTq9BTIyfS^4md_Q1wuN!X;yf>oUQu!Zw(M~;|5#VWeTY9g3W0Ii-o&G&3-O~TXnb# z90SZho;bQkR2CxkBv7yrS(&AC!CpDVrPf>a7g&pjDV#53hr2p)bR0LF~^WpvX126>1-( zWHXwV%1pYrBTCx>gB$i(;4`JJ7=FQZ6W@ihx)dDUeAEH6QL=3WC53=GP@#xu>gWy< z`zFg}U?#PO8M3jn80CtB>gA6t5^+Zqu>eB_u|Xyr$)#wc_PM1&GFC-PO2BeFhY^kf zYGr_VR4|B+iltSqM!*QC1}c}4!L(*!5+a3x_#_*IV){1@fN0o&{wL~g4f5YrP$6x2 zr5_mu4Gt1*GN3bGCc2HtcgdcUULS2t3MPLPXWG#&l?TW^7m(%$giEnpjZRr0>EPsiO<( z3prGn5sG%BAug@3*qj=IcBip0xnz21?O?6vhGhR?DEdbDC~0ezE;@f zt9+&Q#{NgyK2o20wcL(Eo^o?6H4@bIvCuPR#!^xY6vi#7B4a{Iz*rCOB%j0y7o}nv z6+mIz_=5^!L9(_zkDdpcgX1bTKt3OvCn)dUC*T+pjckLeqB9EPS!HW_2o1f654#Yb zJkI=%&@TusBvaD`^%prQnbaegRKW5O1k?hhb!XgWkeNn_f@}lfkHXtsI3go%VXBz} zF=^QWm7BKxB^NVnC@>Xpvd15sZbJ5K^0Kl~T57tWNBH`>D=RC93eE7E9sDBVswdw(!lu<5#cPG z*hHjL4(#GGDlT(SdEn<$1H@fhgEEBnEHaHNBH4@4nr5L+=9!46o(P@!FiQXg#8g!v zd^Wln+v(!MHEu20>DXq6qAa+l(3v zxbm>0640^4q*$@WD77s>QVBS^mcEI6ha64TYZWxe7yOd=`lV#aI(+wG4Q2{Wdx(vN z0>Ok6G_Mc~<$aE~^sNfoUe5~Du-3IJ61l`jByoj-?^~CulXK#U#?eS0R2nBY6is1u z6bH87g{)2CIxuS#{h&OWNff2gZ;7 zI$hj~8+QV!!@vUhVtT#e+6=#907l-&7~T!EJ;Xa3wuxGjVjNm2;$wH6SpC%($;S~E znD>JKID85Qcm=Zo2a-B)``Vs44qps`6Upkpxg*OlFqEal`&7nHBNjM~7_V#G2B;no z3gKZ!POY*vm}=%_qEITL9Te;_o~;6Yc;svD^ga(so|!lgq@i5@+rKy=lHo5}j3o(& zbkzum?=j}$1R!vJ3d;WT)`G2+G}X1pPK!-3B}8(>K_`(F6*mg7FXMx?udhV%>i(%p;Qak zm)pqH<+fV&*NKn4@I=59mzp$@sC0#!imtMp*)7bXq=F;mZ7I1@Ky?=D68+X=%z|DN zZvJ1p$V@Bq9Gl0-r5;06u{Sdsw?&xJY(D@WyoOn{)fm_W;P6NzGB51dLjZPXU1Gl(W z=i<>VpJp73vb4!MQq|l>qxUZJ)$X1vVRyogr9VDkv(=_X+q=fzAF)q=08%jG5;zRW zhfUqL>fDjI)!vr9sNezw4)zaJasdjIU(V#LIW*C^!JB#KnJ+}86}tjFj7i!GgdMv^ zO~5ibDBp8~KPekW03_2~rEs|4_Xs%Z76QttV4|UKV`fjJhW3UE8LnU*;O#vaoLM`f zo*>MxZ?`Gzj|v9sYV4By&UPNal26kWZn#y!2x6ax3A93Hoj2SK@(&6WjRujug)+^; z+T@M%*Cthm^2gp93WKboaH`_CLYd@l5Sdg`u;iAZlA1v(8@TT424yCw2($t_7f2wL z8`cxkQe_~t-hE`S`8YLkhz+y5UWU=jbbdiLuw+s|rol4qYrF)W?VqsD>7Ffh8eQ)( za5DGWrr?k8FCjCnW$kxjVMr;P8%gW5>);n5u{@JtPP0;9DqXW4?^3neuRgbSzfbJ| zJT>+mQ9Bc%79R#;C1Nq(>2f*)sq5{e*eJ{Xbnj)mPMd_MIy+o<8kPR3U!p+sb&>;U z_p_eMqc`@HE#sV)8e;3GYv1X1yxA+!?xkz@(zSc(+QFe!@KviT13{CU&;DzbGhh*U zcC-c9wx-6OjcqH}n3KQKsZe(w+h1!oHKSuRg+4Q)Lj>%c>e)HfqhqSq7Kd2NM6aHi zu2!IRqIz1|7^-?|D*LydiJsb^dPcg_XA{)Oy`>TKXZ*x-G3QvQavpfS^o<<`L9jWjsIUkT4(>8Z@Et%*CN$3vxbR&`acEW z8vMfpX`AX*G2Hww-11+_zgn&k{-gf~0PLRXsR{U3pY+L|oP0;ixfT{vjWpy0EfbY2 zX3A)nymN*7Sj)~tRoSu=;XT-lJdh;W5Vv5g}FMg-%Ui?q& zl8$MAA9s0*Dl;yy`HD5s8GaIuc-;=kF^S}o<6JX<>9mrX zswsxUhkboIH}Ulkn-7~I6oVayOh$GjA0j65uL&&pxUyT_l zNZ{5GpT_UeS4{%AYrr9^06B9aVmUe*E^EF2fF2;?XCxE`J6(q$$8|&xmlfe?2gyg- zk8u>UR7sP|R66}JgNz=+8=e#dX-LUqa36q+EtE8m0wnhdJ6ekOvTzjd|17YuibZsyN2au5WKP5nsR*$Lqi&m zw_)%J56%Vy_J+T`<=xP09efGjhQF#=?1ZRg%_!@0XV-W}f+f8YLl zaA>ixj~Dy(1`cxdNZ>(V3gY!oKh06ttC6s#fhVHlaS`JwVA{bkbJ@@_NHrybZPpXS zH6(#S?LPd77wg_Ru6sV8E4sUfd+(0>o;kh&`t$VlKW%s}yt&yU?DiG|i+N9jnSh&_ z@TZZbP{cWRYG+OhF6&f{=C%z#L6-j92|jEN zvcRV-FU%iV^&%Rm=8e4e3jddfn|m5JaHI2D)?jx=Ow$n^suM867AWih&ER||VgIt?3=${bJD$jtqw+aTP1 zJ-=h)fmDF?PIN-8Pp>z+_*|iY$toP|KSls)m!)2VI~C+rtWEx*lQLV}Gsjro{G{ak z=R^tg+0wOZFco5!V7CPAU{2;-*cbgN7w-{Lrn9X{=*Nk6K?vMLUC1~|HE!^A z?3CN{0y=6<8Ta_xQnm;yZz^`X$H$&2@}Z}4=#wNn>J+kf9j7JOItcZI%|azJKocch z93=>?Xg=lD%xY~^NxQl-E7SQvP*m^Z3-LUW1$7i)cG%b?j$S{Zi4K#o|3lA9?gXCt zmCjLUS504Oa+^iVM%n7BWN}S3R*3J7j!Z=)Z(R9QM}|#lW_BxK@&TjH>&B;ytGsA# zE;SKQ;lmm{)Y@%^%10d?jf82>0su%kKyEf%ds-edw#-VK|8YB`F2{*7@>0Q^hPhc1b}B>3EHk=NN4*S2 z3ArvRPU16{Wl0ocUfG|CO)9AKZj-J$Q&|1VAo5Pg?7wK zQ1dZqqG?E1H_wmDp_PPAgTyrtoLyNkW8h?BD9x&AhDf{!ods1*SXR=pY7*bVy>r;w z6xt=FZee7As-Y{BOBZJ+$Tt-`{Fc`nIp!GcgVTo%5s7X_@;kPieUO${JM;wL9A$Tz~u|#EV zB^U)*qj}hbAYsP+NQND1#c)C=0H1R}d_(FXs0u7IRSHm|MgNQ=1zNxasXgyCgNan5 zT&PnJ9hb!0jl2TwL;1|$G#2s$D~nU0uCZvSlDgL=F$~qVK1+3;fQx5~mI@8a=E~>L zl`dZXOk`ATl}JVJT~DE0c`S6{cMZATQmAU$5~~-&v;(n8kt{H%-#&7CRsq5Y76v)1 zad8CMpXgnO<K^A+6?NO=P*wTS zCYye7xf$~9+cvfyQwX{LJCxJ#ITc~KR5&mumtGeQ≷_Y;kMWbEuI}f`2K!!}Y}R zFnrvWJZt*hSlFW7xC;c_kI+S=lQrO$-4X}JU#`P>W6M|UKB{u!y3XZHJzkA+)pW$e z5xacgTcM<&j+79wYnhfnG8{h+$=7$uBpC{0SZBN41e8HMl@oL{{6>bBEg+Ib)0PkN z6w5Yw22X;0P9WMo)SGl#3Z9SFwmnXyH*78}B8lI?%I>61u9*a|ZrZ6G+aMNOpJ|V| zzb3sn;m(c;IBwQ-%Xj@1sdmw%O+mN(+S;qpnb9h_b$hu2@>4)t;m8VVWWsaisfavk zQAZ+&xSSc!l5u;$X-9I$Vd*Z=PMNS zs8;n}M@VUSsX_+;9R~gvQu^w^6v(QelOvjGImNQQ(LKY>6xqA#ClCzX zXF~N)bg_F%5}|$XC4*~dyGo;%052$eB5d24rVP`EN6w_>yljOP#81uP`RMv`QgltP zKj;`@=@xImb^lzhiSf_<%{;h$nEf7{J|2EQubzFgQgd50Gxf(dt|O0t?fi^(z<#J? zs4>!rz*g7TYN~(~kDA-i9ZK--r0KgDj+yc>%Zt0GWeTx`ms_yA5Y$ZBP0-dEo4-Q;>pm(2G7JHKIBc!({M6tp%=u`hY^4|$~iA?^FWfzM= zmldcxCZOG-p#i_gNBD%qWeEtG+m2W2@q;+Vtf4}kiorkES2?*<`LA7_z{<0qdo}*C zU#lmhudXR2HZtL9og~VdKfYJAmznjiE|)g${$Fsl^&W80H3z zRg68U`YhF0gzovLsZpmgRmV}(znCWm$D9tANf&7kxLIe`way=~&g=TjSwS4@5KQTH zV12alO&$3MabGpjqEpx5@TYY*V)jiMp0d=NzF$&nj9?q(bLPId-}^;-?eSgo}S;CwtV`s%EyHnBk#C3AGqWdDBqWvl`a2S17a)=o$$u>MJU@~~Ay*%mS>D@5 z48!L0L0SEydZoxyUYFAtOj*WGtpoc)^2UE-{O|T7CgqQ^w%(t3&ori8IMMX)@-sB2 z#FZZiEiV!*(HszHD*%13+4;(J`sjv-!JvAb_UY?YC+F1}`unAq9u*77-S0KmZuRPP zZ$$5xwHN)@TI=BfURlfyG5Q*Wtn$`g_Aj#%0W{^A?mE-0YJBBoAf@#7&iE&_0Mzn3 zX;}^YR?|Q0qL%MR4Y+EZN38{B@1Ko)uCvyCuj`kYk4~ecD;_U}PQhsUpGiR<@@drP zqrZ0AV7S1W`dXV0kex)qo*cj&0SX+xuG5ldy<+1 zgRGzkGu^Z7w$us~)P4}TG6T|3p;zvZF41(}F?LCajyPNanJ9%Wa_ghd?d=x|{atgU z{Ul@qELaFUWO1Bm<4r@#U45Z&!c;LAVwrz%;e{Vqyv_k42hoB*CTvNo555xxU3x7)S@)1V(d0Oe?urv zebtt$qr3%7Z9iUvW)NFfP}2dR7p2=doNt&yT0eyD+H1EF3h^PXavdaNkTB^QX9 z5@m}mEvxc)TO|OJIzkXvSfYXoEk#T7twQR`^IS%7u9Ou`tu#vud_9@CxEf~(wUXY| zQ$lgNNIu2OgKyT?s>BZl#q^AOL6jQ}I166Vz5UD{PbM$oM=L#Dulg)n|4!#z(w|i^ zdJf-f&r<)zT+RyMp2H=^BoX0r1!%Gz3JQtp`G(Gb8W~>EqM;9<;%s-V7X8l9y>8`k zu!Kctu%;Q%_%X&+v>H~0U<*TsX>je|Ss2xdS_`zs9^H!encO0tt93WAN$EZ-jIYFK zbCdu2`E~0a8v(nvHV+HeM9U%Vay5plz|G0JPYo3H`J{qAXY;oH6JiGQ#+a%YP&LGJ ze7X>si|q01gW}jB?dA57iN0O_#RDqYC^k1m6-S}4=y+<7WmcG&s&&rk?5it}l%0-J zN{H04B~)cgc)~~B#rNt?aPp5BkQl#T}9rtX^~il#Oru zZM`{U1x!-kwgq6>4cHV_B%OdAQPi#ovntUgOTQySVc=)88}LN*@FF^ZzT&X2oa5UN z)x2+#^Yia@+`t@n=IGq&KIaPGJ9fyHwK2=|r9Q(-9cVrB2M{!_`49ujo@lZXA6jT* zutku1h62|EOHn`za?`Ib5=#$9Nyk;B(8-%=hGw^RjsYV}?t#8hmni`5uXD@Qvacg> z482`TAQGh=ji6`pw0!pai{f5Ml7`qnuX05sc7&$%StCkpU%dM)4N|}_ek!7PVV~7^ zXV!(8ToiE854^Ibql%-){pru%;o$GR#oeDj?d{`V1!&SI(mc*xVsQz??8Lx9&CF2 zK8Eb*sIIFvQ#;~tvrB9A{?V!$V~;A#UEIhcI6LyN)jhlpy}i1q+hC^-s;@xpEAPmS zySigncI@Untee4;HXc0c4IAM14rgfl13Tp2%9thk#vNs7S+3da;}~A@g-bvkG5~7l z#zy|9LDoceCkFH=MI02ic2B^Eb`{7P*mLHoj&Ci*o^^LjTJ~LTnP{G67M{^6aJc-h zaTL84o&yz-_a~&pO;RgoU^R%+KX+mKu}^KFXYzweZe+`FDMySE9QD9_9vaaipFr30V?b%?9+gNJR3h5! zJY*tX$gk~)csoAdC-s;(uDr!m|JK8lD#?=>Q6~33QBr5K56Q9xB|Tn41FJK1qKvkB zwS<|TE$XC>DASz;iSyY%Ty$6ddbGJ(q8>w@CaAtb`>qp@GU$F9q&XdSLW}4v9TrBd zpmF=z8WeWx!j*Ni4az&@yU~~FhR|~Eg!TZJP2TG=`m_ELrDcD<*}R|B5(gCd{C(Xz zIlt{>|AxHJ=XFYsfD9g<<7@KpKrSXfZ4u1ezo&$0#O>P@7&PANTaROr%8S;g1jCr3!PknL#m##}+me31d zme#M=G$Dirb56Lu)6>&>j^${Sy8I$&B7*`gk*B)omVKy`Z&K|5#@izZuOHA>80S^; zz{rGUA-bZNNAMGmB()kcM`4;2!B8(`ULPGRD?QMHW10 zRz^dU_FO#Z&9+=43o?>fJc%fgL1A3c4=x1o?+Neo345*2y%V!l8p;tP{kxYTzGo@+ zfV@ai_^yJuQ4_wlK}ErA?+kfg|NUa@&&k7MbU79jG39M@cL^v?&aed}gMG)Cr1YTP z#4;!BO-#1=DcIl~KS-q-?(;gCYbz?4u}2a{wOnWs>K|4qB_u#&L1m z+U&9a%~L2+pZ~T+xg0&WZ>hBT?DgGSB3~?3 z<5}rsddQ^DCF8won}Kr2(*p4g*WGSa)jr$${zc3qt}RCc^7|}revE(cZ|PH`Gy5JI zoY|>+T6V|Jw!;SR-|Ih5Kb?4{_iN8z3(x+R;vM>YH78bl`J4A2I2s+ISMGW`(>wCw zPxo5gY35h2PhBPcFmm!Qv7@s-\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Salesforce%20Service%20Cloud/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Salesforce Service Cloud](https://www.salesforce.com/in/products/service-cloud/overview/) solution for Microsoft Sentinel enables you to ingest Service Cloud events into Microsoft Sentinel.\r\n \r\n **Underlying Microsoft Technologies used:** \r\n\r\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\r\n\n a. [Azure Monitor HTTP Data Collector API](https://docs.microsoft.com/azure/azure-monitor/logs/data-collector-api)\r\n\n b. [Azure Functions](https://azure.microsoft.com/services/functions/#overview).\n\n**Data Connectors:** 1, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Salesforce Service Cloud. You can get Salesforce Service Cloud custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "The Salesforce Service Cloud data connector provides the capability to ingest information about your Salesforce operational events into Microsoft Sentinel through the REST API. The connector provides the ability to review events in your org on an accelerated basis and get event log files in hourly increments for recent activity. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the SalesforceServiceCloud Kusto Function alias." } }, { diff --git a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json index 0804b2b57ea..b114a3242f1 100644 --- a/Solutions/Salesforce Service Cloud/Package/mainTemplate.json +++ b/Solutions/Salesforce Service Cloud/Package/mainTemplate.json @@ -650,7 +650,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"sortBy\":[],\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Salesforce Service Cloud Workbook\\n---\\n\\nThis workbook brings together queries and visualizations to assist you in identifying potential threats in your Salesforce Service cloud audit data. Visualizations may not appear if no data is present.\\n\\nTo begin select the desired TimeRange to filter the data to the timeframe you want to focus on. Note if you have a large amount of salesforce service cloud data, queries may timeout with a large time range, if this is the case simply select a smaller time range.: \",\"style\":\"info\"},\"name\":\"text - 2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"412a09a0-64ae-4614-aec6-cbfc9273b82b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":1800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 32\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"ae90d1dc-20da-4948-80da-127b210bf152\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"User Logins\",\"subTarget\":\"1\",\"style\":\"link\"},{\"id\":\"af58b4d9-a888-43ed-91a9-6e9f539a61d4\",\"cellValue\":\"view_tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"API Usage\",\"subTarget\":\"2\",\"style\":\"link\"}]},\"name\":\"links - 34\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"User login locations\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let Countrydb = externaldata(Network:string, geoname_id:string, continent_code:string, continent_name:string, country_iso_code:string, country_name:string)\\n[@\\\"https://raw.githubusercontent.com/datasets/geoip2-ipv4/master/data/geoip2-ipv4.csv\\\"];\\nlet UsersLocation = SalesforceServiceCloud\\n| where EventType == \\\"Login\\\"\\n| project TimeGenerated, SourceIp;\\nUsersLocation\\n| extend Dummy=1\\n| summarize count() by Hour=bin(TimeGenerated,24h), SourceIp,Dummy\\n| partition by Hour(\\n lookup (Countrydb|extend Dummy=1) on Dummy\\n | where ipv4_is_match(SourceIp, Network)\\n )\\n| summarize sum(count_) by country_name\",\"size\":3,\"title\":\"Heat Map- Geographical - {TimeRange:label}\",\"timeContextFromParameter\":\"TimeRange\",\"exportedParameters\":[{\"fieldName\":\"TimeGenerated\",\"parameterName\":\"RetTime\"},{\"parameterType\":1}],\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"map\",\"chartSettings\":{\"showLegend\":true},\"mapSettings\":{\"locInfo\":\"CountryRegion\",\"locInfoColumn\":\"country_name\",\"sizeSettings\":\"sum_count_\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"sum_count_\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"nodeColorField\":\"sum_count_\",\"colorAggregation\":\"Sum\",\"type\":\"heatmap\",\"heatmapPalette\":\"greenRed\"}}},\"customWidth\":\"70\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize AvgLogintime = avg(toint(RunTime)), MaxLoginTime = max(toint(RunTime)), TotalLoginRequests = count() by EventType\\r\\n| project-away EventType\",\"size\":1,\"title\":\"Overview - User login requests\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"AvgLogintime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaxLoginTime\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":23,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"TotalLoginRequests\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"rowLimit\":1},\"tileSettings\":{\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 8\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| summarize count() by bin(TimeGenerated, 1h),User, ClientIp \\r\\n| top 10 by count_\",\"size\":0,\"title\":\"Top 10 users with maximun logins - {TimeRange:label}\",\"exportFieldName\":\"UserId\",\"exportParameterName\":\"RetUser\",\"exportDefaultValue\":\"all users\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"user_name_s\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TimeGenerated\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":false},\"chartSettings\":{\"showLegend\":true}},\"customWidth\":\"60\",\"name\":\"query - 2\"},{\"type\":1,\"content\":{\"json\":\"To leverage infomation about Malicious IP, Threat Indicator solution should be configured and ThreatIntelligenceIndicator table should have information of malicious IP.\",\"style\":\"info\"},\"customWidth\":\"10\",\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\" let malicious_ips =\\r\\n ThreatIntelligenceIndicator\\r\\n | where isnotempty(NetworkIP)\\r\\n | summarize make_list(NetworkIP); \\r\\n SalesforceServiceCloud\\r\\n | where EventType == 'Login'\\r\\n | distinct User,ClientIp\\r\\n | where ClientIp in (malicious_ips)\\r\\n | project UserName = User, MaliciousIP = ClientIp\\r\\n\",\"size\":1,\"title\":\"Malicious IP- User Login\",\"noDataMessage\":\"No Malicious IP found\",\"timeBrushParameterName\":\"TimeBrush\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"MaliciousIP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}]},\"graphSettings\":{\"type\":0},\"chartSettings\":{\"showMetrics\":false}},\"customWidth\":\"30\",\"name\":\"query - 23\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAS'\\r\\n| project UserID = UserId,DerivedUSerID = UserIdDerived,EventType = EventType, IPAddress = ClientIp, LoginKey = LoginKey, OrgID = OrganizationId, RequestID = RequestId, SessionKey = SessionKey\\r\\n| limit 10\",\"size\":0,\"title\":\"User Activity- LoginAS(Top 10)\",\"noDataMessage\":\"No user impersonation found\",\"exportFieldName\":\"IPAddress\",\"exportParameterName\":\"RetIP\",\"exportDefaultValue\":\"all IP addresses\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"IPAddress\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"TotalRecords\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"showBorder\":false}},\"customWidth\":\"60\",\"name\":\"query - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'LoginAs'\\r\\n| where isnotempty(User)\\r\\n| summarize count() by User,UserIdDerived,ClientIp\\r\\n| project UserName = User,DerivedUSerID = UserIdDerived,IPAddress = ClientIp, count_\",\"size\":1,\"title\":\"User Impersonation from different IP Addresses\",\"color\":\"blue\",\"noDataMessage\":\"No user impersonation found\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"DerivedUSerID\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IPAddress\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"DerivedUSerID\",\"label\":\"Impersonated ID\"},{\"columnId\":\"IPAddress\",\"label\":\"IP Address\"},{\"columnId\":\"count_\",\"label\":\"Total Login\"}]},\"chartSettings\":{\"xAxis\":\"IPAddress\",\"yAxis\":[\"count_\"],\"showLegend\":true}},\"customWidth\":\"40\",\"name\":\"query - 24\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| project UserName= User,APIType= ApiType, Browser= BrowserType, CipherSuite =CipherSuite, IP =ClientIp, CPUTime=CpuTime, UserType = UserType\\r\\n| take 200\",\"size\":0,\"title\":\"User Successful Login Activity\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"60\",\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == 'Login'\\r\\n| where isnotempty(User)\\r\\n| where LoginStatus !has('LOGIN_NO_ERROR')\\r\\n| summarize count() by User, ClientIp\\r\\n| project UserName = User, IP = ClientIp, Count = count_\",\"size\":1,\"title\":\"User Unsuccessful Logins by IP\",\"noDataMessage\":\"No Unsucessful Login found\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"UserName\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"IP\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"Count\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}}],\"labelSettings\":[{\"columnId\":\"UserName\",\"label\":\"User Name\"},{\"columnId\":\"IP\",\"label\":\"IP Address\"},{\"columnId\":\"Count\",\"label\":\"Count\"}]},\"chartSettings\":{\"xAxis\":\"UserName\",\"yAxis\":[\"Count\"],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}}}}},\"customWidth\":\"30\",\"name\":\"query - 5\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Retrieval Events\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"API Usage\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| summarize count() by EventType\",\"size\":0,\"title\":\"Most fired events\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":50,\"name\":\"query - 4\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by IPAddress = ClientIp,Entity = EntityName\\r\\n| order by Entity\",\"size\":0,\"title\":\"Most accessed entities by IP Address\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"user_id_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":0,\"options\":{\"style\":\"decimal\"}}},{\"columnMatch\":\"entity_name_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"client_ip_s\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"}},{\"columnMatch\":\"count_\",\"formatter\":8,\"formatOptions\":{\"palette\":\"categorical\"},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\"}}}],\"labelSettings\":[{\"columnId\":\"count_\",\"label\":\"Count\"}]}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"30%\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SalesforceServiceCloud\\r\\n| where EventType == \\\"ApiTotalUsage\\\"\\r\\n| summarize count() by EntityName\",\"size\":0,\"title\":\"Most accessed Entities\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\"},\"name\":\"query - 6\"}]},\"conditionalVisibility\":{\"parameterName\":\"view_tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"APIUsage\"}],\"fromTemplateId\":\"sentinel-SalesforceServiceCloudWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel"