From 2b86e96b6bb4284ac6a756a00d2ebfaf2346a0ff Mon Sep 17 00:00:00 2001 From: ashwin Date: Fri, 4 Oct 2024 16:20:16 -0700 Subject: [PATCH 01/11] Added more analytic rules, modified existing queries, changed alerttype --- ...io_Firewall_Tampering_Detection_Query.yaml | 12 +- .../Illumio_VEN_Clone_Detection_Query.yaml | 37 ++ .../Illumio_VEN_Deactivated_Query.yaml | 47 ++ ...EN_Enforcement_Change_Detection_Query.yaml | 13 +- .../Illumio_VEN_Offline_Detection_Query.yaml | 13 +- .../Illumio_VEN_Suspend_Query.yaml | 42 ++ Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 17898 -> 18691 bytes .../Package/createUiDefinition.json | 44 +- .../IllumioSaaS/Package/mainTemplate.json | 465 ++++++++++++++++-- .../data/Solution_IllumioSaaS.json | 5 +- 10 files changed, 628 insertions(+), 50 deletions(-) create mode 100644 Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml create mode 100644 Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml create mode 100644 Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml index 1689d47d8aa..25d57e2b7b0 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml @@ -17,19 +17,23 @@ tactics: relevantTechniques: - T1562 query: | - Illumio_Auditable_Events_CL + Illumio_Auditable_Events_CL | where event_type has 'tampering' + | extend ipaddress = action.src_ip, + hostname = created_by.agent.hostname, + ven_href = created_by.ven.href + | project-away resource_changes, action, version eventGroupingSettings: - aggregationKind: AlertPerResult + aggregationKind: SingleAlert entityMappings: - entityType: Host fieldMappings: - identifier: HostName - columnName: created_by + columnName: hostname - entityType: IP fieldMappings: - identifier: Address - columnName: action + columnName: ipaddress alertDetailsOverride: alertDisplayNameFormat: | Illumio Firewall Tamper Incident: {{IncidentId}} diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml new file mode 100644 index 00000000000..bb568d7e159 --- /dev/null +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml @@ -0,0 +1,37 @@ +id: ec07fcd3-724f-426d-9f53-041801ca5f6c +name: Illumio VEN Offline Detection Rule +description: | + 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' +severity: High +status: Available +requiredDataConnectors: + - connectorId: IllumioSaaSDataConnector + dataTypes: + - Illumio_Auditable_Events_CL +queryFrequency: 60m +queryPeriod: 60m +triggerOperator: gt +triggerThreshold: 0 +tactics: +- DefenseEvasion +relevantTechniques: +- T1562 +query: | + Illumio_Auditable_Events_CL + | where event_type has 'agent.clone_detected' + | extend hostname = created_by.agent.hostname + ven_href = created_by.ven.href +eventGroupingSettings: + aggregationKind: SingleAlert +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: hostname +alertDetailsOverride: + alertDisplayNameFormat: | + Illumio VEN Clone Detection Incident: {{IncidentId}} + alertDescriptionFormat: | + Illumio VEN Clone Detection {{IncidentId}} generated at {{TimeGenerated}} +version: 1.0.5 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml new file mode 100644 index 00000000000..c922cf1c2e8 --- /dev/null +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml @@ -0,0 +1,47 @@ +id: ec07fcd3-724f-426d-9f53-041801ca5f6c +name: Illumio VEN Offline Detection Rule +description: | + 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' +severity: High +status: Available +requiredDataConnectors: + - connectorId: IllumioSaaSDataConnector + dataTypes: + - Illumio_Auditable_Events_CL +queryFrequency: 60m +queryPeriod: 60m +triggerOperator: gt +triggerThreshold: 0 +tactics: +- DefenseEvasion +relevantTechniques: +- T1562 +query: | + Illumio_Auditable_Events_CL + | where event_type has 'agent.deactivate' + | mv-expand resource_changes + | mv-expand resource_changes + | extend hostname = resource_changes['resource']['workload']['hostname'], + workload_href = resource_changes['resource']['workload']['href'], + workload_labels = resource_changes['resource']['workload']['labels'] + | extend ipaddress = action.src_ip, + ven_href = created_by.ven.href + | project-away resource_changes, action, version +eventGroupingSettings: + aggregationKind: SingleAlert +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: hostname + - entityType: IP + fieldMappings: + - identifier: Address + columnName: ipaddress +alertDetailsOverride: + alertDisplayNameFormat: | + Illumio VEN Deactivated Incident: {{IncidentId}} + alertDescriptionFormat: | + Illumio VEN Deactivated Incident {{IncidentId}} generated at {{TimeGenerated}} +version: 1.0.5 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml index fdbccf4e353..ce5498aecea 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml @@ -25,12 +25,13 @@ query: | | extend old_mode = temp_resource_changes.changes.enforcement_mode.before, new_mode = temp_resource_changes.changes.enforcement_mode.after, workload_href = temp_resource_changes.resource.workload.href, - workload_name = temp_resource_changes.resource.workload.hostname + workload_name = temp_resource_changes.resource.workload.hostname, + ipaddress = action.src_ip | where new_mode in (visibility_state) and old_mode in (enf_state) | project-away temp_* - | project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by + | project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by, ipaddress eventGroupingSettings: - aggregationKind: AlertPerResult + aggregationKind: SingleAlert entityMappings: - entityType: Host fieldMappings: @@ -39,7 +40,11 @@ entityMappings: - entityType: Account fieldMappings: - identifier: Name - columnName: created_by + columnName: created_by + - entityType: IP + fieldMappings: + - identifier: Address + columnName: ipaddress alertDetailsOverride: alertDisplayNameFormat: | Illumio Enforcement Change Incident: {{IncidentId}} diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml index a8bc88e4f41..8d6ad837515 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml @@ -17,15 +17,20 @@ tactics: relevantTechniques: - T1562 query: | - Illumio_Auditable_Events_CL - | where event_type has 'agent_offline_check' + Illumio_Auditable_Events_CL + | where event_type has 'agent_offline_check' + | mv-expand resource_changes + | extend hostname = resource_changes['resource']['workload']['hostname'], + workload_href = resource_changes['resource']['workload']['href'], + workload_labels = resource_changes['resource']['workload']['labels'] + | project-away resource_changes, version, notifications, action, severity, status // action field will have filtered ip addr, so no point of using IP entity eventGroupingSettings: - aggregationKind: AlertPerResult + aggregationKind: SingleAlert entityMappings: - entityType: Host fieldMappings: - identifier: HostName - columnName: resource_changes + columnName: hostname alertDetailsOverride: alertDisplayNameFormat: | Illumio VEN Offline Incident: {{IncidentId}} diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml new file mode 100644 index 00000000000..7db0cada50c --- /dev/null +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml @@ -0,0 +1,42 @@ +id: ec07fcd3-724f-426d-9f53-041801ca5f6c +name: Illumio VEN Offline Detection Rule +description: | + 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' +severity: High +status: Available +requiredDataConnectors: + - connectorId: IllumioSaaSDataConnector + dataTypes: + - Illumio_Auditable_Events_CL +queryFrequency: 60m +queryPeriod: 60m +triggerOperator: gt +triggerThreshold: 0 +tactics: +- DefenseEvasion +relevantTechniques: +- T1562 +query: | + Illumio_Auditable_Events_CL + | where event_type has 'agent.suspend' + | extend ipaddress = action.src_ip, + hostname = created_by.agent.hostname + | project-away resource_changes, action, version +eventGroupingSettings: + aggregationKind: SingleAlert +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: hostname + - entityType: IP + fieldMappings: + - identifier: Address + columnName: ipaddress +alertDetailsOverride: + alertDisplayNameFormat: | + Illumio VEN Suspended Incident: {{IncidentId}} + alertDescriptionFormat: | + Illumio VEN Suspended Incident {{IncidentId}} generated at {{TimeGenerated}} +version: 1.0.5 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index beb8586926dfd0d8edf63dcd214a6ce0afb90b04..bd50f128bad28a665d055733258f7a33d69c3d4f 100644 GIT binary patch literal 18691 zcmV)yK$5>uO9KQH000080BC|lSsa|2cs~dL0AnZs02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?OOeA8@UnxKTk2(7O-SUE8DrGh0)wWwVl*Jau-CZjlwblYL}8&bC-K0 z*NQJ^;GU(A)+gx<_d~m@Rct4A+_d*cVlO$I8P4aAq(43Z@cw9m1&^4w58lGs#Ox0S z*@z#pn9X^_W9zeDQqBE9Mfsc=?D)I>UO&;8=|d=%4QR$S;Q^UAi+l*!LdNa zGchl}aYUF?@e9)-j?I`fyjM(2nGu1hkm6X#O`t_$bD@6`(Hx8pUQ9}}Xtwm{!YSvgrX1MT+SyREJbJ+$o)^xk`MT~ z;9|b8<@fiKcoJ`K|EMhA-`<9|k~70W^BLD*71#xbnUYd1MLdTopDE2j#KtlyX@usD zk}2(GABfk#fBP4_a~7;k!r42X@g`B`yi;s8+vw)qSjxC;X_ts)qnj$rf@rfG1&t)DshkXZ%?Dvo(zl{Vz>-5zXjpDKMZRqDcxJf)Fg z%;c370lZ5kcf-$}{;xUHF+{XAHdU#GGQFU1*qUiwN*DI+!mqH-rS$8k7njZnRnYZ% ztCTY7w3<_^WWzaJu2LQFx0xwjBA-De5 zswQCpH-n^*Jz!XttTXCnW;G7ZFPmvG&qd$}DFTdFp*t^szpj`{s(`hb35y&HF+LjO zR7^z}a#yPUCPGSqf<+IO9Om4DuvyGezDqU7fXt%DKxu=jV%OE(c$dNmjN+nnwklot z@Re3+($t($bvpVW48{mmWvkN)mnYSqInPyDE&`!ao@1={v{~HP>)~mse?=R6mGF9N zDdX24>S&k<%rUE#tSwSXjs+?2jj4Xjgru$l)2o${3|f#`;ItP^b7#+Y`PRYh9SqjG z!1A!l8XH6?igt1~cMVQ=B#-BI(W#lP)Aeb4-QG_3+^gC5XRLF!B_4DImBvTC6;W;B~iCVKq7Hqp=6k0jFEE+Fld+C@O+5kLTW`zEczhH*D98k zFsMXu?A#Wyq?3hUCrgITRz2Xiy8b1R_aLY1!i(>Lun0;p z9g7HKiHoy2^mn%h#aL^|b&;SWERP%?gjI%j^4Qt>ILYii@%AU)Ru72Gt?I$n#OqBw zr%C(l^%k-|uLmcEv(P+TD+U#7t;$Y?B#W){yhO{@f)hN{MO6~S7|6rRPWMeXnk@&Az;V+siRFd_;W`7`NB%lcIq81j| z$GG?uANjSAV`hH&O%+qvA}e=!r*Gb9jpBDVK~E}+yqm5 zkOBBqXV8hq4n;Xs*H9CS^9uaVQxUQ_AW#PxI#}T}g1f#~v&(hmtJd*u<+VPleX;kT zULy%D~ODhf?93G<095o42_}#AC%EWQP+;)yhIsWUv{YC3QD@( zSSDJPyIX-Mb^6Ms!K{^rLX!?2vhZlL;4-27hB-DFqH+KMf5}gx*6q{kD-1-LbwHPm zYsKKk5`e?nLTZYcLXihb?v=$|*8SI{^}QsnO|fDLCi|$ez+d}Rpe2Qv|qGo1-9On&;lI$QBA_ zH3P)@TF_xb7559^&`@^6;F4{1xscx}Xr3rd>4q&ax0>JdZqvWb@AJ>}_wC!@ZTeH!pO1*%j&0(<80Sa%eE!ae;T`1Hbi?i zfQM;{g2EVtb(8Ee&6K_Mi+p=0$W>knwL-38+w5mTt~NY>4L{AV;q~@9@vIYgx1%ADpZ}n<3(_6%h9i$WD%agr8)Y>s_w5b7efG`z_Sx^gy}`H7zggct z|Nr#u`XSl2HK={d??O(y6`mJ=wZUl3D!y?k@k*n%aRqp;H85p6}16UWkaW)(rdUCx6)foV7ZOXdKQXhyEIc^V#-JOLlRgKq?YIK#HBnn+bHb-i8U8 z$JA|-(L5mmr7m?z5|Wu6$Hb1NR+3!7sN;nE=WEf0b#fWbeb<7f*3Z=XhaI_22+jVp zMaZ9&ctM;{+eN4(xuoPjZ^Gy*p4kqyB$EG0ZZ19Nl6Wz3Y2;l)m*Xg$vg)soNZMda zpnb>wy%Q5thF68IMGCG+r!(L-=xn?3fle4BgoJY^i6w8yDT#??k(eSQAfw>GB%<)y zrw;zsXl9JE-H_#tot=v%gI33C9+Q!~s*Lqd*%t`_L&oZ_!wESGZ2va#oET=0MwGnq zoG6ULaY9Z&PP~BnIH563<}>pcMqzl>u@LS$lO`mN9L-%Xu}3~7udY!>$)5uBGC8Uy z6LQqZj}qy{L+Wlkq+k5-hP(vSKKodD8;=D?;D?|CP7?cbOirqdukFY~Hc@o(P|E9D zKFBRqi#H2(l(nVT>WY;GD#-F<7mLK=;RQ}-uX}jV?e6t@dk2Rt@qHKz@hE}k&CgOS zw;NeWV@Im;t-1Fi494E%*zFV$Mt*^^0CWm0Y!ZB-z6xI{QaW%|FfaJBTD7wUZPktq z)l5i82=pUV#3}e7lonLegrk4L(HAg`%~{hNqjM;ghRypk&8-}Jo;*^6jJtwy`(nH#({k=V_cevlS z`klRjHF6GIYk$AnarWrA*SGgFKq{QYCP;~&j(i#=*iN!4@_D05_t~5mF!(G6iX9c1 zzTzNu)M4mmWTVC3j@D-2)C+{Ta46M=#5-&-X5-__c^}HW+g-xD-O9YnY7Pz$$F6hO zwdiQiwfdt$-#T#j53R1<8}Ikq_CbHoHu3Hvlc6H-R_VSn?>>q_q2b+XgQ(8C>lg?3 z%)6C_v@-AZmhf(`GVijQ)M@XJ9k*xgcl%?j-vvw$$Ag~L?spE_9mgJw_Z$=NE;1*o z>fH+6SLWSEF*bC1x6&Z0^X@u^!+q=BDnnYCcl%3tw_lle`sLZ>AO?h|l#CUh`mGJK1YvtX&CA_;=nRoX#<=wp}#=Co83GeQG9lV=%RUF?M z!;Ag3hbN7j8N#{r``V*@T7gjYRw+?_??wdX=VyMk1yj3|sh z^OSSuZoAv#;ZN2qqSqe1$!dyodGq;U$;XkCFeO}O>r5*LRu+h&v~%f<25$T=ND0C| zfBwT+$$qwTWlw1FbXH}8EUe}t9TvC*VV%Z$))|2gXN4&l%305Q_6XSNboBV#jLtbfTEH*gzxXLkr5F*A&;Z{goFmh5RcGXyiG+AD62bL_p;lj^6Jg zZbVxRDte_zmZ3J(q)0t4@pF+wOv<+BF{}aP2)Um8G7nh5T)d+PF`JKkFTSLa0!Cj` zk?S{hbmfLOoV23R#kLf{o12@K5)it(qlmnizL z#U?x;*^7e^t+C{mRo}TE#wgOGAdu^mA`j@XsZg1f#9HND!|L<`3@uO{_8M#@4W;8) z*gTRVMgm@ouws2jtcpR@lpmFluVF@BhZ8v=TAJqD!s?8k8KNK!t%`7dBK9QQ?zLUL ziBiB-r|&)=!UlXVHe?$6+V*^5(im(;T#XVtna64jc%gz9zZZu0_hfAQG1XMl%JUYO zwNo!fOI~l7BPx~`b#f{9o_9I?6eVjgn2b+4Bns| z5~U)+loSyV&r>&SPz4eFYwktV)mw)J^hICN`bk3*7qyL@a8|vxMCW~lxe-m+K%r6+ z&8ZnO;iRcj&!s+1AsQ>{7@d7L!Mpw0xR3#*}OQa(5*+m0|T*JC{GcdhQl zC3_wx;nciHFXUHg?_|9CCmrp^AcwKaQH#h^u%$nk)fO;RVVjSi9AIClXs2Jv(QJmv zWot2Lp@YgCI+iVVf#dE`AxHwB{PToSMQr44#|h^_f`fO_Spdu3?t1io_6$G{PhP$F z@apv0vnJtxe|Yul@w>Ofw?}VYWgmZg^}qNZ|NQ;c@2`fxe|Y`uS)S0VP@1_%XLH~8 zg2~19j~^&VAm|0=Cba_sZ6oI3$U*vPr$vs(0S<7{cL)66;? z?$o|YT~=c1nV;_ci&xw=MH2@mc;;aW>5p|j0>7(YFG z_V(TBtM7pdr144<`#!n=HZxd6GyTSo4e|<3)ZBF`tgoP9 z6eY)IUVLwz2j>BhX8YYt;DprP0U|MXJN0h~EHQusvMA51_x{Bd12F7%yhG5y2(M^> zzr*M_#;^*LKQLvqRs5hhLXp+6Y)YL=JMiKuGhSG4$ZZii>F6~xHwfD!0&UKI34Qd_ z0Ci%Xf-ab(lDePGte8gEo|F3>Z4K)hk+UK?hOKn~Qon=9U}}32f2rj1Q-ceaK^8W2 zP<2}5RS;uek^wpMj=jlTiZSv^rb(ICm?z#dpB56c;J4#^i)wfhB0s@cN0f0iE(OQH zigpYtQtGF4&Ug<^GJ_={rY7~waEkwmQMEP|#8{R&!{#PdRc#A>V%-+Ol>0cL5ji?~ z32J8Mdm@|OBEJB{moGk$?U(#y&KK$RB%1q_%@r~yg9iph=35sMhKpD@A@ayRZnEWJ z3g#1=<5#d?*=mn1(#i2!j?)ObUov)Mt7C!RXkg7_tr?7j-%aN5D~#O2zpPXNSV%nE z|BjnQ7H?>SJ)9x7L$+g7hooZ-*sv!+S6JeKV5c;&VP=nAvFgL87rsZuCr0<&*AuqT zJbNaoFSrZ|b7_OvaV%i6@}$f50od?8XM`(CX9V3*=txC+rBfa8YZQdbDgn^IMU)2O zR)s}-*6h^ieMH%^#f;Mjk+K(;VF=?0gLDKy^eD6)&@)`1MihA=WG#SWUx6B+QF{3W zFFpG3COan1ZjN9RsazYu)GsTMS{ZwT>P=8R2UsM>`+4jHSnk!PpWa50g(dM6HD8(XM70h&Hz|+G*1$s1*0W07yK_d z`?oVu@l;e)*1apcHI2o=coH%)a~M0NN-{U!QjYm8sl7pY?~wC^{VxDf5Pl+tXlgHs z6%&*k8bPt{T8wm0*(_Ro&rKX4R>F12D7>az)$}D7JbU&YIs$!wQ=bY;73S|qt0Eog8x}(m zk!|3)9g@aid~VTDOg)w6UzCjeb57^N2HCu05Ol;l*=i@Pcg=k{6*%t1urE3RKkOrA7^=ruu^n;MucIM#-G*`RtkCo|oZG zz^-J`>>sdVHt7>s!R8}ouCQwSzm`;HyODjfJGIds+m!)$@vg!dyJ(92k8V2)ZIPw? zyaT_t{^bFuj6ENWg;yWJ$O2>02BG(^nc84mc#LgF`=RKSD*3|t@VuVJT#WAunj4TzS9mOPI8_L4w z4#&h5!yhM%8<_?^8ly!Fiw?RX#&f@*Vi1r@l_n@8Mz4T=ObE9XQANo$1;KmC!)#Ta zJ%j0bA-5(BH7$>d8O{5degslc*gN=MaP<@034&z{%NJNg*&0lPYcC1|F2XVfiLW_g zO*ygoLZeu-u%sn+l$1yX)*dV!&<(JG*bT+d+BFfU@}ZdaexqECYxOQW%q!RVMM~d_ zU-Ew!Ca)B8w?PD3I-uo&bf%crw8cGz{)yK4J6tdT7?0z(V=%E2^Bp$gzKY#kR<(lT zvT!-TnMD_FeGOL^yLmR{_XgCk=Sb$3bSDqe38s475kQkxEbC}tP$iwhMrA2FhTu6k&c9Ty&F=AV~HlcvD zCW3jT_Nywazo`r;816puOiF9=I{76}Zw)pkp)3ZZN&8qg3&xZ#^3^T+8_WN)MSg?D zUB9R=Ud)#+;wvxS>iVEvtXEv5Re1VEdEsKb#v;6M@m+t>y<4c&K2vs2^{k!;$mUsF z-I%j?jGAa!w$29WHp|m&zM=G*#c4IA4fbYfH0z|#teG~m%u}#Qdd%u+F{`J;knpOSq^w*^ATL zN|U^PI@^P%u`LtZb<@=zGEL1qFALK_jA>Di%9`3#W7o(k3)~ zwSJn!H;^7tMKJFz4WdqectYt9tIYgLX%0_2y`i93jCRV>^o3=HUY)K`rz<>ay26SZ zkvc7*PD}W<(h@4ABdjPzPdn{kdAh-h!>!W_>a>EVl2)*3I>7_7{OkEb^5m=kb95vd#Kx_jjwsu7fIjOMbd>g zThrIEznK=WMI;P7C7Fmk$mYdq*UR=+doSciM#w$-J5d%WN79rpJ63_zt` zaO|uGp3<`~0_nc^^+c?39P^msJmbXu!Mu-r$GMK^uSWn#F?No}r-A?;A=E z_Dm&v?Y`*e0x-4FDtN(;-k=PR@$L|R7!wn@kAm<9*ylX{W>Fp1OPt*LoLX#i$jHS) zAx=5X+VHp3FXGerR^}xOvvtQSuRG^kcj|m((@!iiz`~57I^9JaC0UYfrPGO?;9n_H zREVF6WqV6lHpfGZ1gvCHq}q9)hX1hhx$Pa+K86pH<8bT4Krs-6H|Lxhq6oeLixt)& zR)zPjO!6;LI8E6+&(-%hO~@{68z;Q~thr-HE=LFOD9B98H6w2l%%>y7?G7iKpB4Y< zxydCf?-gXSL<0sY4}EHX%mcVnIc3dxWOKLOSTLQ99X6rd$H{c~5W8f)&PHNSfrfx% zW7Szdl`Yj#KeZY5igOTOhBrTlk;_nGF-CXy%n4e$d?DO`3;Qs3>|kYXc#j7wC(!aK zbHhE(vUa@HX89twcrayOUN;_GtAo7-XgbM|hhID=E}!Geh>myAw99ydwPZ4b-wO>{ zVG_N8rsxU_=_C2#l{ z9q`s?GX?BuGAzaZHpw%_FvvN2-SYf7X~fhS&O+aFZd?2~p}|>adTr5W#d>dx-N^X$HmVo#ix?~c0ZefvurQ+vXxibV2{EgnG7^ED`DF#*F z3FD;07mCeVr#h<|*&ksA;>w{Y+2r3qMVwtU_)%q+`cbU6Lw0uwYmy^-GQ?QjQu|c+cFx)tI|W2v;JW!-*jtEP z4!&8gUI-#Ui}d{RRJPE{l9RPaNtyQX#6{;tW?d*u-(4ay3tN>ezCqsNTS(xgmfzrh z?E8n7F025>+sfiSwG$SG6443$NE-ip9@D7xtikJU7k3cp;vPn&-9>9YbB$#@6F`C$ z(LF;T_P=5I`T6-4i(JQF_(_na2Ebfc&H}CXV|oHcOp zjSK!S^F`|A7eFZzjKC`iZd&otrEf(6$VT*}_+FXwGSlEGXt`XlOirWED>4Ivjofev zHTB$}aKU^b7l^~5Nt%2GEf{>0F?7TVc`O_*dRa?5xHW93&KG-DADExIg)Q`wAunUC zu4XgMSybI9J?fr%sgZ%!i%1F>dp@4*-(1>>stnmdj0eak2+#`%Y(H_OjuLL5*jE$- zfbq;m9LHp;#-(Ex>-(IvF`+D<%*Ub#KjF9U**W9r?2hgb;uYt$Iun%mUBTAIUJQ11N7Z@-;pB`gDj#01zg}O z5q_!!nz~UqBdoKGRc&4KR>3!da|a0S=kdDVW3>*Y`%b?*utuHH!0Oxk9qYh#de-5n z-`^kGopGV}XcV{sYIKyOcZnGLugX4V^y9AuDH9ym|nSR|ScA{JO{C zxLi!U_=5;{Ip?Qf?Axz?II{ih%M|3I=IPd1bA<=nuy>XhdUY1vQgZUOpn^4He^T;^SzhuRWm4OH=H^Dh67MFQu zG5jjrxDMBewbMB`Jlxys?ps~Dzi;(>2Yc3`)9qOuIvTixwhQ}!4qrPLEyOGGDsH{J zvM z4%ztuc%+(}S@C$`cy)wPgRDq_JX|&0u{#L(Rak}ZczjW8Bh-#)CH^XwDV-J$arnFx zHU)P(`IF3o+Y)Iw{>u%T%7B{!<0f|CjinhTjy@Gfxmq0KIcKZXpecvZR2=g|d9or{ zOL5s_6v-zh9^>jL)SxS^4 z&q0Kyu{-@FRTf`Q^E6(B>0(maBfbbDr_+29y`0lcpMfdl*!=yI1Pp@lT%QFdk^6x; z7k+_#DJH(i%CF&DE54rmKoro=A1Zg}2a;Zw`;sN>(ZB(?&rg_|ZM|c`U}qP+T9zHV zxUQJx<01wnaKV? z;`xX}|3Q)~k`3-!>J;j3y;JY}H*wI459w4(G*eQ=alagRm|Fplkvy+xLi(xR=K4+g`mDqfokr49=+4yg>Tny(k->04|AsOjxlzIyqEq59#YD$2R|=8;A>ubt7l{GlV+dW|=Zsy1C= zLHSzlJm}VU9^BWR2YAOgy9)2CzwDs7duQ_U*oH^*bYKje2_n%XJ;MKOXG$+lTEn0vXVmHjFT;vk=0-o)h_y7ARLC z6pvz#@X}Ux+~wU&>b9_8humOF6`fHsBhs-8)HoO$P0?WzMabj zj^oqF9*;d|rMTCE1Uz)~D^#UC-Wbc-Z{?_)*X(g8#g}}^*ZcRO$Go`m`^Q4SYfgIk zblw`P2wJ^JZ|X({$cM)!ypF}_X=&nNA1WnRAa?~TgUqZWczzR`lX7(PRkox*CPeftj??b~*#?Y0lbRu`5LtKS~=EW6$5SoYwMw%hym z0o`9`VUe^@64f)_OXoDp7*po4xWLH!Tcu-VV6)96_FwPx&u*>It!Cg%GJ^G8u>^X4qh6 zJ9ImaoT2>QByOCfe^p2yQyO|vq53h`1+oe-A z5QBf_80Be|Q=7#t6Uz%OhQ#f=gsf9!<@ zftAYw!k|7+qvy@#H1cn`__x&zB~lvvd4SfFxaOZSBTA%Zd$T5AX-hnL1damNqLgP!u!x87hi(l9UigUYS}mOqE|AH0$`eX;Nw#{@)e&}ss}4r zQHKv{MIG3qeTN>lto5#;Q0O0 zAW3FtWHZLO1>~)?w#hWVJi)c(C8?^=!Ml2IHX(RbsrCihNh*zPyr%ADai2fz&*>x<5#DKpu{1 zXOCJV+U{HZ{X^F}>>V6h?e^io>5lq6cd*Vr5$6ZjiUq9pUKX#$Y$?=7=C+xN?gQ}K za?X0nELBmh^9ohdZBEBJ9Jf0b{L<_8_YMz7{lhi5P1+*`ZhNnOUchCt z9y89E^G7w#QY!|Zt71$y^I=yxXHR7Tli;&6DVq`ByP{;T+1Y<=9%VF8chr(7Z^f<} zY`txfEx?L!(`t2i0szhw_le}o+r0QPoWZt6TSEZwoaszk-WBB&LwS#vPbT`}zGyzX z?rX~jB7s4V+#WAY96j)TUhItYtq*uHHK2AVN2V|C2-=NCffYFpz7?jgCny+P&n(Z= zR}n;<%?(`%BHGbp9_woeI?}0QLPJpUV?YfPErgenA)jC~$9YIsrXN^r@_LM3H zD1xk!30px{FG>s*B&WuqmCW>V)DvWd*&q3O2IvXOPRG;=VuLgb>P|7D-SPrMt)84{ zgJAXqaeFgIUoHp>6By|$2(o@OkfbMQ>KbU;JIFe)oT&+lAZ#-GkN?nXFF{pLuU-36 zdCso)^c4g-V>dFW$6f}(io&_bx-C`fE7iu4J<-=nscPy?P&JCL4HX1gCy@aUK~^`` zPg`FQbQIWnZ7=9a4eU3N%h{#AST06Z;F}-_g2p%AOh1N!pk-his5B5{oQ5OMH^7h! zlMxL;$oR@LR5(y()VTN#4wYI#7<@D=lWnCMEcANKyC5D+ZTiyMb^ThN`{&TR-h;8zF?`Fkr~QiTE#rU2a=m$xiN6> zfuQTPNwXeE#m62Ew#@ZZ1Vl4T2k;ao=shV95b&TL|!uH3-*UDG7X9gOQ5XeT!?o^1qi zAorW53X*cBamfA4JTdL{1jS<0yF&Qj6H)% z*O5CI$F%+E$PJ7W8Fz+q4->~uIGZ}Au2OTxutn+gQvGOPvKu4%+f+)y6o%!)1nUi~*scqcy z%MH$@35ML@#FySwzlG_@P0o$UXz$2fP841mC@Qx(Y#lISD|b2eWMbUobo%LXuh}E~ zgcbH!h#3FyBW~gada%zA!W+F-?aF<_;!6E0l>~wjjcIgEbGBNcF?_{97%YEkryyT} zuX^0xciIO|*BXz}SKYPuE!%bWtp3;?xclRdGwQ74tH#q);iA?Z|GrL(7C5YVFadK{ zi&J0*=P^#<_&pivAowNe{M{qzcg9;HTv?pE-Xd$p1Gut>12EU&xgACJZN9w{TxwiF}Y7MIdlikXn%if^*Z*z>UXGX9USxzE!(EFI~sI)mC?3t=p(MPB|6ZssKl1uSkxG0IVTcb0@Jj5Xrm^_GLj(Y2^~?aIA2ryf z08)gJ`dJ6~m!@C-S+wF7CM#pVI$^P=?DG!EDJcGEmrET_yxJwqQFf#}bJ1)S`+y@% zm&)6$?1xtpJAwBhPPzv?cuRivLyQJBG!T}zp%VW6du9zUctoNwg7bWsb+?%d)Wkf- zG%{N}^^~^UT2cQzbg1>rTatFfayQvRsT7>0C2zBr8OxKxV1|CkM|Mkba)l5VTFZIQ zx0pnf2Kom2F4!%Py6SS8i}3AR7G|tdd4qz=TRyMLwBO*KUK>4Mm=EzdT5JOyl=Zis z5_~Kjrm8T?}8|sc#RNW)% z8u_`7yQ|~w>bSeKypFrmieVjhmn*O1?sOIExVt*;u8zA?E7Wm!WwWV{yVI4|ad*WE zb=+O4Mjdxo$KBO&cXixd9e00V-4}Jrnw;?Z%%RSXz_J^VvV*h{3tK=3bcpv6 zzM*k!PdJpfq3jaxu9*k?$nGhfE@*C>T6k}gBr8_D6<^QN&+=kB4014Dpri&Nok(yC zuTm0JFI=9qc#0mw^)JrZGq?WJJaha4j~wOa`UpT*Tps}_HR>aPtWJFdpsP|J0TgT1 zM*xKi^$|dQ1W+FVs1@oX09}>(2tZS#J_0CJsgD4PHR>aP`UpT)FqGFv0QC{Td3^+6 zsPr`+0YGbfl$jLXGvc07{%`gYMdko)iW`jc&ssD|c5;w;JF^1>=<$4!%U@*G$P3?D z#n0rb&-uAacs-tLyHmTiYu9$k*^zF#Yu9$|+J0WUwl(FoYr9;bc5UaX)vj$;T)VdQ z%Vh1^u3g);YrA%BXXUkPyI7-kZL52h+O=({P`kFvHEP#(?b@zg+uw?7TfLuZB;3i# z6LWJf#PRW5-fiWYx!UJl`@Dr0B;AeIKJVJ+{k-;hYszb%cez6C^UhVPecr6N_Ic}< z$=c^#`@CzPckT1e%4?r@u}1ClR`)Em&)ZO;_Ia0U)IRUp=Uw}}zb2pemdW8Qo>X{p zPVN$3cNh6PP55{6>f_7@S&gs)l#c=5Qwov<1U+`eMJz!A)~0WvKO66z`4jpah2a&$ z|KDThl1^<_^D;?h@%OvC6EC@(k6N%+?!J-O?;g!SgdK*zbu7@gB&c|Isy@qeC_Gux6pjfB zDxgC^Yl*oau#NV_BIX6~9UmDOHj43=LP~Pk}61gV%sPBiY9G0 zj0JqIF^tlW03z=8@Q{8wQ2Nx*=N(Rb@cY7 z9y3k-<&H@&A*u?T~_%+uV_-?73FzFBOAY!tGTWv7V4WV)fGw; zF*7I3LQ|0K;fkWExQ1euO@A}%hX11ed3=;6kj5;_;J(UDoe#rL$ z+Noo>TCz&69oLreyCA3Kw$51W2cn!A^4n4NYojWG@D5PD0lb6HiJ2{6IpbWO5ROTh zvN^p-hh?yJi#D#%gD4JuXuI)AVuOt-rGr05*Qmo0m&iB?CD-g%wBc<$ z50>Hpa%;<03a4BoIU+8tkrj4lIc{M))&-j>&0tbxR~pVH5|Or-D_(pFmb6=8X9(NE z1DLRK&2)EJW!rUn>BU42k@&FfiID%ybD++%P@6ML5ppLF9iE$yUN-wjq+ z4tkp9AO(Q$SmJfH)P2dvzEz0!dmAPcp`_t{U~Wz28=aM2vy&u9<(Du4K0gmE%Q|Oa zm3eZ`W1ysLb@cw2Z9T^{aV}H(!iF^gt2fTmHAc8C{Zn<_e1v1CgtI#6*I@GIVjQ!_ z@Dh6@9x${=C+XLbHF>)>ECu)2Fa*Az0a5T`@5ZNJ zU!A5B210Y!$oY$vN83xy)3@7U1L@ytz{7GX<4JiOZ>fq{Cs}xJ10ULMFv;}dAjFk9 zxh?nFioE!0$S)ed-4Wn3gz*9I7#7@NjLH=~P0uymsxVrS9mL`E1{Q)=TC)U3I@sk8 z`ntKVYX~Caz=Xg!R_ZJJbyx;g>~21D(PKZfla=~FpW-lUD}e5lz4MD6r$5;1xAEuh z5iUK?xPKCPZsE=6FiL*Dl`0bW<2NeVTQe7YjL_s=p)i6K-))UA!<(N& zQE6=ZG0k6z&Iku8qb-#Qh%pE|BhMeHTa?2}6lBRG1CbLU#jEqyMZ7wDAA&(-*MRB-P9 zjM@9|inhCk4bpIQI~4e)x(=h7pxG6@W$Tn|#2~0}<$mHh;1DOEe<#}`doqM}@wRNd zbJo6qjS{<=f5>Wrnodj4mNdM`pX`YaB{)^Yd$|L+%$@?e{PF57`9n_0Q+U@M#OMu$ zVLP#uqbC3QnocOb((pYl6Xhofg86hrqhG>kY8ODx11}My31`9@U|pq4KfabewS9&Y z7?F(Mp?%iZ)C;`ne0q#dQX0MVCSHO-I(K(>mELHV!avAtjz@Tp{pkpiSmjq1qSQKg zEFsD|^v2`ul5v7g4gL*({XGyB8avCSPPAj@P1-Qqm$2qsXtZyYq#MLqN*`QG``@UP z;y6|oQEc>h@`=4Imo-?_*y6?~<_XBlmna3jZ&V7xcx4#~4a2~{#o8Hnl6UNrwqZAh?*xSG{{I%1TKnx{q<5 z(J|PorBmLeDH-<6tFtlcY>dsbF?tW4jggOATPGvqexi+@NCHNuoPd$4fqZ1&;w+3j zSsx`ALmR@jTF9>n#Qo)Bn0lylF_!dG=VCmuT#N-4bDfv5=vFQp6%a@jyVMEWiiRXNn`;=QFoyJZ}{aVb}=+yZd_mi(N{KbptjqUrx zQ+o>SV1GJ%No8o>KXKnVJQ5RO`#2Rbk$=Yo|NeSXJC?JdXxMoIDIX=SIr3rFRavQ+ z1EL@GQ2m^0<&I|er4#+`!i{8V#=cn?vpVV@dT_ zOJ_QXSQ^Va#n%6o(J(p%;^@GO7N8B=&Ng+ zX~}9JsdE{4z?DX*r=7uGw;C{1X36av*zThHdbO$IZBNDe^A8Yb!wza|>`~uc(uuhv z27;+tZ!9+1*csEFrY#$rTbRs1>R735^!%aUx9N6nhP`Jc5*@#PGy)xQ?OdHcsY1U8 z0#)NYlvsK2A1y9spyBosxNuo;X6>(5m3z7AFrEQ0{oO` z!CIYJ1D`(0Uyt3pJ2FX60&OhI9sb?v&mz+PGb^Eb|KAr7IM-;ECEkZ`^2{OKxuBtC zK6qHZ5dc&8{thIR1*y2Vb)0)V6Y3wwU7Ar268$=kqJs)Yl1n)Xb4VJ6osfI(_ggF( zn_Hq8g^>)Cd$oy~mCKM@B)R1>OhuH8ZP?gs&ib9-U+4Ea&-eAbzTfBdJg@H`-{~I@-Cvn!6VKh z*4VJ-nv``1xiB{cv$T!r16oRf%VYKIahIyB?@n0$)&NTAZsGY|H^)-) z<>RjgD>gn7dwB8k3nu98edTqKFnkB7)utwx9PF24(#}*=AJ*mjn7r;@|1P?Y8(rx? z{;`b{eRo&kbCJllL-B(GbT*it<~D7BCIY3OowN8rklDU@%15cH`&H25`sS&)&uEB* z+EcRA_vgpk^-d3s5`NlsGYE1O?@M4Dxe2fx#!9BO8#l`;Q!66vq8J6`oUveZij3PC z%mH-3-X=Wuj_~jr{*=n#hUoq=b`on+j?X%jU-Idlc$^Q`O5C$wGTf+BZ}(2-LDjx> z3AR>3{;fnrBE0sR@Cqc6Blj^7BQopF?;w3_x$ZdA2c@iV@NLBGRh*Ur!?V};KBQ9~p_txSldCe}pQR~)WJ)?jPGfx^Ups@5+nb+c_~D1}-) zU}HJtc#}{>Mro4=H*kIA8uztyur^I(?a)tL4^lx>`1mZ30_MiV1-eM(#tRz!TpIOY za4S_6nd1&6TG4!;w`Dq;5)0~CXPKpxw@%DWofhjGn#V@^omQKn2JjR9-Xn(rf<}Qs z@!nxj3XSJt4Ddds#_5E53fa^YSBwI4YKu`sLgXL*-WF*3pT(#Xn-Ccux)`OI+zR}_ z{$lhC5R5^kP^M$Ehk6U-Zu?9QTGDYw3P{XJ1u1fv1>b5}r!oLpUYh+8F>dvIX_j|o) z(1rc4i2f|9tUt@0Hb}PgXZ2sWWFNngwfgI1MjFh6qyl?iQ_l{vWI3+9$$Hg&PUB8+ zWl@v!8QQ>*GXug62`&w#5pW4j#P%bE6ZFqVSY5*aE|P9i4@_?Lf(ffg*uO(&n3Jshe4ku>+Za+AkYBHXH%v@66HNnM z@i}g+Q{O`fA1=RF@+@^~^kJuamqOR`D7N#U#{(nIMk;3WO~9J#h&jme43ML7c`3r~ zW!0E!!)U3pL;0CjdnD{eC=;q7|c;mWyYMBfFyOBI5V~uX||OL-Kjt#TlI`M?)E={FhO&(86l-Ec2&x*To`L zD9`V;hw$`l*TWLy*c(r%GeTQbN{u!v{X)lqRb*c!@Y!@|v@ti<5mvFyr*gMl7u;ym ziQJZR>$gz1i3eV;X~(dCL>D@^$Tf~&SIc#g->Tx(3Z6^w*1n(1jz{d}0F}z_m4_37 z4%G#OCDly53G^>s!;l@%2=K8W8Dwjv1Rex1tJSCH&0iH? zHBBuD0h{=I)6=k=2!+lz=uJt&{Ps;JyUm4^&~2;R=XkU|QCqOEh@9xZqlN^^|NoAP tq#y2Iz(fB`@=tca-zkKIDw3iF6r=wm3D|-GVn2?E2rO0L126wr{RJ4l_hkS8 literal 17898 zcmaI7Ly#_9%r)A!ZJf4k+qSLKwr$(CZR=^<_G#PhzVG+{^$qUe-l`0eRCWe?kXn_s zq9_9jh6V%#1O;@EC8X6`D;N0(3J9oy1PBQ8zpROqnURZ`nw6-Txs{!jiJKRp>-+sY8qXLWuQ%M^C0!t%ScL!SvwuEi)#J|N2F#(&Uq^sM))5iJD^J>k>c=RuSf+m6{3bE~Agfo9dL&EH&>!v-ij(zU z!tdzQq=_b3Z(hbiwKD%T3N{(*9xWv5JKiKB`D16JE?X|!oS{Q192L(R5?m;aVXOte zpTL-YNKr5;)@u@(x2ef!NgL$bNs}7`$k;Voui|$ce z8mnlRBgMpT962W?3jJ6GEt=DpHeD)qzD(wb@PdS)U3xP?jhLy%_;}ZRP^y= z+TPwwl2%jqXK>S(r90-X^ei0Y45n_dnxO_BhO~4m#stcVPa!L0BGyz%333*Pw7E+b z36cKq_pASYu8N5XO5N^#4u`E--RDokyU?vb?n=%li9C$?F%w0M+$gxo7)L}guoN)q zsLP1bX2wq8zJqIWg)7KVMok}Iw-5)biHgnX2wNOC1%cpXtJ#^Gi{WA<Al_atpFYAPvji!^T2>kpEfJ40$;CXMTnID*wbPNRp} zD5PDpq|;&fpS7HGFk^02Cg>4p#Y+At8biG1*KT zeZ(s5jssF=#Y}|vE!|A|ocaqiMFk9jqQ=avW4X-S(c{@?y<45}f1bvas+eWG7=`6F@``Tg zN&vmpkLn0Y9NuK&8ZO#Sa3kl};`#Kyk$sswNrB4f@aGqQl*BQ_3uHcJz2eVy3+h`Y z7t_A5?Em_{2w^>8OE0TixQhQ++z+$VIk}$WJeTAek`*`~VH*${q)AlDnB6K%C})w2j(OT7{tTU zCSdb0IUc}MTF$I4t@iI?@N8SPeOoY~w~EhiI`T{c z?@@G!6*yX{eomDZ4AE-pOdr{^g{vG%LPK^RBg*Rd0;~=j9Nt4Tgik`PVNDB1G;u?n z$d+E=8RA(agH_#_rnQ96$=hX!B6kCa)!dTLV=90c|0B-=TLNwi1ejd{tKT_z(5<1PY7lh_6p0e`OZ1z%72MJWh@X7q)ZQ1g!31QI-tKAPB^V&QYAZpkp&|f37u#R1oR(5ZY^l7Dl+=OJxJ~o zzXMMQ-a84NV?ZDM{2nFirnJOc@x-nT_*KrSt{S z<xdMSE3)d)XrBN1|HF#20@$CkFcX7%knmzh3; zUP&9uh{X~pf;DXBJ&S$<9fV)02WH%!>bQV{;uf4rmZ4LKG3*yt5$lccmsR06sq2k^ zeln`G1(s_ztaK=v8g$&$)`ym#)NA3IwwJ+^tK=@7uLYW4p@`2c6%MlJl}UuIE*+3P zg7*Be*t&eh3X(B0ol845CH|-#ysm%eGh&wx{Gkopie{iZ>-u>f8|6D~Ks7=*LZkeYTwDL;2YW7V^C)2EoKW^n@jdKkH!r;1kIkpq+zqR3AxwP%5djj z2eYJzNQ|53?xSz69QSBp=Qw3lwU5Vhe-sV#VKmt`b2GQPV}jdob9e>$=GZs@Hhr*6 zCQSWD$1!HuAk?Hs`3(IuFvSy4k%IX>V;bLZMH}&_7L$XR7b;0H8dq^jFfq=Fzfq{_!gB7+$R(7gpwhlJ`fs6kGD6W02owqug_Fr{e ze?a3;?Ivc~%>EnIld{TV$zw6@Ns$UynU!=~)gp-r0PCpbgcN**xayboD}^nCrX7z2 zB5=hNT7jhb)7?lpAozlX9m^-sx3BhJ#+caOm|UjJb=jCIsut`4( zrK?cj7ZWy}HvxTq;>hbw=(v3rzW{|7TI_IS_11EgrQnz1arpw*FT}Z53seR`W5Y{J zIP?pFNpSLfzL6ZsfeBNXkttrIIz^jrQ(&x})|v`WQ=vCj=5i+?cT4>hs*kK)8Q9>M z)IV^N1(vv7*xf|Kl$gThN&aqA%ek+A?pyf_ZWhRq!&?6m@{1hUceejV>C>BPI%n)R z7*jly`N-n-hea|)M|Ru7nMWcc9ipsB3Y+{LYc!HTWs#ycdT})Vy2QT)@M4Fv?6DPA zzLPNdw~?$t7jE=th229k^$^KNT>nue!A3nYSTl0LRvvH z#yR0^e#!51uvU{q0UozpN?75;08ZeWdyvDUhf&f@Ihk^1s9~8Y(fMjRVhiyjhZCkQOc0HTm=4(UrV zT^eam{nfb0MWUIz!5yn`GK2#7uUlhM3z=({Z6mP|ywbt=2y@@DN1(}dt2gBJi+*{t z`@HqT?RSRroDXEpw-)!}jJWzDP#`hRbdQD+2jVA)kMCFqv@u?8-tbUyNk3$PM2lmP|Ml z_wv+wN26`TQztDzA&+guLR`eNv=2$yXrgwiP~urBb`PqD)l4l=Y-XIu)XNhooRWaF zo^UJk_MLUAOkERiCF>>E>CqS3yPq6nas>8jVnK1CI*e0VZjWl{k30w!T@KzjVfT{~ z(vh+3^>k7Wq)g8?cOA}$QMX}NoF~j+x&08ifZ=)eayjRJvjwVIoRslfmN%* zX_ocLWSgm)Mc-grMZF1R>lK*OeITK2`Lv;Jm@1aYa-oN_Uv=zjG7?3Kg`8umj`W3# zv)q*}Dv{DW3JKCYu$3vXUV~ROidLr+%2pOksTd2Uk4N8QnF{=HKe(#MH17M!Q_kR4F^=Ug0`O~PM=SB6$A$`2vr#V_grMW( z8Vu_)C=Oo!px9|p7-_qe^z+BshHDOLZ*fs1qH`{z17>{jW(XXYF_4k=yjQo4cjk7USlwLp$g$ z)@6Yi*UOE=+(MFr1-x>H@c;C9)KuSi>^^nWB&tKD22Vg zPF8hx^BQ_hx2{YQ+*oBd39mgy{a@$pO!0$MNd88T@M4-{^i1HgJX0IH_D%c~ z9=3Ai&WG_<)l}Sz=ha~@Hu5>^ByZaz*$L!INcugb9%E96BSfJvjF0d8ndTq_+fx+0 zMX}EsS@n?Kpuw8(I@_ofNyx|13ZUcg)@Ce@nltnoTwjL1LWqifm%f>#e2P!n$4H+{H18|b*QD!}>e_1PkPJ$9I9 zb+p`I!rI!}P@_bqgA59Y54Oogk;_#j-<=PU2pm;_k_iCZD9$EA6B_;Ixy&&N{`6o5 zv`J;J17ENLyepZ@1}DwoZ7kApF%SspG>KGhCWqMEocre#u0n7m>QJJyriD+D04d?F zBrh!TTIT3*I5I+n5l@s40%nYYWL@)LE4?t46>oz{kaI`k=BtW!elfZ8> zrd;)G)}cV29J%1J=?K@U5iO5NixWd$&4qIt;(t@qc3of`zoNLoJx|d?oKx4_@wcX- zVbs&`3)k4S2!OSXRlXadI02!P4;#qaI6UcVe@GU#qK%7fS+3!U|4VBy{5)+Pi9S|) zisn|As;*kA?cVWR75~GeS-~JrNy@ z#Mb^VOnpxqHxkWJd4GYYfCTY;kf{+&>3(LqJLvin{mhg|{wftp_DofRNh2Oi`^mEB z5Lr5_&k`U0*6QvZ0R!UCF`$c5Dcc@ahjY^d&T4(W3hK1fD1K;0erm;%Idrh9WdA5u zlVd-+TP5Dt%$r}s&jpA4Ms1%Xd!)0VNf@4i|77#S*~IdbNohsJ`3=Hy2$f+JG(a48 z7XNQtC$)jNyEe5&RlB9Z`*Ae(H&YI@z5KyI+&)Rnx!ChP4)#(4H4YZ!)bN#N zK?VFF@gM)$o`?<{-zG-j-Au)l#rd$s(MC|n_=}a1h`4H6WP1?`*w!RVacM)9vo@W| zBG|@$Dp_ASvg4(o>+qtKTn{*!^B-Zm8&Ou~%7M%fU^aT-zx2W?LfoSp&_+W4?9Qg= z6$gjPfuj_zC>hC#RofwnL+UJukeuAWg3}yXU`qy7u-Kv+ezTGp@AjWsf=>{!;L(Dr zax>N(Zs6;WZij?G*s)l6=)LQpWetT1b!e1cgiZN@l(wFTd>~;|F)K!x?Jk=+p()64 zJ-N_Xh??eec4|AwdSazrl_!K$d(6f7D-Jn-tJT!-28!Q1E0-lc-N7+jjb8YZ1 zuVWkn_`Ywgzn2G}92;W>yI%}1V*>u(k6YP4_Jn(U-f0pq%^BvF@s-#RZ%Cs@0L+gi!R?#%tTb9vM0qp=t#hNk| z&P2A@VK87ZmoLlsK*v47-#&)@dA|%btg@8mvH6;4+ZXs%bBy=%56S4Dqwv;0Ol%Z# zH__aSrqM?vXw5F9Oo5K1Q%XY%-R}Lp0w42`oEyedgy5Ou)$;DJJh3NZR0;$3q_T!S z@0G{5Z!5Uw7k?r_qj{ehX)IvCWDZf5EdiS-n}jF)Vl3Qg$sw|9Mlhc5R~z+&@_W3H zx;b&cxS50Y5Y0-H)as!Aa+T1O7LZmjEZqU9Z~}O#I2eV+&{d!j?V0(4YQt^^ctUF6 zqe|0l5t{BpoRQh1)l81`R_PWaN^*lxVQ{RWJ8a2r(_D#|?mgshJ*q9(LpP z+}J%P18@)aUm@oDKO-g^A)F>WcZbj`e=Y4Lod@6yr#g$gB7_uD1G1aj3**ZO2IQxe z|8ZujqWmmXVke(XIy?0jqZsQS>`zC)9Y_)Y{n{TGGCtRF`Vrqe$OLa`KK4!PsxNt< z0@ia2gv9#|XY!%_#GNJp)NB&X+k$_wMSL)517cj1$m4}csWNT?6pKcE51=ZLY4f%! z;pEd}pMm5>)(L_5aJ1yc(0;Ltb9T}o#8vjrEbC0PZrB$ZR_$;y5U_%Khd6nC;2+E{ zym^=ASa(4HYxVp%*{s1+z})*o)F2u>dh{g)%)0T6YaPBP*V7|_f-|Ray2$B_tTlL@#}PAvQ*z>tF4eRNc+k^YHL8io_dFADexaGcdzNU~m2iy6o^8MQ zOUbgU^ALJmxa(<+&{$ccVP-drR`Edf4SS$N@=}JwlLVc*-~kHtKJj-7Xt$m914jd9 zb9vBL&eS4+7~6ebb{NeX-isy{5O!Yk5C^I8WkDH?EE8mdb7cwIkz}226d-t2QON-o zewp~TObHlSXcy4pj|*SN&1y%iA>AROTyP?O7~8vdC&IY^BEFCoaK&rf1PH;}KN9Jw z1b#mGo~6yx>RlPi+BB&{Euv5sSMV=~hUT9?a%43<@_KWxp-FpZ%MOGjMBkkcKmeWt zcE<&QKUWQmB4yWw4PY?^_IP?n9Y;Xcz|aqRHybSM(NE(*CEOWg(EGuMsF83#={euu zF&ezb=%sXbDBI8bETiy=qX1+QMnf^pDayI4XgV0*Gutwo0~z+RF=%; zIZ}JU7oxMu={nX7L~R_#8%kuuSHOr=H~wY`H(ZOpJR<-EfTM3CGzUB+iW2Zu=YAx* zQ%9B}luy_PZ)f^>3o;5%gF)_3P$~5b1UHF*1||Yw73SWs6hJ9R=heO)q>*7nvStem z_Th+#q*!=VuJV~LE90S~$+_=_12e4X$=J-pj6j8TMjXunP^_c3mc4Sf1oJBi&c`S43>N7E+7Xm0Ahh_d>uYga}fo1Lv|3-%57xH`;*Z_ z0gg>j-o`ped&crMZMTxr^j8j%@CniDAmB*sC}$9qfrLrMmhe#*JH6Hy-k45m9z-T- z^JOhL)BZW1s&9(AqjQ%rg)*mV#2E^>7Tq^MqK;FtasEuK*ty@?`-*oD_p^_fAcBbR zF?D7jFNVvklZmtcqWcwyIa*oYjp*kc?tM`w$0d)+FuB__`5n@R4bN6b<)Q{7a^+Bm zG0$$9lwQgQlz%3X!5ON>^LGcHJ6$wO*PPX^qP83{UepNop%WML`W+;@G*wT`_#mL+ zg;2A!JE+DBw?-tD_z~}KM`4szepHx^rz}C`%a!i>Q|992V_8?KR&|tyT2Yj^@uT<&7;(Ff+(%Q>M}rvy#wP@tPDVEv-q3Q)V*u&y@Tg zv7&%olEWy?oYp~XzqJ;_EJ<8GCvlg=?L<7(Ng!w%ztMdnOe^)Tki0@TC)g9tl3?T4 zGvJoU9lcLkX026tuEo%W~((i7g{}s zb^RFXEn%n;j5ILI63)~xy_aj80{h21;oa3bSG=O(QvVutGi2g%Zc<{f!ngByTgEqw zzVlea{)?riWh}P>`EqlFVRJHGl|%*R=nC235><8VsVWA;m% zh@KPZNr?#$tRkvZ_|EOFp@csCaL8IHZ25`zx4AsG)rtfd80R5IV5 zhhN-WGAdZ}e|xS|+^thwhwXfTq6-9iV#@v+fzL?`qCYy&*F(8KZI~;Vt%~4=As6dh zDZCftXE$j14qJG4nu%Mj-qh7KypDOc%k_a@_0r{)D^-AW@BTk4csQs6gSUe2uQk*@ z*rvp0_d&<|v)~D1OL~P8|9HZhV2qz_J4{$^?<|n&t(6qKt8?iWZN1$&@EA0gz`GCh z=OZEP4{&?OFGh+@cmUPa}d+fF|tE8f6aXmvD93T6^J>k_mg;U&2 zT)OEt8+*Sg{=JUWH4+`aVOFU9f-2k!0Gf$wEu__z*7#WP20V&<`#yJH!nBrI>%9QW?h4(Bj(rTkVs$ z#aq#kzsGT-R~0-2KJ1djAARUy)L|1lwjZ%A{7hdAznSy^=f}WW5-PU-w3W~Cx zjsb~1SnX@~*lf3li{L!N^#h?>8F6@G&b+6|Z8pt=W=k979GxCS_Gd2wJg-40d%7lN zK2Xc()xc8iRRcJo_3Y0Eb3{I7O>~jX8?_vBTF4BP;D17T=2`qcPFjfXqFaW=2fF8} z68pn8x^UJcO<)Ci!)UR^@^scs4XfYo#dF{S!HJ7V@P(uY;Y<{tK{e!Q+myCzU8$R^ z3crEfh{*Axa%{iwMFAUP!Fu0mWO-D?7A#M2j={yeiIS&6U-3CR`98w1}`5piRGV$ET-; zW2`gax*Z;&RuUIziz0f+)go*IWgaPzBLpcH!@hQG=tC0YK! zDS$z!9+aapbi$m^G}8bZafPUxQnq{w9GBGDbmycAsV6Nlnb{@CEx}J?6{` z$BBed=zd1+jE1y1+>*lZ{QE8E3#tB*y7fIGAbTspK%>}43V$pH+whITG#L@0;5(cy z<+ash4)N2+dxU_{vu|*RpfH7iSSG~{RPN6?5WxgzDP6AzgP|zNTe@+Le<>0h*2W5t zq5G7)Fk!^kPr120uvCL5P+cIqPUI1PLW}2%0{T90cpBOpx)0uMr|{_K(c`sJi&XUP z*05WeV^nR`9?b{YgRCJzx98%md+pew6MW0JcG)0T4cD$VKhr$-x$&Dh&fH$Z+t{u& zy=gjDC^gD)@MCpNzX&;h;Btyvcvartmgmn%xU{h=55FPLjE^bJZ(%&(;-=OC(E<+v zSeC*n4EI|Kew+>8S5shb8$5-1Jy%EhEQa( zXr0@&FJD|9r?VUtps{XVXP?X7lEeZgU+^uzSyDKeZ;6Wz@kMNN9mo4DTP9RsZ^v9e z;TQ2pSNOAMeLZs3j5g8Ks<=~C0V1Bry!+P$x8S8fjR@7s==(*)#-$e~A<%SKM%pG! z4OEubOckIF0lqP%&meyxDDmm4?fzA#yNxt2WqGdNBHAWIY|g?MlUMh6s4EMUxX{1z zR{>jeWe;dmdE|9dsr7=NVai;n45{e-qo>C1q`gF-8?)2tK51C{o4r$b9e@>#6c{X@ z?&1vz*|xH2AeQD^)Fe)^=y9JbhGXQgJ(g(MN?Jv>z(E-~Iq-`Ev3YPZwf-|ZKe+gK zOL<7?LBE}bs!s8=nJ9)5v2s{%=(|OYhQh2l;0pWAPD8ID^S1KN%}FtG=$XZIBO6<- zh`+~^8?0|{U*C&(@ACO+-tOFB@qz~x(>89nwqx7rfY7kMtJQ|gAXV-06!bQprA?zk z6Zr=pxhJwH0V8cGF}&Oq9?C0-zEm-!i#zf9bz8l@`!dVU+QZOos~3TQean1oW9RmX zc8sid$LY^hIEg&pUOXW^o})b-IV0mt`PiDD`JK>F@+mwA^48oLbI{=5N9QWnT{~Oc z8+f>BXZFmQ9Q+`ht#d*LpT9P^@b5_JzdCh9_LCsuehlaaD`O-LbJCzmqn?dsHol0g z$}`inT0IVZ)PQjzb#Y)m8>VhvyRUSZQzxgmfQ572U|Ys$n`y=^>>LaQ-Gphp z5@|kF@?OBZqp;T3<27CPh1MPeOguRm3^4baVAI*DwQZ^n3vAahiA3*Aw|w#42YwZ+ zCAy6f= z$CR?jE6MoT%s*xTw1UI!W(hdcECu0aGezsjeIs06@gX9P+ zmeM=EkM*cV@hv>`Q}n0wNuWLeys!Se8JN@o=q4JK+Buuh(sX?TygE&9T2DWn;b{SE z+q*F%zlh*87juAfX7v>Uy#oYZxy6#W6@l7G>ppS7zn8|zhQb8Cj_TJBk-r-_I4;

vw)wx1&JmDj&J?6HR z)9?ecIAQ!Led#0m=uo1o&fqEE9dR0v`2BB(4#2AvW(yV>fEy% zxXDM#E1_C?>vawIIV1SlMJMwD;|et?Y-B|I`dM}br2zC(rRUcjW@b_;9{$_U>(1+B zkNS*2FsAi*0b8-(iF&QGC|8>Mn7wBB`HYQp0wIJnUBt0n}U=hYLhenI9bsE8r1Y~|Z$kTK~Q(0jjWg?PN7hf3T z$gU;8Q;0;awn3!~{x8WLopj?w=T%X;KQD({CFqZ?+x%R*bh6Z-YWsk>_=V&wEeBGoL?sz?|k%ZFa;IVNO9KlVTjZ%;%vu%Pb2Pk zc4JZ>8llUqm4%q-RfJ5AMA|}wWgK{R!eTBXi|eo$9zxbOxO6@`ub}C;WVQTgIuoE$ z^~scmv<71R$bAx%8c+*w6W8G*H00FeSrHo#BpB5Y5=k4R9`Tu3T-c(8K{grd(AlM- zfSY6^>oz(iN>)|}#YIQPxe7^_d69^1ZlEa%QoG|s|1j^Id z3sGn_4BaD5mTJlizM2Q4o_Da5SV=rfH1089cp#r()u%%@@pnWHmcDqUc#_&V-2#g+Z+Q^qkhhiffKa;x5(I7-wT0kHI80rx1nUjMsQL4B6=#`+}4YvvU zQ!Ou7e9ba1k)91a0S(jo-8<)-eCuwL;d0Zn@ui8_ft1h9}P9 z-JjR;V{KbBNCX#(&LOYbhqsf<>6j?@B1;9ViCGZo9MBW&?`J;D3421kx2VDQ3I@H)nNZc*JvkiEJ13x#!(+Si zRlkB;u0_;jT7aviFfXHT{xPX_fjsX zBBkJjn=`9DDuoxLtNR1tv^T+wU71Qw6RkS1jNO109}{mYs6-#Fxw6J=9E@Mf;=6K5 z(9#-~)D0|rNChV$j8#?-TAdPI4!DqWQ{pvFJoW#`(Dibv^R>EM!yIt+ZmMYPpT+D* zk`VAP&+X^XoLah?JU6*=2}1_f zroG_hi;DPl8}r~+M~|4BLi8bkNLcz@AK2zs;ozkQ)($SxOB|7gNJ7KIH8NR+4&q9X?*M;@KUsxSc_y+t*pHtYSYni+& zNy34^=``%Yy&PLK=7_7nRI(kz3fMb(dv;~6qIj`_*Y_4K{#v%Vt+FohSgCPT_>Vei zo_OUHH&KjZGj145l)l5)(h~q_3^ci9b&P9GwChrrVf;`ek*ZCb9}E^OE@|hSEz8TA zufdSO#@k?pago8Z$f>M@kl4(}@ib}WoV>!1&D)c9N8s$eAg2i_7Y}R(96$)I`)8>P z(G#et%95Q?C_=hE44_ctR7;99q;Vd}O5j{YfyV5u(lv1ocGN+*9|9e1Xd~fyHns%~ z?jslJe~uW!?P~w73>-05tOkE%`t&PBv56UrAW>pK%5=_;Ty9mtbt69 zzM>qvRQ5m~O2C$!iqyDUH05;^GVOI%1#{uk1 z!w67$-WT!u>NqYJ!udG$9H*-VN$=4{05L@bxhV2=gCJgBqgF zr~KuBRrWCPX4Te9pH(-4M_~9(UAI6>PGDZ=X!GG~6m}MnG0|CuYWw zClmu-cQ8pVSa(2gVl&SXJX#&)tX^&++ZHvibbuBj!xd$d{lm4{fYl}D`)9S-4vY0o z(%+lf**m@FiLQ;3(;M#K@9)BmMw)(C3?JQwdWThv8@EA8Ba8)^ojqA9r%@+L?} zE&aru2<)ry{d5=hse74K8+1P@9flDGPr%w&6NcY}#HDe`!5k9dJ0|~T!^?H;B(6PU z4gahCi`CVVa(z!@0qb3OIWO%4CM)omFU}wLy>s%Il{4}qxs6`MD|fe6)gvvE-$a4& zL18IPbInv%d zB$r~+2`VkUA>SH*F$E>KP)g!(S*5Ia#kcMjk7}x4a#W0zpw_l^?N5&ODw>a2eN)hu zRQ-2}z%1i@60{}^$6D)w#T$#M+V!+5m%cM#I0uevenNzEPmoBJWe(I9O&T8g_sR(Q zLmUPoSP9n|A|#1%cX!ZuVcsrz)=J3cv)AIRj?!keU|?Ixjh5tsKyx)>&UIT4-(6#D zr_}A5`$pdErvB*W;jH5522E6XY-h#M-E}*68u@>V{!jdW>;Kn%-FI}?GDK-7?`I^M z2FX808Wp`mzuG6^PZDdeygIdA+G-{}5@3+NjonP;f1p{P{Erham6O->{i|3`-*5#{ zGM&g?U<7L!fN(E8^hz3M`vgBvV=tQS;XVU*i|O^zE|(aW!|D9kt0Zp(2ToShy3)7zyc zKAg$!GF|3%2&Z+!oz~gyE}^{rKfQiZwQZhrw@Ixt-EE$0?6;dIdRsl0>B|@Y-`4k& zzDzK9Qp@J?NP(W0ljv=y+m89pBe(8;G*ezlD9*|LVK|L6>Mc#KLWtxA(2pCES?&#Z zBj0Sk-^~;#m=nU%U%dadxQdwol(CITF~{cLUd8m7^5U}QIy61%$M~H(a6jKexMTHu z0>bTK6z>tR4k39^c_3J?853OWG}lerhxYO$P6tO{_I^luC-Q%xn!iS!O+ahzC#m5o zCFobVx|>Mm2;N9{ZA#uy<8SdhV{2i_p!@=7;DeAjHz-%TXZ$p?RCGa z#WslT;~=eIK!8sGeS5;vCqqMk|EG-=5Bw*lKHTwmguown8FrtikCPE#9RziaPDly_ z4T{Ir!Q^2ecLuhKsKw_eS4Qd}wGXt8Nx?AynS2rs4Aa>Rs}4^p4dfrT5Y*)p8BhKa z0WkK8^2)K+2byBl*~3*Wfu?PMjZ4^wh0}vhhb4smTI>EZ=Ej`15WPZG?`IEa1`ZA% zHhQA|yUTujtjvU?NMI;CQ%yB!>5<}jd9w8)cBD}hh5^yH5jHadz>LIOLE?I}`ZR13 zmz!Ngk{9+b6G;X%;Whs!PA;mfMD_p9cpU)j`fL>e70+L3F(Z&%pN%wJoue%?A!W(t zjQrklZVZnqwpM$vi?wO3V@d>?e>7x!{0tFSZUt=*R@x2F=LHlMR)X_9kgcNV>_0!d zss!~8pA!Gna{Fo=y3iqH=nG<+{@+Cf$W$QXt4)P#SyjP$&aw?zcl*(Ff9(ys#B6CIC|(Z=FtUIQlyk%gHo#SD z40(;HVmqbtNs_JSj&8O13UzRqCZoF%V`s@t(_N11%n*IK6WNMYK*4QM8Kk>%r7Jv# z#$PyN-2#^n#b-l`R^8476e{i_ZKR(75DeW=Gc1>WtTB+=xE7l{%6FQ)Vzk{1bHDB& zE+geD%-{9&Ghpk!dQo)#Sw+aOG^%oje?hb)3M;2TFGifUFHu|c;2q3^I&4JBGL@>r z%_>~T!!ftBjhf7l?odm}avBf}EK*gKL9R%TwJ$Yd;u`0LA&!+pVF&pYp;-&Ac|f6B zpquv=#rGcYIKnkQQaq|5q@lM($NlY=B;E(j^gyI{R2mZ`3S}HJAjU!-EO87eD3t>o z<)`LNpjt|DZ5GhNtJ5s8YW0{Cls02EP-){65H6TpC6LZ?jxgc*p(VyzG;HbKi-Rv?v|m9?h%ohxgm=x=L*|df_+s z_A5-^+y!JnLI&$KU$3{B{CDn@_!6MUDeLp={`1C?F>oaWbH5xXPCC&ao`dlKIbA5b zzb?rE{PS>NLnK5w3vCp^HBnF8R+i7X`X-71vBP&d;5xI~XO_JaxW(peXEE2Zx#Rn4 zNa&}1&8F~=vSUamNn&$CQ$~*5-n7IT9I!xxB+(ti2`2Fs60cN_CY)a;A6o=?F7U=n z%ra4r+0GSr;FQfQKy(oRFWHYhh@BJY<&xuq%Q$IEWD%9AADm-TAPfy(q6op83l4{O zOUCWd3b@ln@3UX*IDqKe-zmsB9|0z^W|p%%@wOG$_t~)E$k?-SyxR!4H@m}P-}j3F z!KhVdh;hP_W7Hly_=ocnY_9E$AbV4(_9jHa-JJa#_@7=ADPv68*R22LG!VTzTh6GM z*ltfg?E;i8<-3LsvWw0BMFIXZre+&E8RRzc2jQiQ?yJ)`U~8G>g77~c%|jLk4o+Yf z3K{wd*j!P5H>%apIfR_>&;0fMjP@wNJzN-B-3N)CAbd?AtY>ll#U!cUI`9V6>&c@M)Rp>mwl3iMjul9fAz1Xq zM_ucD)Y}9~SDP*velyIc zQ8`m+()N~{$`Hq~tny`;AlY#xj0Q%ykLy34H2UihS^@z}xqN`0ljM zPcLZ`(Qg9!`%~p4j6htTMV?-9x|=Rg{?NtgTT5%1ZordJ z#y#xSH6Q3rI6*r_KxZHZM#VMK=s0x!$57Hy@K4a(zj!8SxIykwB^$;Y;OIlb0r<&B zK_dofm22>XlwakaqN~ynF%VrA0G=~EO_kzQ^7L6a%YXOQdeXVOQgZfG1%-5@>v6zdMN5sf;t=*u++q5oh4K43lYxqJAS(y;HgjWzln2Dx zfwY#3istz9R?j%Oek5!{XYruoRGyZ~h0QZ%K$FNKdI^cOf9uBU)t{Ra*Be;4HmPiT z$VD2)k~uWkQ$^GYgAADO0_2|q6l!;R-PAlN8IrPJU(kHxWEi&RN&31g9HD_=0MNjn ztl_w8LxpHpLHWY|cEw%Pad;o)roSwlXp}&D(OYEDA%&s4zypKTRz{zRjiIb%-EJb0 zl_G0mz|IO0+}wSrQ;Hk(c>6$WGH?> zodm#>PrZwi8we9QKV+Y#UFe{Ixx-hI*BA9(1G6J3_m2xbG%rT+%Fp@Hrkt?^1VeC| zK@M*fRj&*|Gl^RX&6!ViRo;#H-<=f%3uC4~kP0iLOWBl-~Q1Z2lM@b>gXxT>h@J@*Hx7G~1Em+z1>rIz# z^(8uh>GPf>@JjsvKhvMq_qG`F5qzz^p!c>~^v98N|KyXcy@OxuDL@!NoRv8Y3yZ+Q zFydDpC)hqG3}STqR(s$-XKc5t9H-9v_i$jnuuh|oV*q;$U0-Kd_ zQQ;rDjjoNaKY<|$m6gx}JB=9!0cgyBkX^r@GAB#V?eYB(>))v|kKVSJI1q9-!`wP75F*-7W>DiKNX7Z#O+pmcQUiMpKrEv zyIR+ka~xBJ%K86wOp42zek8cWQ-ptZ!G$V?=`O$f^f-^6c>iWn#JeAr_IjON$LsmF zm3dy#>pbNDc2b4JbeGV?!u07!jJ{15jS<>anKJ#C{`*N0V$YAj!(QC=1!^WQLJJ;v=M5~#{Q;lVx{aMlVe%fIH z6`2cyOFW*{h)A39x3vUG!309 z5##@6s~UZ--{O@O{W0aA(JZaoMW<96|NT-j>_|GwwOu?kk4tog$OkoL`&e^$$Fb;E#$W&R?3^-tI8Xig@_xE#{+vtp3G1x4 zPcaEx{ch={Xe*1XBZXY$4+BizpSry{#V3Euk2P<^7X9_%fA9Q!z4RYvAy%si72Dk; zRHJ5e&1K@%72Z&)^Tz1D+C#S`$<|&9ZaV_H@_Un3`c3*+*i~P8S#x*K`aeSZCY}EN z?5}2_MXXHmZ-l=5LlHVTkq(IT%&UU-DQrWvSG4qlv zf31p)=RBs;3j+MpIk{*2xLtqX|KIumZ$>5&2HYpA0Cztl0UYP6pc{g|e;Q#zIPkC* WjNQ}$-mGjOB}_or0;B_6K|BD&=4hAz diff --git a/Solutions/IllumioSaaS/Package/createUiDefinition.json b/Solutions/IllumioSaaS/Package/createUiDefinition.json index cb18df34c5f..2feed2f85a0 100644 --- a/Solutions/IllumioSaaS/Package/createUiDefinition.json +++ b/Solutions/IllumioSaaS/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/IllumioSaaS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[IllumioSaaS](https://www.illumio.com/) solution provides ability to ingest auditable and flow events from AWS S3 bucket.\n\n**Data Connectors:** 1, **Workbooks:** 3, **Analytic Rules:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/IllumioSaaS/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\n[IllumioSaaS](https://www.illumio.com/) solution provides ability to ingest auditable and flow events from AWS S3 bucket.\n\n**Data Connectors:** 1, **Workbooks:** 3, **Analytic Rules:** 6\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -212,6 +212,48 @@ } } ] + }, + { + "name": "analytic4", + "type": "Microsoft.Common.Section", + "label": "Illumio VEN Offline Detection Rule", + "elements": [ + { + "name": "analytic4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state" + } + } + ] + }, + { + "name": "analytic5", + "type": "Microsoft.Common.Section", + "label": "Illumio VEN Offline Detection Rule", + "elements": [ + { + "name": "analytic5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state" + } + } + ] + }, + { + "name": "analytic6", + "type": "Microsoft.Common.Section", + "label": "Illumio VEN Offline Detection Rule", + "elements": [ + { + "name": "analytic6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state" + } + } + ] } ] } diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index 71e6d301129..dfcb7cd6266 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -107,6 +107,27 @@ "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.5", + "_analyticRulecontentId4": "ec07fcd3-724f-426d-9f53-041801ca5f6c", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + }, + "analyticRuleObject5": { + "analyticRuleVersion5": "1.0.5", + "_analyticRulecontentId5": "ec07fcd3-724f-426d-9f53-041801ca5f6c", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + }, + "analyticRuleObject6": { + "analyticRuleVersion6": "1.0.5", + "_analyticRulecontentId6": "ec07fcd3-724f-426d-9f53-041801ca5f6c", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -483,7 +504,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9875bc24-f51c-4151-96f0-2e4af7039364\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Time\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":86400000},{\"durationMs\":604800000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize count()\",\"size\":4,\"title\":\"Audit Events\",\"noDataMessage\":\"0\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"Audit Events\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"table('Illumio_Auditable_Events_CL')\\n| where event_type has 'tampering'\\n| summarize count()\",\"size\":4,\"title\":\"Tampering Events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"tileSettings\":{\"showBorder\":false},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"Tampering Events\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"table('Illumio_Auditable_Events_CL')\\n| where event_type has 'port_scan'\\n| summarize count()\",\"size\":4,\"title\":\"Port Scan Events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"Port Scan Events\",\"styleSettings\":{\"maxWidth\":\"30\"}}]},\"name\":\"group - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize distinct_count = dcount(href) by event_type\\n| order by distinct_count \\n| top 10 by distinct_count\",\"size\":0,\"title\":\"Top Auditable events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Change Monitoring\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize arg_max(TimeGenerated, *) by href\\n| where event_type == 'sec_policy.create' \\n| mv-expand resource_change = resource_changes\\n| project TimeGenerated,\\n workloads_affected_after_change = resource_change.changes.workloads_affected.after,\\n policy_version = resource_change.resource.sec_policy.version,\\n commit_message = resource_change.resource.sec_policy.commit_message,\\n modified_objects = resource_change.resource.sec_policy.modified_objects,\\n change_type = resource_change.change_type\\n\",\"size\":0,\"title\":\"Workloads affected by policy changes\",\"noDataMessage\":\"No workloads were affected by policy changes\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"name\":\"Workloads affected by policy changes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| where resource_changes != '[]' and isnotempty(resource_changes) // ensure resource changes are not empty\\n| summarize arg_max(TimeGenerated, *) by href\\n| mv-expand parse_json(resource_changes)\\n| project resource_type = tostring(bag_keys(resource_changes.resource)[0])\\n| summarize Count=count() by resource_type\",\"size\":0,\"title\":\"Changes by Resource Type\",\"noDataMessage\":\"No changes by resource type\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"customWidth\":\"35\",\"name\":\"Changes by Resource Type\",\"styleSettings\":{\"maxWidth\":\"35\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| where resource_changes != '[]' and isnotempty(resource_changes) and not(event_type matches regex '^user.*') and (event_type has '.create' or event_type has '.update' or event_type has '.delete') and (created_by !has \\\"agent\\\" and created_by !has \\\"ven\\\" and created_by !has \\\"container\\\")\\n| extend User = tostring(parse_json(created_by)['user']['username'])\\n| summarize Count = count() by User\",\"size\":0,\"title\":\"Changes by User\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"35\",\"name\":\"Changes by User\",\"styleSettings\":{\"maxWidth\":\"35\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| where created_by has \\\"agent\\\" or created_by has \\\"ven\\\"\\n| project user = tostring(parse_json(created_by)['agent']['hostname'])\\n| summarize count() by user\",\"size\":0,\"title\":\"Events generated by agents\",\"noDataMessage\":\"Agents have not generated any events\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"20\",\"name\":\"Events generated by agents\",\"styleSettings\":{\"maxWidth\":\"20\"}}]},\"name\":\"ChangeMonitoring\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize arg_max(TimeGenerated, *) by href // try to filter what event_type to prioritize in bar chart\\n| make-series events = count() default = 0 on TimeGenerated from {Time:start} to {Time:end} step 1h by event_type //from ago(1d) to now() step 1h by event_type \",\"size\":0,\"title\":\"PCE events breakdown - every hour\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"mapSettings\":{\"locInfo\":\"LatLong\"}},\"name\":\"PCE events breakdown - every hour\"},{\"type\":1,\"content\":{\"json\":\"### Authentication events \\nChoose from below drop down to filter authentication events.\"},\"name\":\"text - 7\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1ee7c425-b1b5-4a71-8dc3-9b447fa1f316\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EventType\",\"label\":\"Include Event Type\",\"type\":2,\"description\":\"Types of events to be included \",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"user.logout\\\", \\\"label\\\":\\\"User logout\\\" },\\n { \\\"value\\\":\\\"user.sign_in\\\", \\\"label\\\":\\\"User signin\\\" },\\n { \\\"value\\\":\\\"user.sign_out\\\", \\\"label\\\":\\\"User signout\\\" },\\n { \\\"value\\\":\\\"user.login\\\", \\\"label\\\":\\\"User login\\\"},\\n { \\\"value\\\":\\\"user.pce_session_terminated\\\", \\\"label\\\":\\\"User session terminated\\\"},\\n { \\\"value\\\":\\\"request.authentication_failed\\\", \\\"label\\\":\\\"Authentication failed\\\"},\\n { \\\"value\\\":\\\"user.authenticate\\\", \\\"label\\\":\\\"User Authentication\\\"},\\n { \\\"value\\\":\\\"user.create_session\\\", \\\"label\\\":\\\"User create session\\\"}\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":[\"value::all\"]},{\"id\":\"4f1ca215-f902-4fac-9bf0-834e4988a107\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ExcludeEventType\",\"label\":\"Exclude Event Type\",\"type\":2,\"description\":\"Types of events to be excluded\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"user.logout\\\", \\\"label\\\":\\\"User logout\\\" },\\n { \\\"value\\\":\\\"user.sign_in\\\", \\\"label\\\":\\\"User signin\\\" },\\n { \\\"value\\\":\\\"user.sign_out\\\", \\\"label\\\":\\\"User signout\\\" },\\n { \\\"value\\\":\\\"user.login\\\", \\\"label\\\":\\\"User login\\\"},\\n { \\\"value\\\":\\\"user.pce_session_terminated\\\", \\\"label\\\":\\\"User session terminated\\\"},\\n { \\\"value\\\":\\\"request.authentication_failed\\\", \\\"label\\\":\\\"Authentication failed\\\"},\\n { \\\"value\\\":\\\"user.authenticate\\\", \\\"label\\\":\\\"User Authentication\\\"},\\n { \\\"value\\\":\\\"user.create_session\\\", \\\"label\\\":\\\"User create session\\\"},\\n { \\\"value\\\":\\\"None\\\", \\\"label\\\":\\\"None\\\", \\\"selected\\\": true}\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":[\"None\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Status\",\"type\":2,\"description\":\"Status values\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"failure\\\", \\\"label\\\":\\\"Failure\\\" },\\n { \\\"value\\\":\\\"success\\\", \\\"label\\\":\\\"Success\\\", \\\"selected\\\": true },\\n { \\\"value\\\":\\\"None\\\", \\\"label\\\":\\\"None\\\"}\\n]\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"c8996627-2e77-4386-9c23-1eb5d50df311\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"description\":\"Status values\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"err\\\", \\\"label\\\":\\\"Error\\\" },\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\", \\\"selected\\\": true } \\n]\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"79d0945d-d0f8-4293-8dc2-3c57391cde95\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let included_event_types = iif(\\\"*\\\" in ({EventType}), dynamic(['user.login','user.logout', 'user.sign_in', 'user.sign_out', 'user.authenticate','user.create_session','user.pce_session_terminated']), dynamic([{EventType}]) );\\nIllumio_Auditable_Events_CL\\n| where event_type in (included_event_types)\\n| where \\\"*\\\" in ({Status}) or status in ({Status}) and \\\"*\\\" in ({Severity}) or severity in ({Severity})\\n| where not(event_type in ({ExcludeEventType}))\\n| project TimeGenerated, pce_fqdn, event_type, status, notification_type = parse_json(notifications)[0].notification_type,severity, created_by_username = iif(created_by == '{\\\"system\\\":{}}', parse_json(notifications)[0].info.user.username, parse_json(created_by).user.username)\",\"size\":0,\"title\":\"PCE Authentication Events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":100,\"filter\":true,\"sortBy\":[{\"itemKey\":\"severity\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"severity\",\"sortOrder\":1}]},\"name\":\"PCE Authentication Events\"}],\"fromTemplateId\":\"sentinel-AuditableEventsWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"9875bc24-f51c-4151-96f0-2e4af7039364\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Time\",\"type\":4,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":86400000},{\"durationMs\":604800000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 5\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize count()\",\"size\":4,\"title\":\"Audit Events\",\"noDataMessage\":\"0\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"Audit Events\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"table('Illumio_Auditable_Events_CL')\\n| where event_type has 'tampering'\\n| summarize count()\",\"size\":4,\"title\":\"Tampering Events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"tileSettings\":{\"showBorder\":false},\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"Tampering Events\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"table('Illumio_Auditable_Events_CL')\\n| where event_type has 'port_scan'\\n| summarize count()\",\"size\":4,\"title\":\"Port Scan Events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"customWidth\":\"30\",\"name\":\"Port Scan Events\",\"styleSettings\":{\"maxWidth\":\"30\"}}]},\"name\":\"group - 5\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize distinct_count = dcount(href) by event_type\\n| order by distinct_count \\n| top 10 by distinct_count\",\"size\":0,\"title\":\"Top Auditable events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\"},\"name\":\"query - 0\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Change Monitoring\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize arg_max(TimeGenerated, *) by href\\n| where event_type == 'sec_policy.create' \\n| mv-expand resource_change = resource_changes\\n| project TimeGenerated,\\n workloads_affected_after_change = resource_change.changes.workloads_affected.after,\\n policy_version = resource_change.resource.sec_policy.version,\\n commit_message = resource_change.resource.sec_policy.commit_message,\\n modified_objects = resource_change.resource.sec_policy.modified_objects,\\n change_type = resource_change.change_type\\n\",\"size\":0,\"title\":\"Workloads affected by policy changes\",\"noDataMessage\":\"No workloads were affected by policy changes\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"TimeGenerated\",\"sortOrder\":1}]},\"name\":\"Workloads affected by policy changes\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| where resource_changes != '[]' and isnotempty(resource_changes) // ensure resource changes are not empty\\n| summarize arg_max(TimeGenerated, *) by href\\n| mv-expand parse_json(resource_changes)\\n| project resource_type = tostring(bag_keys(resource_changes.resource)[0])\\n| summarize Count=count() by resource_type\",\"size\":0,\"title\":\"Changes by Resource Type\",\"noDataMessage\":\"No changes by resource type\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"Count\",\"sortOrder\":2}]},\"customWidth\":\"35\",\"name\":\"Changes by Resource Type\",\"styleSettings\":{\"maxWidth\":\"35\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| where resource_changes != '[]' and isnotempty(resource_changes) and not(event_type matches regex '^user.*') and (event_type has '.create' or event_type has '.update' or event_type has '.delete') and (created_by !has \\\"agent\\\" and created_by !has \\\"ven\\\" and created_by !has \\\"container\\\")\\n| extend User = tostring(parse_json(created_by)['user']['username'])\\n| summarize Count = count() by User\",\"size\":0,\"title\":\"Changes by User\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"35\",\"name\":\"Changes by User\",\"styleSettings\":{\"maxWidth\":\"35\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| where created_by has \\\"agent\\\" or created_by has \\\"ven\\\"\\n| project user = tostring(parse_json(created_by)['agent']['hostname'])\\n| summarize count() by user\",\"size\":0,\"title\":\"Events generated by agents\",\"noDataMessage\":\"Agents have not generated any events\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"20\",\"name\":\"Events generated by agents\",\"styleSettings\":{\"maxWidth\":\"20\"}}]},\"name\":\"ChangeMonitoring\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Auditable_Events_CL\\n| summarize arg_max(TimeGenerated, *) by href // try to filter what event_type to prioritize in bar chart\\n| make-series events = count() default = 0 on TimeGenerated from {Time:start} to {Time:end} step 1h by event_type //from ago(1d) to now() step 1h by event_type \",\"size\":0,\"title\":\"PCE events breakdown - every hour\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"unstackedbar\",\"tileSettings\":{\"showBorder\":false},\"graphSettings\":{\"type\":0},\"mapSettings\":{\"locInfo\":\"LatLong\"}},\"name\":\"PCE events breakdown - every hour\"},{\"type\":1,\"content\":{\"json\":\"### Authentication events \\nChoose from below drop down to filter authentication events.\"},\"name\":\"text - 7\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"1ee7c425-b1b5-4a71-8dc3-9b447fa1f316\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"EventType\",\"label\":\"Include Event Type\",\"type\":2,\"description\":\"Types of events to be included \",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"user.logout\\\", \\\"label\\\":\\\"User logout\\\" },\\n { \\\"value\\\":\\\"user.sign_in\\\", \\\"label\\\":\\\"User signin\\\" },\\n { \\\"value\\\":\\\"user.sign_out\\\", \\\"label\\\":\\\"User signout\\\" },\\n { \\\"value\\\":\\\"user.login\\\", \\\"label\\\":\\\"User login\\\"},\\n { \\\"value\\\":\\\"user.pce_session_terminated\\\", \\\"label\\\":\\\"User session terminated\\\"},\\n { \\\"value\\\":\\\"request.authentication_failed\\\", \\\"label\\\":\\\"Authentication failed\\\"},\\n { \\\"value\\\":\\\"user.authenticate\\\", \\\"label\\\":\\\"User Authentication\\\"},\\n { \\\"value\\\":\\\"user.create_session\\\", \\\"label\\\":\\\"User create session\\\"}\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":[\"value::all\"]},{\"id\":\"4f1ca215-f902-4fac-9bf0-834e4988a107\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"ExcludeEventType\",\"label\":\"Exclude Event Type\",\"type\":2,\"description\":\"Types of events to be excluded\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"user.logout\\\", \\\"label\\\":\\\"User logout\\\" },\\n { \\\"value\\\":\\\"user.sign_in\\\", \\\"label\\\":\\\"User signin\\\" },\\n { \\\"value\\\":\\\"user.sign_out\\\", \\\"label\\\":\\\"User signout\\\" },\\n { \\\"value\\\":\\\"user.login\\\", \\\"label\\\":\\\"User login\\\"},\\n { \\\"value\\\":\\\"user.pce_session_terminated\\\", \\\"label\\\":\\\"User session terminated\\\"},\\n { \\\"value\\\":\\\"request.authentication_failed\\\", \\\"label\\\":\\\"Authentication failed\\\"},\\n { \\\"value\\\":\\\"user.authenticate\\\", \\\"label\\\":\\\"User Authentication\\\"},\\n { \\\"value\\\":\\\"user.create_session\\\", \\\"label\\\":\\\"User create session\\\"},\\n { \\\"value\\\":\\\"None\\\", \\\"label\\\":\\\"None\\\", \\\"selected\\\": true}\\n]\",\"timeContext\":{\"durationMs\":86400000},\"value\":[\"None\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Status\",\"type\":2,\"description\":\"Status values\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"failure\\\", \\\"label\\\":\\\"Failure\\\" },\\n { \\\"value\\\":\\\"success\\\", \\\"label\\\":\\\"Success\\\", \\\"selected\\\": true },\\n { \\\"value\\\":\\\"None\\\", \\\"label\\\":\\\"None\\\"}\\n]\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"c8996627-2e77-4386-9c23-1eb5d50df311\",\"value\":[\"value::all\"]},{\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"description\":\"Status values\",\"isRequired\":true,\"isGlobal\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"jsonData\":\"[\\n { \\\"value\\\":\\\"err\\\", \\\"label\\\":\\\"Error\\\" },\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\", \\\"selected\\\": true } \\n]\",\"timeContext\":{\"durationMs\":86400000},\"id\":\"79d0945d-d0f8-4293-8dc2-3c57391cde95\",\"value\":[\"value::all\"]}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let included_event_types = iif(\\\"*\\\" in ({EventType}), dynamic(['user.login','user.logout', 'user.sign_in', 'user.sign_out', 'user.authenticate','user.create_session','user.pce_session_terminated']), dynamic([{EventType}]) );\\nIllumio_Auditable_Events_CL\\n| where event_type in (included_event_types)\\n| where \\\"*\\\" in ({Status}) or status in ({Status}) and \\\"*\\\" in ({Severity}) or severity in ({Severity})\\n| where not(event_type in ({ExcludeEventType}))\\n| project TimeGenerated, pce_fqdn, event_type, status, notification_type = parse_json(notifications)[0].notification_type,severity, created_by_username = iif(created_by == '{\\\"system\\\":{}}', parse_json(notifications)[0].info.user.username, parse_json(created_by).user.username)\",\"size\":0,\"title\":\"PCE Authentication Events\",\"timeContextFromParameter\":\"Time\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":100,\"filter\":true,\"sortBy\":[{\"itemKey\":\"severity\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"severity\",\"sortOrder\":1}]},\"name\":\"PCE Authentication Events\"}],\"fromTemplateId\":\"sentinel-AuditableEventsWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -570,7 +591,7 @@ }, "properties": { "displayName": "[parameters('workbook2-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ebc4e534-7a4a-41be-b365-ddcd4f564090\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range\",\"label\":\"Time Range\",\"type\":4,\"description\":\"As a time filter\",\"isGlobal\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize count() by bin(TimeGenerated, 1h)\",\"size\":0,\"title\":\"Traffic every hour\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true,\"showDataPoints\":true,\"xSettings\":{\"label\":\"Time\"},\"ySettings\":{\"label\":\"Traffic Connections\"}}},\"name\":\"traffic-every-hour\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Trafficked Workload Stats\",\"items\":[{\"type\":1,\"content\":{\"json\":\"#### Enter the number of workloads for which the inbound and outbound connections are to be fetched. These workloads will be ordered by connection count. \",\"style\":\"info\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0dead08f-24f5-40b3-a011-a59e007a8e70\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"workload_count\",\"label\":\"Workload Count\",\"type\":1,\"description\":\"Provide an integer that denotes the limit for retrieving most trafficked workloads\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": 5, \\\\\\\"label\\\\\\\": 5, \\\\\\\"selected\\\\\\\": true}\\\"}\\r\\n\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":8,\"value\":\"10\"}],\"style\":\"pills\",\"queryType\":8},\"name\":\"parameters - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let workload_count = {workload_count};\\nIllumio_Flow_Events_CL\\n| extend hostname = coalesce(src_hostname, dst_hostname)\\n| summarize Count = count() by hostname, dir\\n| summarize InboundCount = sum(iff(dir == \\\"I\\\", Count, 0)), OutboundCount = sum(iff(dir == \\\"O\\\", Count, 0)) by hostname\\n| top workload_count by hostname\\n\",\"size\":0,\"title\":\"Most Trafficked Workloads\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"workload\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"hostname\",\"showLegend\":true,\"xSettings\":{\"label\":\"Workloads\"},\"ySettings\":{\"label\":\"Traffic Connections\"}}},\"name\":\"Most Trafficked Workloads\"}]},\"name\":\"MostTraffickedWorkload\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Traffic Explorer\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Filters for querying traffic data\",\"expandable\":true,\"expanded\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"## Traffic Explorer\\n### Please enter source ip, destination ip, destination port, protocol, time range to filter traffic records. \\n### All records are returned unless provided.\\n\",\"style\":\"info\"},\"name\":\"text - 9\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8ab7ce90-16a6-4e7e-85b7-292234a9d3c1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"src_ip\",\"label\":\"Source IP\",\"type\":2,\"description\":\"Select source ip\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by src_ip\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"24f11ee0-0b0b-4c79-918b-01df57233aa2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"dst_ip\",\"label\":\"Destination IP\",\"type\":2,\"description\":\"Select destination ips\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by dst_ip\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"eb9fe16e-be04-479d-9389-0095c2b43d50\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"dst_port\",\"label\":\"Destination Port\",\"type\":2,\"description\":\"Select destination port\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by dst_port\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"416ab303-c10f-47c1-9f01-7c1324699b49\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"protocol\",\"label\":\"Protocol\",\"type\":2,\"description\":\"Protocol for fetching traffic records. For multiple, use comma as delimiter like 6,17\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by proto\\n| extend protocolName = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"f07c08c2-ff0f-42a7-adc6-4fd5d7f1cb19\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"src_label\",\"label\":\"Source Label\",\"type\":2,\"description\":\"Filter for source labels\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| where src_labels != ''\\n| extend parsed_labels = parse_json(src_labels)\\n| mv-expand kind=array parsed_labels\\n| extend src_label=tostring(parsed_labels[1])\\n| summarize by src_label\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"9d5cb77f-31a5-41ed-8849-aaee2b513f54\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"dst_label\",\"label\":\"Destination Label\",\"type\":2,\"description\":\"Filter for destination label\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| where dst_labels != ''\\n| extend parsed_labels = parse_json(dst_labels)\\n| mv-expand kind=array parsed_labels\\n| extend dst_label=tostring(parsed_labels[1])\\n| summarize by dst_label\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"all_traffic_params\",\"styleSettings\":{\"maxWidth\":\"30\"}}],\"exportParameters\":true},\"name\":\"parameters_group\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol})) \\n| extend policy_decision = \\n case(pd == 0, \\\"Allowed\\\",\\n pd == 1, \\\"Potentially Blocked\\\",\\n pd == 2, \\\"Blocked\\\",\\n \\\"Unknown\\\")\\n| summarize count() by policy_decision\\n\",\"size\":2,\"title\":\"Flow count by policy decision\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Potentially Blocked\",\"color\":\"yellow\"},{\"seriesName\":\"Allowed\",\"color\":\"green\"},{\"seriesName\":\"Blocked\",\"color\":\"red\"},{\"seriesName\":\"Unknown\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"name\":\"Flow count by policy decision\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\nIllumio_Flow_Events_CL\\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend class_type = \\n case(class == 'B', 'Broadcast',\\n class == 'M', 'Multicast',\\n class == 'U', \\\"Unicast\\\",\\n \\\"Unknown\\\")\\n| summarize count() by class_type\\n\",\"size\":2,\"title\":\"Flows by class\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"Flows by class\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":1,\"content\":{\"json\":\"### A service is indicated with a destination port and protocol, represented in the below graph as \\\"destination_port/protocol\\\"\",\"style\":\"info\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocolName = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| extend service = strcat(dst_port, '/', protocolName)\\n| summarize service_count = count() by service\\n| top 5 by service_count\\n\",\"size\":0,\"title\":\"Top 5 Services by Flow Count\",\"color\":\"blue\",\"noDataMessage\":\"No services found\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"xAxis\":\"service\",\"yAxis\":[\"service_count\"],\"xSettings\":{\"label\":\"Destination Service\"},\"ySettings\":{\"label\":\"Count\"}}},\"name\":\"Top 5 Services by Flow Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where pd == 2 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocol = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\\n\\n\",\"size\":0,\"title\":\"Blocked Traffic\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Blocked Traffic\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where pd == 1 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocol = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\\n\\n\",\"size\":0,\"title\":\"Potentially blocked traffic\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Potentially blocked traffic\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where pd == 0 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocol = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\\n\",\"size\":0,\"title\":\"Allowed traffic\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Allowed traffic\"}]},\"name\":\"Traffic Explorer\"}],\"fromTemplateId\":\"sentinel-FlowDataWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ebc4e534-7a4a-41be-b365-ddcd4f564090\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"time_range\",\"label\":\"Time Range\",\"type\":4,\"description\":\"As a time filter\",\"isGlobal\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":86400000}}],\"style\":\"above\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize count() by bin(TimeGenerated, 1h)\",\"size\":0,\"title\":\"Traffic every hour\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true,\"showDataPoints\":true,\"xSettings\":{\"label\":\"Time\"},\"ySettings\":{\"label\":\"Traffic Connections\"}}},\"name\":\"traffic-every-hour\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Trafficked Workload Stats\",\"items\":[{\"type\":1,\"content\":{\"json\":\"#### Enter the number of workloads for which the inbound and outbound connections are to be fetched. These workloads will be ordered by connection count. \",\"style\":\"info\"},\"name\":\"text - 4\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0dead08f-24f5-40b3-a011-a59e007a8e70\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"workload_count\",\"label\":\"Workload Count\",\"type\":1,\"description\":\"Provide an integer that denotes the limit for retrieving most trafficked workloads\",\"query\":\"{\\\"version\\\":\\\"1.0.0\\\",\\\"content\\\":\\\"{\\\\\\\"value\\\\\\\": 5, \\\\\\\"label\\\\\\\": 5, \\\\\\\"selected\\\\\\\": true}\\\"}\\n\",\"timeContext\":{\"durationMs\":86400000},\"queryType\":8,\"value\":\"10\"}],\"style\":\"pills\",\"queryType\":8},\"name\":\"parameters - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let workload_count = {workload_count};\\nIllumio_Flow_Events_CL\\n| extend hostname = coalesce(src_hostname, dst_hostname)\\n| summarize Count = count() by hostname, dir\\n| summarize InboundCount = sum(iff(dir == \\\"I\\\", Count, 0)), OutboundCount = sum(iff(dir == \\\"O\\\", Count, 0)) by hostname\\n| top workload_count by hostname\\n\",\"size\":0,\"title\":\"Most Trafficked Workloads\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"tileSettings\":{\"showBorder\":false,\"titleContent\":{\"columnMatch\":\"workload\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Count\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"xAxis\":\"hostname\",\"showLegend\":true,\"xSettings\":{\"label\":\"Workloads\"},\"ySettings\":{\"label\":\"Traffic Connections\"}}},\"name\":\"Most Trafficked Workloads\"}]},\"name\":\"MostTraffickedWorkload\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Traffic Explorer\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"title\":\"Filters for querying traffic data\",\"expandable\":true,\"expanded\":true,\"items\":[{\"type\":1,\"content\":{\"json\":\"## Traffic Explorer\\n### Please enter source ip, destination ip, destination port, protocol, time range to filter traffic records. \\n### All records are returned unless provided.\\n\",\"style\":\"info\"},\"name\":\"text - 9\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8ab7ce90-16a6-4e7e-85b7-292234a9d3c1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"src_ip\",\"label\":\"Source IP\",\"type\":2,\"description\":\"Select source ip\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by src_ip\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"24f11ee0-0b0b-4c79-918b-01df57233aa2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"dst_ip\",\"label\":\"Destination IP\",\"type\":2,\"description\":\"Select destination ips\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by dst_ip\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":86400000},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},{\"id\":\"eb9fe16e-be04-479d-9389-0095c2b43d50\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"dst_port\",\"label\":\"Destination Port\",\"type\":2,\"description\":\"Select destination port\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by dst_port\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\"},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"416ab303-c10f-47c1-9f01-7c1324699b49\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"protocol\",\"label\":\"Protocol\",\"type\":2,\"description\":\"Protocol for fetching traffic records. For multiple, use comma as delimiter like 6,17\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| summarize by proto\\n| extend protocolName = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"f07c08c2-ff0f-42a7-adc6-4fd5d7f1cb19\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"src_label\",\"label\":\"Source Label\",\"type\":2,\"description\":\"Filter for source labels\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| where src_labels != ''\\n| extend parsed_labels = parse_json(src_labels)\\n| mv-expand kind=array parsed_labels\\n| extend src_label=tostring(parsed_labels[1])\\n| summarize by src_label\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]},{\"id\":\"9d5cb77f-31a5-41ed-8849-aaee2b513f54\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"dst_label\",\"label\":\"Destination Label\",\"type\":2,\"description\":\"Filter for destination label\",\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"Illumio_Flow_Events_CL\\n| where dst_labels != ''\\n| extend parsed_labels = parse_json(dst_labels)\\n| mv-expand kind=array parsed_labels\\n| extend dst_label=tostring(parsed_labels[1])\\n| summarize by dst_label\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"time_range\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":[\"value::all\"]}],\"style\":\"formHorizontal\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"30\",\"name\":\"all_traffic_params\",\"styleSettings\":{\"maxWidth\":\"30\"}}],\"exportParameters\":true},\"name\":\"parameters_group\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol})) \\n| extend policy_decision = \\n case(pd == 0, \\\"Allowed\\\",\\n pd == 1, \\\"Potentially Blocked\\\",\\n pd == 2, \\\"Blocked\\\",\\n \\\"Unknown\\\")\\n| summarize count() by policy_decision\\n\",\"size\":2,\"title\":\"Flow count by policy decision\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Potentially Blocked\",\"color\":\"yellow\"},{\"seriesName\":\"Allowed\",\"color\":\"green\"},{\"seriesName\":\"Blocked\",\"color\":\"red\"},{\"seriesName\":\"Unknown\",\"color\":\"gray\"}]}},\"customWidth\":\"50\",\"name\":\"Flow count by policy decision\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"\\nIllumio_Flow_Events_CL\\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend class_type = \\n case(class == 'B', 'Broadcast',\\n class == 'M', 'Multicast',\\n class == 'U', \\\"Unicast\\\",\\n \\\"Unknown\\\")\\n| summarize count() by class_type\\n\",\"size\":2,\"title\":\"Flows by class\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"50\",\"name\":\"Flows by class\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":1,\"content\":{\"json\":\"### A service is indicated with a destination port and protocol, represented in the below graph as \\\"destination_port/protocol\\\"\",\"style\":\"info\"},\"name\":\"text - 7\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where (src_ip in ({src_ip}) or '*' in ({src_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocolName = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| extend service = strcat(dst_port, '/', protocolName)\\n| summarize service_count = count() by service\\n| top 5 by service_count\\n\",\"size\":0,\"title\":\"Top 5 Services by Flow Count\",\"color\":\"blue\",\"noDataMessage\":\"No services found\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"xAxis\":\"service\",\"yAxis\":[\"service_count\"],\"xSettings\":{\"label\":\"Destination Service\"},\"ySettings\":{\"label\":\"Count\"}}},\"name\":\"Top 5 Services by Flow Count\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where pd == 2 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocol = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\\n\\n\",\"size\":0,\"title\":\"Blocked Traffic\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Blocked Traffic\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where pd == 1 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocol = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\\n\\n\",\"size\":0,\"title\":\"Potentially blocked traffic\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Potentially blocked traffic\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Flow_Events_CL\\n| where pd == 0 and (src_ip in ({src_ip}) or '*' in ({src_ip})) and (dst_ip in ({dst_ip}) or '*' in ({dst_ip})) and (src_labels has_any ({src_label}) or '*' in ({src_label})) and (dst_labels has_any ({dst_label}) or '*' in ({dst_label})) and (dst_port in ({dst_port}) or '*' in ({dst_port})) and (proto in ({protocol}) or '*' in ({protocol}))\\n| extend protocol = case(\\n proto == -1, \\\"all\\\",\\n proto == 0, \\\"hopopt\\\",\\n proto == 1, \\\"icmp\\\",\\n proto == 2, \\\"igmp\\\",\\n proto == 3, \\\"ggp\\\",\\n proto == 4, \\\"ipv4\\\",\\n proto == 5, \\\"st\\\",\\n proto == 6, \\\"tcp\\\",\\n proto == 7, \\\"cbt\\\",\\n proto == 8, \\\"egp\\\",\\n proto == 9, \\\"igp\\\",\\n proto == 10, \\\"bbn-rcc-mon\\\",\\n proto == 11, \\\"nvp-ii\\\",\\n proto == 12, \\\"pup\\\",\\n proto == 13, \\\"argus\\\",\\n proto == 14, \\\"emcon\\\",\\n proto == 15, \\\"xnet\\\",\\n proto == 16, \\\"chaos\\\",\\n proto == 17, \\\"udp\\\",\\n proto == 18, \\\"mux\\\",\\n proto == 19, \\\"dcn-meas\\\",\\n proto == 20, \\\"hmp\\\",\\n proto == 21, \\\"prm\\\",\\n proto == 22, \\\"xns-idp\\\",\\n proto == 23, \\\"trunk-1\\\",\\n proto == 24, \\\"trunk-2\\\",\\n proto == 25, \\\"leaf-1\\\",\\n proto == 26, \\\"leaf-2\\\",\\n proto == 27, \\\"rdp\\\",\\n proto == 28, \\\"irtp\\\",\\n proto == 29, \\\"iso-tp4\\\",\\n proto == 30, \\\"netblt\\\",\\n proto == 31, \\\"mfe-nsp\\\",\\n proto == 32, \\\"merit-inp\\\",\\n proto == 33, \\\"dccp\\\",\\n proto == 34, \\\"3pc\\\",\\n proto == 35, \\\"idpr\\\",\\n proto == 36, \\\"xtp\\\",\\n proto == 37, \\\"ddp\\\",\\n proto == 38, \\\"idpr-cmtp\\\",\\n proto == 39, \\\"tp++\\\",\\n proto == 40, \\\"il\\\",\\n proto == 41, \\\"ipv6\\\",\\n proto == 42, \\\"sdrp\\\",\\n proto == 43, \\\"ipv6-route\\\",\\n proto == 44, \\\"ipv6-frag\\\",\\n proto == 45, \\\"idrp\\\",\\n proto == 46, \\\"rsvp\\\",\\n proto == 47, \\\"gre\\\",\\n proto == 48, \\\"dsr\\\",\\n proto == 49, \\\"bna\\\",\\n proto == 50, \\\"esp\\\",\\n proto == 51, \\\"ah\\\",\\n proto == 52, \\\"i-nlsp\\\",\\n proto == 53, \\\"swipe\\\",\\n proto == 54, \\\"narp\\\",\\n proto == 55, \\\"mobile\\\",\\n proto == 56, \\\"tlsp\\\",\\n proto == 57, \\\"skip\\\",\\n proto == 58, \\\"ipv6-icmp\\\",\\n proto == 59, \\\"ipv6-nonxt\\\",\\n proto == 60, \\\"ipv6-opts\\\",\\n proto == 62, \\\"cftp\\\",\\n proto == 64, \\\"sat-expak\\\",\\n proto == 65, \\\"kryptolan\\\",\\n proto == 66, \\\"rvd\\\",\\n proto == 67, \\\"ippc\\\",\\n proto == 69, \\\"sat-mon\\\",\\n proto == 70, \\\"visa\\\",\\n proto == 71, \\\"ipcv\\\",\\n proto == 72, \\\"cpnx\\\",\\n proto == 73, \\\"cphb\\\",\\n proto == 74, \\\"wsn\\\",\\n proto == 75, \\\"pvp\\\",\\n proto == 76, \\\"br-sat-mon\\\",\\n proto == 77, \\\"sun-nd\\\",\\n proto == 78, \\\"wb-mon\\\",\\n proto == 79, \\\"wb-expak\\\",\\n proto == 80, \\\"iso-ip\\\",\\n proto == 81, \\\"vmtp\\\",\\n proto == 82, \\\"secure-vmtp\\\",\\n proto == 83, \\\"vines\\\",\\n proto == 84, \\\"iptm\\\",\\n proto == 85, \\\"nsfnet-igp\\\",\\n proto == 86, \\\"dgp\\\",\\n proto == 87, \\\"tcf\\\",\\n proto == 88, \\\"eigrp\\\",\\n proto == 89, \\\"ospfigp\\\",\\n proto == 90, \\\"sprite-rpc\\\",\\n proto == 91, \\\"larp\\\",\\n proto == 92, \\\"mtp\\\",\\n proto == 93, \\\"ax.25\\\",\\n proto == 94, \\\"ipip\\\",\\n proto == 95, \\\"micp\\\",\\n proto == 96, \\\"scc-sp\\\",\\n proto == 97, \\\"etherip\\\",\\n proto == 98, \\\"encap\\\",\\n proto == 100, \\\"gmtp\\\",\\n proto == 101, \\\"ifmp\\\",\\n proto == 102, \\\"pnni\\\",\\n proto == 103, \\\"pim\\\",\\n proto == 104, \\\"aris\\\",\\n proto == 105, \\\"scps\\\",\\n proto == 106, \\\"qnx\\\",\\n proto == 107, \\\"a/n\\\",\\n proto == 108, \\\"ipcomp\\\",\\n proto == 109, \\\"snp\\\",\\n proto == 110, \\\"compaq-peer\\\",\\n proto == 111, \\\"ipx-in-ip\\\",\\n proto == 112, \\\"vrrp\\\",\\n proto == 113, \\\"pgm\\\",\\n proto == 115, \\\"l2tp\\\",\\n proto == 116, \\\"ddx\\\",\\n proto == 117, \\\"iatp\\\",\\n proto == 118, \\\"stp\\\",\\n proto == 119, \\\"srp\\\",\\n proto == 120, \\\"uti\\\",\\n proto == 121, \\\"smp\\\",\\n proto == 122, \\\"sm\\\",\\n proto == 123, \\\"ptp\\\",\\n proto == 124, \\\"isis over ipv4\\\",\\n proto == 125, \\\"fire\\\",\\n proto == 126, \\\"crtp\\\",\\n proto == 127, \\\"crudp\\\",\\n proto == 128, \\\"sscopmce\\\",\\n proto == 129, \\\"iplt\\\",\\n proto == 130, \\\"sps\\\",\\n proto == 131, \\\"pipe\\\",\\n proto == 132, \\\"sctp\\\",\\n proto == 133, \\\"fc\\\",\\n proto == 134, \\\"rsvp-e2e-ignore\\\",\\n proto == 135, \\\"mobility header\\\",\\n proto == 136, \\\"udplite\\\",\\n proto == 137, \\\"mpls-in-ip\\\",\\n proto == 138, \\\"manet\\\",\\n proto == 139, \\\"hip\\\",\\n proto == 140, \\\"shim6\\\",\\n proto == 141, \\\"wesp\\\",\\n proto == 142, \\\"rohc\\\",\\n proto == 143, \\\"ethernet\\\",\\n proto == 144, \\\"aggfrag\\\",\\n proto == 145, \\\"nsh\\\",\\n proto >= 146 and proto <= 252, \\\"unknown\\\",\\n proto == 253, \\\"unknown\\\",\\n proto == 254, \\\"unknown\\\",\\n proto == 255, \\\"reserved\\\",\\n \\\"unknown\\\"\\n)\\n| project TimeGenerated, src_ip, src_hostname, src_labels, dst_ip, dst_hostname, dst_port, dst_labels, protocol\\n\",\"size\":0,\"title\":\"Allowed traffic\",\"timeContextFromParameter\":\"time_range\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"Allowed traffic\"}]},\"name\":\"Traffic Explorer\"}],\"fromTemplateId\":\"sentinel-FlowDataWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -657,7 +678,7 @@ }, "properties": { "displayName": "[parameters('workbook3-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Illumio Workloads Stats\\n---\\n\\nThis workbook uses Illumio APIs to fetch workload details and presents stats.\"},\"name\":\"text - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"4de2c193-277e-4f8e-88b5-2caac1676e2b\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workload Operations\",\"subTarget\":\"0\",\"style\":\"link\",\"tabWidth\":\"500px\"},{\"id\":\"8b46c8dd-071a-4bd4-9d36-1247d8777702\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workload Investigations\",\"subTarget\":\"1\",\"style\":\"link\",\"tabWidth\":\"500px\"}]},\"name\":\"links - 9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"print workload_response = '{GETWorkloadsAPI}'\\n| project parse_json(workload_response)\\n| mv-apply workload_response on (\\n where workload_response.managed == 'true' and isnotempty(workload_response.risk_summary)\\n | project exposure_severity = workload_response.risk_summary.ransomware.workload_exposure_severity,\\n protection_percentage = workload_response.risk_summary.ransomware.ransomware_protection_percent,\\n updated_at = workload_response.risk_summary.ransomware.last_updated_at\\n )\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"protection_percentage\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"protection_percentage\",\"sortOrder\":2}],\"tileSettings\":{\"showBorder\":false}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"Ransomware\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_version)\\n| mv-expand keyValue = parsedJson\\n| extend version = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project version, count_\",\"size\":3,\"title\":\"Workloads by VEN Version\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_managed)\\n| mv-expand keyValue = parsedJson\\n| extend managed = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project managed = iff(managed == 'true', 'Managed', 'Unmanaged'), count_\",\"size\":3,\"title\":\"Managed and Unmanaged workload counts\",\"noDataMessage\":\"No workloads\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_type)\\n| mv-expand keyValue = parsedJson\\n| extend type = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project type, count_\",\"size\":3,\"title\":\"VENs by type\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_os)\\n| mv-expand keyValue = parsedJson\\n| extend os = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project os, count_\",\"size\":3,\"title\":\"Managed workloads by OS\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}}],\"exportParameters\":true},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"WorkloadOperations\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_enforcement_mode)\\n| mv-expand keyValue = parsedJson\\n| extend mode = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project mode = case(mode == 'full', 'Full',\\n mode == 'visibility_only', 'Visibility Only',\\n mode == 'selective', \\\"Selective\\\",\\n \\\"Idle\\\"), count_\\n\",\"size\":3,\"title\":\"Workloads by enforcement modes\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 7\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_status)\\n| mv-expand keyValue = parsedJson\\n| extend status = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project status, count_\\n\",\"size\":3,\"title\":\"VENs by Status\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_sync_state)\\n| mv-expand keyValue = parsedJson\\n| extend sync_state = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project sync_state, count_\\n\",\"size\":3,\"title\":\"VENs by synchronization state\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Workload Investigations\"}],\"fromTemplateId\":\"sentinel-apiWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"### Illumio Workloads Stats\\n---\\n\\nThis workbook uses Illumio APIs to fetch workload details and presents stats.\"},\"name\":\"text - 2\"},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"tabStyle\":\"bigger\",\"links\":[{\"id\":\"4de2c193-277e-4f8e-88b5-2caac1676e2b\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workload Operations\",\"subTarget\":\"0\",\"style\":\"link\",\"tabWidth\":\"500px\"},{\"id\":\"8b46c8dd-071a-4bd4-9d36-1247d8777702\",\"cellValue\":\"Tab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Workload Investigations\",\"subTarget\":\"1\",\"style\":\"link\",\"tabWidth\":\"500px\"}]},\"name\":\"links - 9\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"print workload_response = '{GETWorkloadsAPI}'\\n| project parse_json(workload_response)\\n| mv-apply workload_response on (\\n where workload_response.managed == 'true' and isnotempty(workload_response.risk_summary)\\n | project exposure_severity = workload_response.risk_summary.ransomware.workload_exposure_severity,\\n protection_percentage = workload_response.risk_summary.ransomware.ransomware_protection_percent,\\n updated_at = workload_response.risk_summary.ransomware.last_updated_at\\n )\",\"size\":0,\"timeContext\":{\"durationMs\":86400000},\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"protection_percentage\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"protection_percentage\",\"sortOrder\":2}],\"tileSettings\":{\"showBorder\":false}},\"name\":\"query - 0\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"2\"},\"name\":\"Ransomware\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_version)\\n| mv-expand keyValue = parsedJson\\n| extend version = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project version, count_\",\"size\":3,\"title\":\"Workloads by VEN Version\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 5\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_managed)\\n| mv-expand keyValue = parsedJson\\n| extend managed = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project managed = iff(managed == 'true', 'Managed', 'Unmanaged'), count_\",\"size\":3,\"title\":\"Managed and Unmanaged workload counts\",\"noDataMessage\":\"No workloads\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 4\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_type)\\n| mv-expand keyValue = parsedJson\\n| extend type = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project type, count_\",\"size\":3,\"title\":\"VENs by type\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 3\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_os)\\n| mv-expand keyValue = parsedJson\\n| extend os = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project os, count_\",\"size\":3,\"title\":\"Managed workloads by OS\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"showMetrics\":false,\"showLegend\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 6\",\"styleSettings\":{\"maxWidth\":\"50\"}}],\"exportParameters\":true},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"0\"},\"name\":\"WorkloadOperations\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_enforcement_mode)\\n| mv-expand keyValue = parsedJson\\n| extend mode = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project mode = case(mode == 'full', 'Full',\\n mode == 'visibility_only', 'Visibility Only',\\n mode == 'selective', \\\"Selective\\\",\\n \\\"Idle\\\"), count_\\n\",\"size\":3,\"title\":\"Workloads by enforcement modes\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 7\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_status)\\n| mv-expand keyValue = parsedJson\\n| extend status = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project status, count_\\n\",\"size\":3,\"title\":\"VENs by Status\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"customWidth\":\"50\",\"name\":\"query - 1\",\"styleSettings\":{\"maxWidth\":\"50\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"Illumio_Workloads_Summarized_API_CL\\n| order by TimeGenerated desc\\n| top 1 by TimeGenerated\\n| extend parsedJson = parse_json(vens_by_sync_state)\\n| mv-expand keyValue = parsedJson\\n| extend sync_state = tostring(bag_keys(keyValue)[0]), count_ = toint(keyValue[tostring(bag_keys(keyValue)[0])])\\n| project sync_state, count_\\n\",\"size\":3,\"title\":\"VENs by synchronization state\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"minimumIntegerDigits\":1}}}}},\"name\":\"query - 2\"}]},\"conditionalVisibility\":{\"parameterName\":\"Tab\",\"comparison\":\"isEqualTo\",\"value\":\"1\"},\"name\":\"Workload Investigations\"}],\"fromTemplateId\":\"sentinel-apiWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -743,7 +764,7 @@ "description": "Create Microsoft Sentinel Incident When Firewall Is Tampered With", "displayName": "Illumio Firewall Tampering Analytic Rule", "enabled": false, - "query": "Illumio_Auditable_Events_CL\n| where event_type has 'tampering'\n", + "query": "Illumio_Auditable_Events_CL\n | where event_type has 'tampering'\n | extend ipaddress = action.src_ip,\n hostname = created_by.agent.hostname,\n ven_href = created_by.ven.href\n | project-away resource_changes, action, version\n", "queryFrequency": "PT60M", "queryPeriod": "PT60M", "severity": "Medium", @@ -768,30 +789,30 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { - "columnName": "created_by", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "hostname" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "action", - "identifier": "Address" + "identifier": "Address", + "columnName": "ipaddress" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" + "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "Illumio Firewall Tamper Incident: {{IncidentId}}\n", - "alertDescriptionFormat": "Illumio Firewall Tamper Incident {{IncidentId}} generated at {{TimeGenerated}}\n" + "alertDescriptionFormat": "Illumio Firewall Tamper Incident {{IncidentId}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio Firewall Tamper Incident: {{IncidentId}}\n" } } }, @@ -862,7 +883,7 @@ "description": "Create Microsoft Sentinel Incident When Ven Changes Enforcement State from Full/Selective To Idle/Visibility state", "displayName": "Illumio Enforcement Change Analytic Rule", "enabled": false, - "query": "let enf_state = dynamic([\"full\", \"selective\"]);\nlet visibility_state = dynamic([\"visibility\", \"idle\"]);\nIllumio_Auditable_Events_CL\n| extend temp_resource_changes = parse_json(resource_changes)[0]\n| where event_type == 'workloads.update' \n| extend old_mode = temp_resource_changes.changes.enforcement_mode.before,\n new_mode = temp_resource_changes.changes.enforcement_mode.after,\n workload_href = temp_resource_changes.resource.workload.href,\n workload_name = temp_resource_changes.resource.workload.hostname\n| where new_mode in (visibility_state) and old_mode in (enf_state)\n| project-away temp_*\n| project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by\n", + "query": "let enf_state = dynamic([\"full\", \"selective\"]);\nlet visibility_state = dynamic([\"visibility\", \"idle\"]);\nIllumio_Auditable_Events_CL\n| extend temp_resource_changes = parse_json(resource_changes)[0]\n| where event_type == 'workloads.update' \n| extend old_mode = temp_resource_changes.changes.enforcement_mode.before,\n new_mode = temp_resource_changes.changes.enforcement_mode.after,\n workload_href = temp_resource_changes.resource.workload.href,\n workload_name = temp_resource_changes.resource.workload.hostname,\n ipaddress = action.src_ip\n| where new_mode in (visibility_state) and old_mode in (enf_state)\n| project-away temp_*\n| project old_mode, new_mode, workload_href, workload_name, TimeGenerated, created_by, ipaddress\n", "queryFrequency": "PT60M", "queryPeriod": "PT60M", "severity": "Medium", @@ -887,30 +908,39 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { - "columnName": "workload_name", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "workload_name" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "created_by", - "identifier": "Name" + "identifier": "Name", + "columnName": "created_by" } - ], - "entityType": "Account" + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "ipaddress" + } + ] } ], "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" + "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "Illumio Enforcement Change Incident: {{IncidentId}}\n", - "alertDescriptionFormat": "Illumio Enforcement Change Incident {{IncidentId}} generated at {{TimeGenerated}}\n" + "alertDescriptionFormat": "Illumio Enforcement Change Incident {{IncidentId}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio Enforcement Change Incident: {{IncidentId}}\n" } } }, @@ -981,7 +1011,7 @@ "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", "displayName": "Illumio VEN Offline Detection Rule", "enabled": false, - "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent_offline_check'\n", + "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent_offline_check'\n| mv-expand resource_changes\n| extend hostname = resource_changes['resource']['workload']['hostname'],\n workload_href = resource_changes['resource']['workload']['href'],\n workload_labels = resource_changes['resource']['workload']['labels']\n| project-away resource_changes, version, notifications, action, severity, status // action field will have filtered ip addr, so no point of using IP entity\n", "queryFrequency": "PT60M", "queryPeriod": "PT60M", "severity": "High", @@ -1006,21 +1036,21 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { - "columnName": "resource_changes", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "hostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { - "aggregationKind": "AlertPerResult" + "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "Illumio VEN Offline Incident: {{IncidentId}}\n", - "alertDescriptionFormat": "Illumio VEN Offline Incident {{IncidentId}} generated at {{TimeGenerated}}\n" + "alertDescriptionFormat": "Illumio VEN Offline Incident {{IncidentId}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Offline Incident: {{IncidentId}}\n" } } }, @@ -1065,6 +1095,354 @@ "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Illumio_VEN_Clone_Detection_Query_AnalyticalRules Analytics Rule with template version 3.2.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", + "displayName": "Illumio VEN Offline Detection Rule", + "enabled": false, + "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.clone_detected'\n| extend hostname = created_by.agent.hostname\n ven_href = created_by.ven.href\n", + "queryFrequency": "PT60M", + "queryPeriod": "PT60M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "Illumio_Auditable_Events_CL" + ], + "connectorId": "IllumioSaaSDataConnector" + } + ], + "tactics": [ + "DefenseEvasion" + ], + "techniques": [ + "T1562" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "identifier": "HostName", + "columnName": "hostname" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "alertDetailsOverride": { + "alertDescriptionFormat": "Illumio VEN Clone Detection {{IncidentId}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Clone Detection Incident: {{IncidentId}}\n" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", + "properties": { + "description": "IllumioSaaS Analytics Rule 4", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "source": { + "kind": "Solution", + "name": "IllumioSaaS", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "app-integrations@illumio.com" + }, + "support": { + "name": "Illumio", + "email": "app-integrations@illumio.com", + "tier": "Partner", + "link": "https://www.illumio.com/support/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "contentKind": "AnalyticsRule", + "displayName": "Illumio VEN Offline Detection Rule", + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Illumio_VEN_Deactivated_Query_AnalyticalRules Analytics Rule with template version 3.2.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", + "displayName": "Illumio VEN Offline Detection Rule", + "enabled": false, + "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.deactivate'\n| mv-expand resource_changes\n| mv-expand resource_changes\n| extend hostname = resource_changes['resource']['workload']['hostname'],\n workload_href = resource_changes['resource']['workload']['href'],\n workload_labels = resource_changes['resource']['workload']['labels']\n| extend ipaddress = action.src_ip, \n ven_href = created_by.ven.href\n| project-away resource_changes, action, version \n", + "queryFrequency": "PT60M", + "queryPeriod": "PT60M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "Illumio_Auditable_Events_CL" + ], + "connectorId": "IllumioSaaSDataConnector" + } + ], + "tactics": [ + "DefenseEvasion" + ], + "techniques": [ + "T1562" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "identifier": "HostName", + "columnName": "hostname" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "ipaddress" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "alertDetailsOverride": { + "alertDescriptionFormat": "Illumio VEN Deactivated Incident {{IncidentId}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Deactivated Incident: {{IncidentId}}\n" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", + "properties": { + "description": "IllumioSaaS Analytics Rule 5", + "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", + "source": { + "kind": "Solution", + "name": "IllumioSaaS", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "app-integrations@illumio.com" + }, + "support": { + "name": "Illumio", + "email": "app-integrations@illumio.com", + "tier": "Partner", + "link": "https://www.illumio.com/support/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "contentKind": "AnalyticsRule", + "displayName": "Illumio VEN Offline Detection Rule", + "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Illumio_VEN_Suspend_Query_AnalyticalRules Analytics Rule with template version 3.2.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", + "displayName": "Illumio VEN Offline Detection Rule", + "enabled": false, + "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.suspend'\n| extend ipaddress = action.src_ip,\n hostname = created_by.agent.hostname\n| project-away resource_changes, action, version \n", + "queryFrequency": "PT60M", + "queryPeriod": "PT60M", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "dataTypes": [ + "Illumio_Auditable_Events_CL" + ], + "connectorId": "IllumioSaaSDataConnector" + } + ], + "tactics": [ + "DefenseEvasion" + ], + "techniques": [ + "T1562" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "identifier": "HostName", + "columnName": "hostname" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "ipaddress" + } + ] + } + ], + "eventGroupingSettings": { + "aggregationKind": "SingleAlert" + }, + "alertDetailsOverride": { + "alertDescriptionFormat": "Illumio VEN Suspended Incident {{IncidentId}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Suspended Incident: {{IncidentId}}\n" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", + "properties": { + "description": "IllumioSaaS Analytics Rule 6", + "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", + "source": { + "kind": "Solution", + "name": "IllumioSaaS", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "app-integrations@illumio.com" + }, + "support": { + "name": "Illumio", + "email": "app-integrations@illumio.com", + "tier": "Partner", + "link": "https://www.illumio.com/support/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "contentKind": "AnalyticsRule", + "displayName": "Illumio VEN Offline Detection Rule", + "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", @@ -1075,7 +1453,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "IllumioSaaS", "publisherDisplayName": "Illumio", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

IllumioSaaS solution provides ability to ingest auditable and flow events from AWS S3 bucket.

\n

Data Connectors: 1, Workbooks: 3, Analytic Rules: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

IllumioSaaS solution provides ability to ingest auditable and flow events from AWS S3 bucket.

\n

Data Connectors: 1, Workbooks: 3, Analytic Rules: 6

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1133,6 +1511,21 @@ "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" } ] }, diff --git a/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json b/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json index fcba9bda4d1..1f0eea09450 100644 --- a/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json +++ b/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json @@ -14,7 +14,10 @@ "Analytic Rules": [ "Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml", "Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml", - "Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml" + "Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml", + "Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml", + "Analytic Rules/Illumio_VEN_Deactivated_Query.yaml", + "Analytic Rules/Illumio_VEN_Suspend_Query.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\IllumioSaaS", "Version": "3.2.0", From 0740f560eb18ad6f605195261dd6ae883bf32ab2 Mon Sep 17 00:00:00 2001 From: ashwin Date: Mon, 7 Oct 2024 10:15:50 -0700 Subject: [PATCH 02/11] fix ids --- .../Illumio_VEN_Deactivated_Query.yaml | 2 +- .../Illumio_VEN_Offline_Detection_Query.yaml | 2 +- .../Illumio_VEN_Suspend_Query.yaml | 2 +- Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18691 -> 18825 bytes .../IllumioSaaS/Package/mainTemplate.json | 24 +++++++++--------- 5 files changed, 15 insertions(+), 15 deletions(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml index c922cf1c2e8..34e70b9c0b1 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml @@ -1,4 +1,4 @@ -id: ec07fcd3-724f-426d-9f53-041801ca5f6c +id: c18bd8c2-50f0-4aa2-8122-d449243627d7 name: Illumio VEN Offline Detection Rule description: | 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml index 8d6ad837515..3d9ff5f2135 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml @@ -1,4 +1,4 @@ -id: ec07fcd3-724f-426d-9f53-041801ca5f6c +id: 93e40501-f737-4281-9df9-505aa773d983 name: Illumio VEN Offline Detection Rule description: | 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml index 7db0cada50c..856c6bbb123 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml @@ -1,4 +1,4 @@ -id: ec07fcd3-724f-426d-9f53-041801ca5f6c +id: 7379f752-18a2-43ca-8b74-70747dd792f8 name: Illumio VEN Offline Detection Rule description: | 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index bd50f128bad28a665d055733258f7a33d69c3d4f..93e47f4344d4b46e8f69a060ba5b1754ebd5fc41 100644 GIT binary patch delta 16665 zcmX_mV^}6o^LMswx7oI9b8WV5yF1&p*|u%lc5TL;+l>D{&--4_r!&{!H*?PUFz3un za1v-_GAN>wEI0%P2nYxa$eprO1ELcQ+`m=pLTUF(PB=LNh6KRbxc~eCr+<2#xTBHs zx4D`khfP6ZoHR5#pV>+a>9?e@BnA-CkB){E(kepXkuK=*UgDqT=7~BZ=De$G4smR3v|@fx?&5Kz9b74kQ#};? zhX`&r6ZUw-Jd|*5Ndg=;x+ny?>`W(L$f7vo!#oF1?2`#I=4S%*%*;NNha2^?bx`(q ziy`JO3P9MU6iWj^i1l#V@XM(@ioOKf)Q?i(`@GSa5*q_NdsA)-*Sdl!CmcDezg$w1 zi-zGvep25(hv+IH8ez3waJ4_n*!DTkY}=j^<*3Oapbizt(Yi@XDOlx}B4Aj-SmBW5 zNZ|4Wj1L`JyeFx&EgcWr2Jh=-{BTv~raU?|?S6ET6d6P#eXSp-^>}_NDjk`M~aXG$@ z^3x`ic`{InB>gddG79g~Z|n71S^YW5Sds1K;sD&hPm{&i9BU^^zf@FnP>B#oS5|V)MtfQP-|Qw;Yfsn+ zHR=Ydo36G^>UrhS(aqBoTmE zYKC`Rr03cN$5`!x0YcaptXSUAJZG6aTg+^J3LfXBB3GL+Q0pEBF||aFtt6&AA7jdt z&~(aBVc~}zB;-m`GAed;uE_%#6vqe%QK*oEWb}(lWIKJ9^=2*uu8;W{Mw%)Q<~YAz zdHxrDQGV2my_lfAq|H>gVN;=H`8Yr=A&P&B2_xdkInYuTEKq%!Rm;*r1#8pHwBQrM zte{5@Yg5*&K#y)9>xybB>*~0BLw`IgXOLC>tcd)sv_6X58uRkCsY(6|nDS?C7X4^$ zmh}rre>|sv`vv6J`bVD55hT+0ihXlGkH0Sff;SeD+MJx7c6ZN8vYHBX0duqTv8KYE z#XgRP?ogkl8+L?`(}{j(>7V{xX2c0jWj2Jx0jAv1@(ExZQJ5zgy+eoznNk?spQX&>)W~ z#6td?S`z}>3=dgEE3@4z`ae4gR=Xt}(1eS2PnirZ+c%Fh_V4v(NZEJ&Kn|bOl^c)j z0VAn@NYj!3LmCbH9}@TfkQn~}cI^KH6}bb9w<|Mw+S*|uf&Ima^UQ1Bw8d-NYFou6 zSnt-owG%X>RQNBVEkF9Kf@PA)2m9wcueRj`^^=`lwB4)UCwkgT_JncSVqJ)698g1} zjhiP%RXdzH_8#-s?ns+{Wp#%;yC?r|S6e<5y9`_r_uX4QzPkVhj^f{5&xWu!L@ED3 z&{IPO+V^a-YQ*~Mwi*~79G7o0Kh68LJo<;N;*s6Ded>8`QqOzYZ;1HOZc_2Zy>jJdS!-N)kJyhy#~&k%ZRehGFsnwhO@r z+pGopKk-zc0dNy>04Fl1(^uwQLxXwKT0d*`oRe3NPVe6yhJxbB$&G%sPtRujLYihr zk+42Zz`e^k>&Zh2@%R52(i-qj^)r+I`Q@r^9>iXKLWYYqjhK(w^~)86*#5`9FfS-q z!g?4(x!rdAof#gQ`^=Ap1ae5~{)*!_V{=x$9YBKaB0!NvQ(;Q{yklAdOOmtsicuvs zvUwZ}^H}=BclLvl?Zv#(zlF`a;yZ}Cb=q8tGD~r=|GG!&dP$$9^msU*ve%Zx@37tp0#MXmo0MC$sbPd1mR1h&e z`e~WO9Pp5MDw#%+(qC>PEg1K04DnUOp$oHguQS}zLlv( zz6O3Wbdq@Er{nN$oMHL~@2B&Pj9;OavTqbCnevf4ohj`RzDSfa=NHHckjwN$T zgTlT%oFBGk<5=i~`4jFOU8oYaq$Y4Lz(G8F8DNE?lN*9DMoGar0HZ(&h7lw6BgCmN z{g@xcZz~ZKb@*G|T2QW#C=6Kc@p3Q|ht{8icP#^6>KcEtR1qq!YtycULWhK<*qj!p za`#ts0wobr7D6kF+*$SzHq;#A5Yzmz4z0;5`+c-8mKw&y#MLIdQ$^Gbhu$tOkh>#^*<*0s_|ft2K8}YYI_0&ZT}F;io5Z4T#G{B$aNo z*7Fuwj3y+6se5q?;jdDxU$GOmL?#WXmD~^^8zJ^$wXk3*5mXLuvs{RC6iQ64#a>_U1<-7pdA40(0& zCvVGgjG88{uQ6nfr31;7&R4pP1~|EkYCff+ue&@l)IU-N9H7!Y##(`_)F?B@Q=-7| z>_~`Al_!Sv9Y{vKv8)4TtoFO=K{uu1Aq~Mp4LQe75N)-Cv(DZPF?4DjN_F(sSOOp9 z&rBQ$-Ss6WeNIiMPD+oxW6C~imwVbx=Zd(~FR;%;KWKqDDH`7tMV~N70OlkfYg8}i z)<>zHO|Y;@yNA1EL?Aq7%~6#TdzO*&hBiXxWj=d&oJ6$Wemes#gvfp}AX};OHn!Vr zYhXLx=@y9>-mqiKAbxi)7j*p3L=`r%L5`r0I@kIhvB9VJ$Jfs7&cc?)`PiQRC)3lI zkU!w>d)1#C;yr$!RLVzMKuYQL!p8Q4F2K3reMt%o4aPgLQ<`Bfpq13k(Ujz~dyP46 zY}Agqj5p%dpX|>%3KAN$hx~R(Wzjc9>-_W|KA@#w*1&9~5y1!yb@59PGURP<=$C+E zf59hn9|Ho-p;*C2oZAy(sX3AN#N$twpqC-l#E8y-(&s^3>CD4$fQf1)Mr;HK+MSH9 zHy!oAc0*?r7X$$$*&rDMCwC9RXzT}7FHCo+>h%NjsJ7LpDnBu~o zYPSYd7GXbte)9fe2f#7{g3yJ3g==XDp)owRXXJ`tq8SE@w`l;T6_!!xO4^_G?#R3~!RFsx)Zk{{UbS{6$A?*8lP}K0Alr!zc z-?IyIN>tzyIxYPtP$cnfwIk#Y8I~M^lPU4a`8_iv;30DMj!v_lzGEzGVe(cxYze`& zuNWw)F-Fjbx|b~_!-fOfM?CjO1E(VrkP!*SoamYQEWj2mw>l5z!!2Puw;roRh{w<* z6)phUIf#Y~!AIE($>syRRU;Pcxz!yMQtq_q&7BWD*G8HE(<>#X9Sx3n^Lb6 zxj&2;fJ3f}%E~rR7#gQqtiifM+9es-Rc#D{s4E^Z=b)z9Y$2~0D;N^OsI$!7gH7Y( zgbTqO*RLoEB906`1tl;9VJ)734Ymo!{e)Q#iuNPTpnkC^-eJk);PC{8H*v8ARrPZb zt>AY9m!|(`$FWzN8TCCY4?-`t^M^usXf!q`;P;#zq~Ruwhe`BoqNY^G0?QB*2Za)N zeC1s+UK%b6jiEqqvw+WNSOO3sKtk$)8%kSAo6Ke4`=IHY`w&ynOTucWs}XN0f;eUj zl#(sDL8F|)`9c0XeGg+3Kjk^siD>Ejl>}~EQ5;nsNZD%~lq5z@{Yx)85lD0CWz#qd zn1DF&prGLdMW>W#1y6Uk@K^;Q_2>L`c+73CPSDjFws(+ZTkPv>5Ftd24*cCbQ_umpn5UExY2jG9D;nO;n= ze;1k_5xcNbl@;)TzR@0+42J~%bb@HX2qX_}5#f%#b~Lx_P^lBOs)0@Z}6ED^~8InZ_YX{(ki5Pa@U+WG^7gEIae zcjhg_AM6+EI-h4P;4j+_Y>*lJ6t<@LIiB2y4Hts%k3ll1$QmABd7g&#fBvWfFz zaj<_vt`gA`&Lh@??jcIdZ!VygJr<Emmt}IF>_=q*L{@ecvtrh9!KfaS;8eJwMuVX@gjIl_ITLA}Co!8@z`dC| zJkn0qg54eE%1|DFm4td|re1`1nWeflGnXgH85K2R5X#?D@nL*|$gES*GWJvBDZM*8 zx(ae8$BTSa;k+0hQ-A*EEub_Glv~=r-+Kg-RazQXMV~`qM~&V9FbY01sxFpiQdzT? zL#A$F5lQE^ZP%tps~o6-g`Wf5WZ|BghzE=u?w zkLc(Vr$qmaif%>#DE3e@>Bg*ShF~-HUNUuhz_)CYn?0w@U37%o=C-WF3i?P@MW&iv z+9udH@z0##%hYLQtE;RVI;2WADZEW*TCq*>LuM6^Rp(+gdGpGRrqA7%auSMW1+~k( z4XG&jXmVE2m2&YfG(&wZr^y=3dyk}+($W7^c|lu5?~Q2&ghVGL_i*>rFi%{THSPG| zZLv1!ap_$NE-gPkG%^#4XF)YGf0AdJ^iuB>$z_I5W_0B=$3e@SYEs1(>CV5y4P47E zaio@5(M!)!zuez5x3b4ZFELd%!$W#amFU>!9b%QK(Yt@0D4b&z%TvEtf3in9kO&mU z7}_%+7Rmqso}%Z-Rns3bR!E9`J)~ut&F+(nkD+E^`oC+HO6d44I|rli6KNR=WMp4j z7tv%&$g8O(6#1?Uy*dY?hH4h!Dw~7KlGN+1cn1U;zuGc5>w8=SG0V(jn*$J+K-I8zi!BZ05i@HyrK8M;kZ*byq}E7rkBe8&u&?O<|mH13$k-NJ&GKkCJryc_sb6X z&X@kvU;_$0jGBX~NO)%@nO+b&j-6Gr8DMky_RMlPv(ZQqpACk+CdwNg zUUkI*xw$tVj=c|z5wM~g4jh@Me19JZ*IO0Isd~T8EQ1G(`nVdm^jx-WHq6^rY%+p_otA8qYdNmD_=0Ce(!i)!;Nx;u`&GQ( zLdkcI`*LqN;*5w;vn{gQh03v$icW50_jEo0^SrhPb9w>>^E~qy&7FGk6Mq70kMcK; zKXpM$v9uwX&KB@f{;=#49w3_(l08SF>w~{%kL=M`iupty=)@~W+au9*SW*wu6ltM< zVZDU{c=x1xOhr1c+eh3^eNPo~<6Yknm(GlgCY5TQ$l}oGrP~%K#1(JrAZP|h6vr9? zIh6ESe@JD(v>T~^U2Ufg0nT2xuZir42cQR>+W!{hQ^N#vSY+en!}LN%W3G~DhyG=h zzrSQo|6!YZe8HfA-Uz=l>U1MyXRlK*G!M$}%$n>tGoJJEa1P_tH8f#vF#_mR@Rgq8 zPjYr@h|$tT^{)Nxx? zl#umWRbf@PimzqMp+oM!iui7b|+$=^qOjz1{l;-LL4Bi=|V;wI}FIR2y(a5MULcn{HP zzuO%NgQ%tb&T(?OBq_f!))}QN@Gwpf$3>VJFGgl?nrrG%TIU{jWnS?NzGwfN=FA4> zjqHXQ0fA-Cn*3fbVYbRCn73GX(={|2Q!02YqM(Jn2=`}PQ!0QN|x&*>&1-j-Y784x#J z8D@UdlDpDNnnv{2lcC`Xq@*|xM1X%~9*t)ru&B4q3!?V+G@Xp-BQ0RJ+Y6pPVUeW; z)}>WpXT!{s@$~UyGNb?+P0JY2e*N&{cUtgD)W$|zYDYG`+tsml#1iL#RB#cY1(N>SMIS2c8Yy%LHywnG~kc`T&Q5!m5QL7*6V zxz3?Pd=hK=`}_Bbk+0ohyQ3ACgEC{ME(I`ShY)`o21&(}5gYcYW*l$IHk-89F(+g z56QH)PiQynO@M#-GfyGi8-#_?JB!0x7)pBsTmAxL8~zgPp+=zeFo3wv-@=wV!Ri8@LY}@{h+#|(P{Xf3G;YZj zZNM5ac}|t@GPRp*3$WM6zPR&qdK(V7K+V<>#M1J0Mj;bV9aXh4=AZWf4g_~NrbL9} zf4~gxZdGXJmtli5MEGR2R(^3f9Ql%SdjuE?MX$NXuV{xnUfFk9#Az4hZnV5HJj^%n zofs}(J&gg>ZMLlltDUMPOL!a3EJ?_c0eep;NJeqJ%SVS|VrB8JG;!AJe zW??3^;crf2u-TGB`2n?O?Y6p#I@P0Kf*AlWV&#D5_g*V(XbeAc3;HK7gMKxFr)CGz ztaNYtI9v3ev_GS6?QwNEPk#&@9p|sJ>=tjbc4q$s^3-n;Hc3bdl&!fM63-jkoEC<9 zO6ZT&q~Y(WZ)<1jNaI|j@2lZJ{c#p_b4sfQb;_nuaiSL0%bR!uFXK6TB3QDDL!JTH z`^*o_{M*!ekH5uyBO&Vj=5hYYr*BK11yR*f3_Wz!{^_cmP-{S?R;pf+u9Wo*)B zXiP%L=}2zFGx_aL9m+OIiSmroFZz%-F&Q2kx*|DO*oj8(u z&eO;v6L1y`6K3(s6nPa1dy@U7s>4EiI}H>letqTqcqudxXL8^ZMR_&9Vch|A-fS+d z$K+BynDGij`zMHuXtx?wk%Y`l|1REAQJUNGng5Gji) z?PSqPoD=aXxol`2D(bP1g2&WACW%v`FoH%{A|pi@igkj_iaGuw=f0;3=))*)mKt<& zac(NOltL|^3yv&bFhW163lq>rp^JXc_5(H14YIxnU0L6hg z?BIo$BY7rwW9$y|qxsPrG3l_cL*AMDVfiyZZ%^ZTHeS+M?^-sqUdk7LUr?yPy7ev> zDmX{4-rC9?c+lya8ef)fKs8!cK1O-s1y5Y^vXIaF=0epuO(G1xLDLbfUxDzhji2 zv_72Wz%d=YnJMbgBmiWps#sKfd#DxmjPZpP926f`qL~oXkcodQ&%ScSV|035#jGA9 z6GpDubUUfGp2NXUt~sBIbag%$>Ua?C6COU&cGrD120yL2ZHO3gXN`+4eob`%1N4c= z1rQ%RJqVlo>bsD}$FGz0%WR%%YR%kr$c^K8p#_$lY|Hqr2?4HI!6$fu2xoHmVK^%p z@J9J_k-l_x>f|&zi8elilWp zQP+4~A!6WGr|v$tAY#qkdW%Ms&x~}xpH!cy+TcNKL-vuEcEk)D!UN=Ee5`^%ZfS)-mcVwx9x&Veka zQ4c5MT|oa%c3onE9-c6*ihT{$!O?{4N7IzQRDU24Hqel$NoetXT8oGvdah6-<1lBU z?D4>g#s}>tA{>rAEQ7&eG4?EF2wxH}OcAxDtbWpR4{+@#`OZmb%ri68un}f94CIs| zT(WM}E?vP-FmG}oO#0%5kIoNGDbKyvXDzcDO=pjPg_PVrwSI;AdpV!cY&=AoZZ)#o zYQl83FMba{co!6572xqyR-H1fsKBtG!oFcKFleS>o&R@8^OcMXv$D!EUlI9?iYhgst@{Tyro4$gh&&J&yVz=j&jZ%EjbedL_RmM(q>aO>y%wV!G}R3)N|}m02StmzjBA`Zv`Lc2hvD1!=)Zuwcld<&M@c1 zh||rleO^@KJV(kB&j!%cm-hv0%EfG!+a~g@T9K;3n`GaH`GK)-=05ZG9-XWG=j$~b z)zrG{+gh{Uyhdz}A4XOQ6fJCvxJ7^0;sSJ?@S&@IhkOQyE2g&PscWHl!C6KH17c2| zu&2>r84X+7v_sfuPRe;$yW9bWNZR4#O&iXmJ^o!w4b@M0G2xu5fp_{c_j;M{jWT53 zmP9E~zwY)gzDPDed2o_fL0P1VH#oXJ15J>4!@-+22p)k?ayuy0Lm3@?9~P3vJI9ibr*zf^S0@M_6^oQX$oCF%s4Tf z!5r=K>*PH4?<4^IezQU%j@j}DDb86mI;gy=LOHGnLk*rXMKjRk{U$cpEZkfliI`yT zs_%Jz87q>Ta!BRfJ3Wqd?=F6w0IWZyE4B>~AlWo0=o6`2T6bp5!FI8Y04V7F&83XS z?wKj7%zGrdJh|l&y398JbTL6RC^_*fh$^4E+le5kp~BDV%|-3V$>cE=Z-QKgPnE=fbgZ5E#$T0q)9eR%T-S zmMEFY<5q^VVBgtWsxBqhEXmB5-JX+C!+07J3X8CU$*m=1^>gtLfZdIq{feNJF#Smt zIuxBV_j3(U(Slu8S+!cLSHN$v27LjSot=noy=+1iY8W<_h#IY|G5w`IOH79Dazy zyfp=v!kQ_00KBW*PDxRX83N=GJXenBj{p^RutUuvDCq2Rh&;QMzvM8NTdA{Xr>a?J zVO!R4BE&ZAR#h~%j(cl3=kf|o8CB-Z>P>Xht{Nu7TqEwIx#!l7g`Xu0Ts1$aGFs{y z93JpKGc#NUZtzbyqnb-*9 zj4ux)?M)%pDA=2~E>qVBWAtLB*UKzh#Mj^&ZoQnnTWUA^Bcdjs?+VIuJ`0;*d}qZ+@+EdzVbGX&3V`iKsTw!m z6;JO;z2(ZoJuc}5uy79eANkkT{%~@C_=jl-x~Rx;A-X7XdVDB8W<6y?$fMZSbcz8p znjji)jvyzz{B48toinXzpj0(^7B}fwZgbk9(Z#P;Eor3Ils~pGk^`5Tq&~mafz8#q z8+NE;{QN*9xhb+@fr}R2!(HAwj)TN38M!0$VKp-eK}k6yp^$EhA}x9SMf1yX*+p+k zuL-o?q_moGSx#+ia>Q>Ukbyg+P#*yIj={fDc|OO{X_gq?d-I~Kts7nnR>&PRkF5;F z7&Ta2IJ@|DuZw(o`BmdBg}Vp(dyd|>s*n1V|53boy%L)Gu>af&HnEnUSdxq{vQY#w zbiK@DQ6bBBuZ1JX;zb77PeIyxc@PR1^1n++w@ea!KsJXFdO2-LKufT%;yK_{fV?Pw zy+{wKLGQ~Nn@j3E@qSvQ>GutI9J3y+P17Q=dgKj+AO!b0I5ZEg>nPdw5NSqM<^(UHMo>KL>#vg3GI<&tFd2dP z@Y6-v;M%3EdPleH7LK%+uimuqt|>HczD3cE_*BeBCA}$XO8>@O-ZliNr%qEcdE=aE zJF$4;F(ta5&7>oB*$&V`;Fn&L;N1}=;dYw)+Je%DYgq&Dkl*4W2Z(<-2u!pcU*e^fXoV(H7U~p;NwN6}VB|YR}=S2Gyc`r)&e{UAP7b;jK zqpRofE}x@ndV~M+PT(vwfnryP+Kql4Q2QIpBO=$J~zQd|&g|9a)|xmX2cTErRbClsJZ@Pd`cfmD)%bcnh^!N+ zT|pJ@{ihF5A_R?q%e=pU$>#;*u8RX<|J^%E4q_P_&x+si9Fty_@|o2up2#bF`2lqZ zY{GIQ7vTBXlXDIV_UPF=emvJ?Jsf(|d_dlD!RCJrrjLBOX|Gm$HQA!)=uVM!{cr7P z&C{s0lkhs;WK=KL-O8~3ZIgxdkMoyRtD}`}4d8yfS*yEc^-n&#_D_DFTjFeIL#tYQ zWgPooYr3_kwu8;on=(8n59g2J?QM7`U+y#yl}_{8doK+^higb__ru?FUH4u>b-ue% z_mii3)k?43Y%8>RTnx3oyBB7S|Ixeo$A9f!`X|n*Q-19}7LYxDSXC|e1?-OC{nz@R zO5Mb1Pmzn~0~Ka&c5+w1+K$AN0{YXA=U=On!0Iqf(8;lY8yZk)uplD74>BwvD4Qj= zg}m73*$-I1xS;*0gYUdVKj~7e8ZX?jrnB(R&q#cOSt&$Ky5~JO;B&k=$sp&*9{KZG)?&>t zMw2{VysIU|{UEg1q^#AWAgKSQwnG9Yh=8xd+9RXyrcp`oly(UnDkOEj>`pLe=kNe{ zF!H#@cs5~4tU2LqhzA#Ot;zNrpMv*q(9Moh=LOJ|pxbp+3Rnl*2uvD5^6f^Y@q_JF`GwL%?ST*V+m#B$0X3?-)qb zAWJ69q$oh0mWwR*@%^L)@)f%+cnZxtUI%=U*#BGf2QqoT4-_SNcAB-2ul0gs~%C<Tbn74OW!9kjclUqoX z_WP8CI`$+UYQ;DR4yZt$;y_NRF|9Tr1@`S$Hv#?c7o0K?y;9-%WhwrE8vI<8uSjjZ z%W-u6YaF|t5Jirm0Jg21GMR7=GYd%f8338Hr)tY)M)U@LJ z->|n0423i;)p?{@PC4C0^A7XDZAK~`dyfi<{mkJM$ucRUQlmK=bC<9f>nG;t%yBmo zyl{tqA>b8((o9Rr7kJ?`6!phjc0rjFk|Q{HJ1~?NN=H-=c6FPsngXjMD=RAu!Yl7z zLsiFqKaOIxbD_yBPhn_wp)1WAXzLo^uPaukgK_%2OzRX#>;DU=RL zOS8a?wfs=1KB-LAEVpk})%Yp@GM%jiFE82}OczynfET63{wZIV=0Si>4}Zyt>$qz_ z@MgEfgp@J#g#tCZtskP-YfL2V@%gXW`D1T_V3bGZ=gbdI3MpmHH{~Gxg)m_HOzmWt z9KcR$1P5Y28MnbHiI)}Dy*uCvJViyyi9_PI9A7Cz(X+qg)K&JvI z*dM}tYj98GJoF`C4Qa_5JWnMoEdXDfb&S#V`Y#S-Se-jdt>!)ZR;U>1C!?_L zeRtXhtQMrcxif3h5InuKF)2)|}i?IkS;zPl9iV+`*Ldrw{j(n4C z{zw5R7xo2@jaz9h$)!OB@4q{Sk;nN(nn-9MFL9Lm8nW4Gwm`lP%RUbgITRVRYv_|z z)$RqY3l2V!AaQ?0+WyniUaQPg_G(tySucnbjG8z>f~A_%^x-EnQG@mRQNzEITAh+G zZ3X_7wK=hlwwR8o(4SCpyK*rAlQ$fF+t?TIu+=k)S6*i-^ug;V2^X#Ta3PUhx1U?~ zh`i=qdsOBgzCWjjhLq=Qw^Gg8klvt+1q$u#$ojXX>8bz>7#A9(<O`G?bW$Yv_aX>2oPWx?Jy8KS- zk%eZSQlXuJ28U*&=vRi?bcjDL;fq}$r&-2Xq#)gX?A-ZW-6b&d1h<0SoW81ds$JaENc?3{W0Vm3`s31IN%LKg7rS~>#|-u!$?>;PteK)20XV_+D)%3W?Gm`v z;sca7;_&i66_<<}d0Mv5Rt$vumjaa8l(Vn4wVzo2L@@1!F4!i=@3qEw?08)^rA9E4C-;7pWHtQsaQf*>!4uzM@m9Uw5i8`GM zk&+le2pT}DTyP|1gg1{yzQ!M7me^NOqdpch@axnIS+C*EKg!RGA8n0kT&#`BTJoySRV|8ZWq;&S0D#N@iO=G-p){gS`X*?0^QI|G&z{3q_z%Ufj$FKe8SNqcFv8 z9v&JOvF@ZFJ~`$K8_V_gER4I1@9}5lLjKy!9<-tzd~*MtfW1+<ZySw-rTS-h4(fyv9{+uLSATvw{A>?&~z|}*W?Q`D5KKdI>RiTH=jmq zZ9*8osC>RF{SIWTgI^9ohG7()!>g_gY&Y>u&U6pP6`jS0BDF$pgjDRFn>EOZ?RQ_qCn zd|hHr?-SQs{gy-o;YZA@vxlfRN2VI6?)wEs2K{y~&GtM3> z#r+J^B&prf6ZXN8*RW7|&(WG($Krbxb~Jk5{ilK>)V*Gau$O|2{f4;xhJffUvYtOX zY8(Y11@-m$x7eNDLTtDGFT^iFI9->cf$FKoU#!sL0v81zJPVTyBiFK&Z&#uC6T>lp zP%BrEZZdMyrI=*Qwh$)KpzbWCHSRz79)~yxjL`91U)>bFq#+~RaR@({hFQKKzBD%O zJ63*3n_@Gg1JUF6PD!BpEurA1L^@hH3 z?pMkfX>%~@ioU*FDUE6oIKG?%?1^M^@RjE@$nslAQ@zDe!&F-Du{1Cbp7}<0OLB`?BexC0p|w~K|AI}-EgokmYsLDjlF7$ zhUVUx0Q4&8l`6MVSws$1GidA{dd{yD%TI3=Qs-)bSf`l_YT<2x5(HoY`iS^EJVq&a zV4LgdU0yuO1fzexDb|GCe|{&3?duk(rFs(gPOycWo(6@be(f8*N`lD!xgz}e6aJUK zgPL5R{ysQU=#zEt9U>QWQbQi;CtTcv8l0FQk?ox_|GM)Lh|}M=9|AWP}3)}EW8|k!%EJMCZghKAuEQ@F3Si!Mbj=}WTfIN z4q_i!ihNcvFun0=qVgfL}?_HYjKW39eCL<3EL&2glDwO+ad;datjW10*F5= zauJA$MW&lzeE3;N0i5d6nhuIlH0F$esIw+HRw4&2#m)+g3e~x|*4#dTfPi&*S#X5{ zQe|@R#gQ;HFpGz0+%j&AUy!@e3U4Gh(VBy`gtnR27!|RSJXJnU69ej6EU%GXxPaHv zYd<*kqZGe22ibXkaTk~`5%^RJ%|K^2d~=*%k_{drR)eGsNPScxY*vM4z$a=>QH9MS zYOdaQ(LT(V;EH$@3Hpt!tq#!v3HfqN-0Yf4(Ck_noXSAd+)W%W(xzTU=lzBLN@wtV zE+bVnz_)T9b!QXc0JpE>rmL?m$T)!SF0m!PdM!|`kFBOCwjU0f=9iB4UYXjnM1B*Q zra)O-{^nZ)Xv%!~)x|A4%X#auQ0_iJ`21=Tf+;K#OosFHb|w>`nY<}6Fk%pMp;)W- z1nxS(%$QR6nf(4|1XB3@y?Z)8mslx17rMFc$88(-(j$V0dA<}>CIrZ8`X4*0^e~}# z=AfgO-~nIRcxR+rk9npQ8eum$r5rH+Sd{>V6J%d_K(CHhi=Sm#P36s`&U^pvW;ZIb zIWXAMhA+#@2Gi2vqDF6`z7N~Mt^*M>T-(bg?NP)=0&{u7cqP&tIGH z?HrPl?%hh`-)XHpAHQ35$$m8NOe%Is2wlN5m3KG8x5sk<{de>?Yt>ym=$Nk7&P(jp zRqqJ_QHV~~)>73^-pTAT-Ww}Fey26uv(ke8%Mp`P|HNpkJ0aMEZDG>k2O6%;ga0o^9(+2B!?4-WB-%d}y!dWs zR3x2reE9!AIzD_K+3eV!$&Gdi3&5dl5MQIs1^LS=VXW8eA)=2#TTw&V%4W~x!pm=7 zyd3ch+2J7nuEavwy8IItGXA=$kJ_qTYCF~1%}F(#4r@9MJGTPYQW3YUfzn>v2_PV) zTubfyH`{w)&c^E}lI92U!SuD=$+UWYPX(J#iNJghchl6B0MGJdMo)3xBp^eNr-{qe zJWUl=aV4WhObB#AXCtGBY@DIImuWA0g?QB{wL+WRg!){{EDevy>{-wJq z@xPgAk>l|%8Nv$*=ShS2{;$n$E#$DPV8DwFGUvk@?fmYtL03`*faz<~S%)5}<$jIvyzG8W{c98P zvxQP^Q04F1#k`_0K{c>W5A_I3bx+{kCY0QX(BrCeRxJnnUi)M-d&)6TlxgnG`fIA< zGiSs1sAGW=)_}Ik0;KfvbMKI5B}Hh)|BEJSs6X%HgE3+PS?KDa4-kV))Ieq&Qg4J1 z%guZsYa9bU2XB8nDEf4i^5?By<(dB@=vZ_cbQ*Z-LLBhj_x%8fjdvwu#f-_L2M0gM z&7+!hJs3@UKwT-4I%6{X<_HzC5ki99$P3C5AM_JhwKO1`{E`w?9(59rt#IjmVEZwl^(;HxuQdpJ##z}HV94R)upJlT0vAk2PmRcDWm94jN~+PyQH=0 zo*E9Ey=E(gcc$ay_v0If_OeLOY8M$2(R~!8uzs&9x{A=FMq}%cN+TR;jQ#u&%CGb3u=$?+Ry`R;?(!?+U&X+;b{lr#PIblCH<-TxurgN zm93PV%Qvx`yM}*jVO;|kvUT}AXh-P=!hd7>NcO@5beYeN!KNREsrvAmXNvuZ; zfB%()hrp_*20Zpgu183`M@5$dFiiR5|JL~Sef*{e%3lgf&ZeEuDK!e)P%!0*&b%Wx zy!UykCx=^`9hk$i@X)RzCY~xSIi7bN&b)_B?oE`qzCdQ-6RC<*`A6B_IP937<8GVs z&_v7aT5j2$O(r*Zs+Y0cY>d5|BeywV`TKYKe*X{fW@Hj!h97k>xx&K<`KW^<9+qtH KJ%9%xFaQ848qCQ6 delta 16530 zcmX_oWl$bXur;m$f)j$fy99?2+#$HTyX)fa?h-t>ySux)yTgOSm-l|R?pAH}?CH}# zW~OR(t55faC4dLSgCogHK|*1Gfq}t+nfd>!L9&NK_-EB!t(W))1rkExh=9iU?Z;PI zrpfcT4boAMm$(AQ%DIh^ha%mk3o_G~iv@WyGDqn+1c{Z4wLM2r)4AN5ZmqIgED^kT zqEXw%#(kE=8k9U0#$SY>pP1Jtwt-gfp66P#r5z7^E3MM;>TmCt44<>eO_{)}Kp_YbV44cl z3)Xg0zxpJg!&?}3u?i3Rg#QR;1o5_fAuTtXGD(K5pp45BTzk68zM3l52@S1Y{PKq3 z8C~-saXeK+A^}BUgeSV6%E?`Gkw9si;2Wb6o8+3ou^Ow`3_m;Zw$8 zOaCekZNzRb>LF_h?3I04C^YoEqy&~fG8?!f%-ToI~fo@wc#z$eY*~BhnnYqRrB~B11+{4k_#z|_Ub4t`!}-c zVpy0%!RbbR6gbo5AEsB1;6!vzY$#kh4Nrom8NM~dj_BXrftEF`@^qWNxP0*Ngbks; z@y0>Cq4GPLm{O!``mQcvDE9ZZqUDj~%i!kz@&(3MQ6IlrFed~$D>SdXP6SxF2f1!-|{xO>vy{nSrHiDxx!_{LoviU9t+2WP$)bJM$_8FP#D?#6HP z!6*ua2Wt&5geD0LD$4mZF&&2t|6%G2noDZjy?W z)@*=98}^w+O}^e-Q$na?f4?8P412jfQb?H9cd9psGhgJbR75LDhR=E`Ig*dlDOjo~ zQ_?7#;kP`Xq9AYVbtTMiBWgJoVpLaac08;c4}_D9F=B*XI`|#aK=`T5v#1|$7SlPE z4gY+EAN}c?M(30=`m;&FkF!lKnX_%oy{;{m)3eaHd|pg$N5&j;Xq<-Q&h(1^xlT1m zz*8<(z;o=Wt|?K#Q~9ax(dfCZDN_LPSM31ud*6ETmFOq5iI~{NVCjH}r(vx1WUvJv zCD6n+E4*6#-oaPq+Pu~HlGWkI?trXi33RR5gN~b*njTpMX)*^W#KUr;y>Q8wWov0} z-SZ_MS2D4gp6Fo0@iEgncZpo)^^Z-A@&~q}7frV35d)j;s1}0zd90XB_V&iy2}j%4 zw0qk&M%%|MkdaY_Djk;_j?JbTUh;*u0B*ZSl#0rY?^lm&AR%Ci`f6CV1ucy-6p+1e z>59CHKSU7uh=+c~z(V==bOT{S^>9OsnZwDWX_n~k-6eN$pZD1Yjj%?V>#LL-(4_m% zX589*hTYhF((Y`0ERD7Wkhk-cjJE~IxVv8WySZK`U0-fn9&B`wx3{ULxju6I8&VFo zdFsMnU3%lUXSgWiZQ=Gsyf=hU<~xjbCMs(Gp~Z9{_o6ze)p_DG8C7g zf))Cw-ti<7#^#Md9KM$y_~=s~@o984mNUC?QZe?YD?cQ`#~Me&cT^2M=X*cRjh zrxdr^6}L$E&e$^kv$yh@42@mU7d&%Shscy-X`v5xr0_j4;2=^uF$);e+SlI~Ub}QK zZV`|0Qc%y{pDJG0r3tVtI#uP#SAAg&GZ?aXbo!IpxGYGzFN`>vyM(b+|DJ@+6!b=m zWVX-MMVL~C^GommH+u7m#O9YK5{*Zpcyb=ce1SM0Ed({%$ZsLXJ()gqdOxbBN^>$Yg>M3dunHD5Fr<6 zoWPx*iEt1SViJc^!u?k|c6YHus8&R#K_5#y3lR^JLmgyFBs0Hsw+VBQ7?2&CK=5rM zi#EOfUO4*~==?UvG1VvPeuQu%uy(QAwwseh_LNQ9N>@m78x2qhF@P$@0*4taMjz!; zm~=o5ZMhhZrrrh0*a(XhP=tNvdAx2sq!71dQCthbSzCwhPUb~PD%sb0Los0^C|9M1 zN}oOQj6;`$$^9!QP=g9@0)0siRpF!<10A4 z!hoPLSV8xO$*DLV)AMO5)7Kqz+(EXpAnOTr>9$DR;)WRV--ANY{_hv7ch#)olNiIw|A*PEDn+Lb{D81VzqBQ z1b-ytAK*Hp4mP%N>2dD^`XY!dr_=FteR{uAN3jC{ZVzWSZB2bmVzxTQgn;Km*AwCA z+xx;*Rd5&J_I|FOJzXZB-Xdn|xb^5i0t|p+2&u%0j-d}J8XzI8Ne{P&g@aVI=TBBhC5Kx*X=EKc5no0D*q|9c*kb4qfCz^iv^nsH^BTQQ4`>PfWz{czH zd4J8=a}@?lkg0!Bs14=bvof!q8|TKmobQy>RxvnD%ej1yP+eyiL5HPqJJd%w|KgT3 zXi|HOsczhcTo;kg)wf5MS2y8}Bf#eg0&Sd>UHKstrwE3OvvY>nn>CvFj?HQLMAOaZ=QsE-gN9a&7WyIAh_5?Qp12kNM0 z>ib+&9IR@;Sl6m>XYpJHn9zO;!A(_ry+J&dP;i}AhyZVlQ3|1o~2rwDfE5GIb_!+kV)L2PoN%36o zQnTu)*$!Kya-STtvvR_%kwREc`oMeN&w)7`WcxFu7R0yaOq8dJE@daY;#(t~;l|aG za0gd7gDG|e4C`5Vq5`G+w@LwsDMDBrPV&wg`^sMpb>qRg?xH(Jw8EKhC5t4|mQpD< zS#z+^>b9Hqydo^z&`1P;9yPHq3&>(FEom$#ZHrMC^9SopWzA( z9GLxT$y|Mh6e`Nrh~5SpSUriaKk`tyxIN%4Ob$IsGB!!N!1_}d`C~6q-i#)(Paeq9 zUlS)VSttWwVMGo!vC)Df)P4}(4)fd89_S++qG#->R_m=;#L&+IBR3k+b8xM?EG~v+ zhJIUSdJ~2f-y#FIWDc)sBiDPo%725aiSw>~MrVj%*_s9LWfC_EHyZv9DKJD@uBH@J zRonH`D`u*7 z1vo(o-c!}%PqS*}iek7E8`1k3>iXg4DtJ6YGxEJ$Q}9qs+C=N2muh|QnP;Sp)A;5Y zaKM?m)(L0^kuc8nZNm}|U0JC$yD7*&_o{#uWg&1jp5ui9&cAW+InU*VA=s}=aOM8m zr-8>oETT)T)tP$1olJtMIkCy1!rNCV2SEz+@JhUl1pnkamN04@V7=XfA3vz)Wiul$&6jkjn;7}# zD0_6zc1t0sThabImFX+BUv3-;(=R3nZ6O&N0 z8n-NR96jR804>hH%NhiVrVlXJvP9Bh=Hm~L0eas@dk>L^`Z4q9!SLhei+qVd zZY3FX?8-Ix8Y`JZK}9B7`P?iQ>?U z1OOfWG*Y$SGSa~GDm!ZNZC)zKCtoYd@_~V8oObD1L~<)!_ZGmWsKRh;5`xm?&OPvR zDoS0fAK(l62wQyS(P9F_iP>v1WU4{C!{^xT4ByaFY4G2xwd3ke6T!CeMpDH-5KS(^ zO6+}0);UiMAT>mDc9l4w(XstnLL+FW2xO38kyAJz&B0D%^45-$>#t6--H&V?D<^9s z?Vj)@Y4npzB3@OO&&Sw}(Vdy;%adpIiW*aM2XD*yP`wZ&+6g*q`6{sGf)=)q4XlcA z0^U?vuLnjIo@pI_()L57ne-fVrLBmlF!!sZ%pozbMQvI9e05Y^ILV+l{!thf3+$j{ z{mgD#smzK|-I8B6e%(qQeo4*{_@m7Xqvnzz$Ion_*~*dUTTkKdUI;3qDeo%%LWOh5 ze=99%dCUDwE@z9xL6JuXQy}rG#)&wX$Z)$r|MGq8vsT0>U_iU8gi&Wag<+SLar5*g zSG!zQt3cW9MZ|r_pnZ^}-R?#k0A@NgOBVQ*T;v|gvtfr1)ipO#>s%w#&D0wwVNN*4 z=BzsN?$Za%*$a_CCgyBs1yki|9ChPL)e;`#r{>IM#eMsc&%Cy{bHtI*}Bm^2zM&-bZj>{1o1_IKg_HvX7Xf!QufBi=7Z>DcHOkeA4?lV+j;Qn6BuN z{>TDuKTlA~#@{5(k>z+gfV^C_NSD#s`yk_BovcdvVp?8{*52^%aoqHIvQkftvuHGh zq~%m1ay%D$?yWuHeHC*Er}h5D@ha8k+&z%BA5Cc-cEAY)t?UG@Ir#S?$nsDBNUk=Y2M@n?`N9PhtCtXSj4w-QV(TobF;P4kSq zbI&S=0rPMfv zgd?HKjT8!iRrlQB&+5CD3;ad?V3hbhyR$w)=C6UAN13>P;5xx0Fc*nbf*vcSZy6PS z$gJ>AEj<2^8D_BhPTBrh-eM@mAO?F)H7q^KPHKxbUQF75flQf^gZX*VGD1#!g=tj# z3lfF~#oGcHhiq2jGM;cZa%|dAW6Fxc=g30?K9EaCv^&(#PMSNv)IoC6`af^YarJTN{cI@MutaWK$ zFnK0va$_>q)!`)2DhudVx)vnZ!n2axAwNF_!I-2VP;K^;DzTsalnzBNl zo3YRhd~l4g4l)gMd2HOiahdnef1CWdo!BZzMI@h+Qbee`##~d8lkz{=*RgL?jC8jutK4}MQs-06yS|h!zgdT?-lf6 z1K|@I#oT4MD}?&cyQ6tjEBjl5BAME3PYTA#FAC*N!Y;1x2eP{A6f>rk+GY}Ja}8{& zMUm4rICI1=y`$p$_wpJvP^9n!mhq&XEd6R5im$()Tqaksd7yvkZnr*bEo+8qA$O`* z>cEi*M%=&M{%)KejZbJ0mq-KM^otyc04Ca0(p%ajEQp#(be%$*yPD$Lg~?mnKIg9? z$qeOS18bwZd=2PW!Dut^@8Y*^F=zOM zi9lWY&;Ks02(2OACyCf1m~Jh#Nr+zFuRd=9hy*<0b|Y6zRLU-xCsSY-ne2AJbrj+U zqrZcNhFE8>nf1(hbUEWgf8Ydmnyyy3p7C7HLY|Y;$S7tyw({tvb40p-B2|5Pk94ydW&JAX519IzD;9Ah=ZLjd?x+%=XapbYCx# z9(U>XA`qSKamb`S6S8`7)y2N^Fb>DiH0E)#qYwrcUJ@4M{f6sS94Tr5-5*G3t!-LV zpTAJ)tqMO#%j+VQt+nq|dN}97k74Yu@aR*zuMBk^>UGyd<9@+Nl}*i|-7iQpNI7bx z3zki<;&t~&RmCgw{_MCAzB&hsa`xDN1w!u{?;nv}-)C zT}!$EyJ+%jLKA_P9kR?i=a!Mbb{1nama$&y7A#@!2{bQd7IN%l5$&)^jm$?m``(8@D;25%JX*S(gW!zMuA% z#-^ivzwvN!bX_ukxF4$O4^?FHU1><05oG9|R$8<$>gkJgBXHb^@(Q`+u(k(Tw#9e8 zV^U}NklEt{TvhKi-`iEEj@<5qvQ9njh1hMK_Mtvr4nQByk!^G$vxcB>=kVILN6q^T z7R?|IgNo-*+tP3(h$;4B#(U4py@h|iXRLL zkM%zqKwfzUcPmKGP``28adQq-2q+i# zknNw^F*u-Id7cx-{nyaUe|(G~rH}e%KAI+v74Vo6n^VnfZ-( zC+uEJq9$d(Vu&$9NwMF=TuqIBBj@VM3*W!aNE3r)hyc&MBzSXtWO?AfF}gYKZ~dH> zzd0%f6f3yh;bOx-mCX$zH)Atu{*EjzsA=u5K#Qv`*Pkpi&n28oJ`PPhp&F|6rH_|F zJYi$W2!5cR)mMX*dC^VBt1Tmw&}32QkI&uJk|csnGl{Ej7JHC=-BkYIOKIeg>alxp z;?7Z*OeCHX3M{JOc_&lG(v`bo(+NB=P+TPiI^jr*=e$rmGUsG+{HXVr-`*3TzWCp0 z%!z4~!s`}lcNQ*;iGR_$ogc4of`VoXmF(zqVM#_OcK#*?4Vbb~if$)%=ScNq5Q znPRtVB;&U=SEe59Q6Dai+?b!jhq-U|h*A3xNe}VMF@{UdFz!#j#~x02=U(exrFS*~ z2~v<1X~Q3ayU(G*pF;7p@ko~%rx>R;9ZFYkoc7bTU!ApGZkXv<^wPBt1?@w}=56k(>NjlroVMx zd%LsIpJTD8REaTS45F`RRRV+$TgiCYGz(IIXNoQlE>hYV4)M-LpEoA2rq(vYhXxkA$hjF*$T`JiVc zUi1#HUtNdmjxtIfsvkFN8Mj2c1$^&fPSXYPKp^kS!3Ew0e#UK>PTp<1d11AU;$2De z8)M7St|YjL@&49h9`|xrviW6-w@IRo!!Mke)oYRO{fhGKV$G%Wq7h{fP{B?{E!!e^ zpljPWQ3GwqHm<#bz&CVF_2cU0(H2-YrHrWgbCJWjZ6p(=LyWHh;c|D&5+t%x3fMFDwbkxLX%5zHCn0ppN9f^S?3zP~d(VP{ z2uv*}7|Xe}X?#oHXEG*>DRElDkIsZ{XEWTaD#YT@2fBW}d1u#`dk(2u zMd9Dv9Oq--Lj8^CaQD_vvc@T_W(ilWLw)4~^WMcg-c-^GOH!yFb;$pRD4 zI*ROU3Y_Nv4w)O<^(D?3l-NKb4Vg|MqjV7o_xQfv*J)A!Ti1UZpP**VVukbOk19(H zgkHM)_MQ^gEoP3&Uszf-g%A{T5&Y$R?+}8?fhJds~*T+Ig!pYpthEb1TW88z@+x>avoJXp20!R+NBDI2t>gnOwTcDBcd z5@x_A`OWh-w+e_m3lc<|o5pC6u3l=szY8yMpX1|cT!41EPoiJ=T&pMfQIBAk!lBDS zI#^YMR@C!ihmC3Bmyp+M4wD|Ebjk`95Bm7{532y**h&3Rx3%mLH(nDD*4ykE=n)x3 z?7fe@S!R_K+QzfWN2lAkmVk9K^-hd^Qjr!Wr_4Z_^G;ut%T&%7JYlZk(Wjj!bYt>;LN8cT8H)rAO1_3sS@ffy0w$}c{lG)QJswoV1op~ay zxd~t%pbNXlq{vac>~@;*w_RF}!IJn1#jF!B%HZ)`d+VG>-dCWwF|+5oP>B^WUc#+L ziTYu3A$MXHRZ&vmXid>g&8edP%A7#bh9_B_F(Np#gyWtqHT)?oe`_d+giap{?>Rd? z9hQ5v&YnvR$DIYtryz#6%IeAJTmCts90B4fe9-qZMU=eVRijxOc_II33(3VUZI7NF zpWQETYkT7hDJ`2u$>@O+X<(@Q%j4iRg;W?NzhIIT59TF}-#g5s8wITpK6}6%!;i`i z%_A5DupyqxGXL4Qg%GaD&NK_q13}q)vWn?4z#*dJoY2D6`mn_oP@0|MnyvB-a|6|x zrSRcIRxGbEpVO9%LdtSg+OLZ4la-J6m{44XoGc|nIxs!qy)DD7^vY+n3xjcdGfR@C z7N;`u?BP{Nm{97Jao{LIDx8aQnz~<|FqS>68IL89&N*YpRth`S7(`XJGl<~)2RS#T z1%mx@jrG2luzfYk3?`l8?2biDKn0M5hMz`RfB%p-nQwkVMo!WY!tr9GORz4)rMvf- zXrnASibUG2rlk6pRBS`JmDH7rJ)&vNBG0ouOUdUOu~@3?^wRxfC6DSE@{Oga&{a3` zbv5GQtuY6o#Id4^$eac7-g4DPPNf;|-_-wX^uypmx0t}htzie^iY)f#Ndm#?uqwHf zC!Knw8FAl6^)&`~dtl=;^jethuKaS(8YJon#0Q25kQ&DyJRD#k{~oOd{C*(!2-p_< z`Xh9x`bnL_@ltSlg+1v?O4G5NF=erUlleFbQfQqiJ4!|k4`FqX^~;wg639D37o*9l zyei=q+3&|5RP>`U6_&Z5_QBl!X(mg0DDhU(vshmj)DzqtlGpr8-Q{>b1is#J6w ztQI-BS9~{%C2R>xOB)B;{)O~MoAWxnvMkbWMXz_{rdiD}G+ZYWqd$B6Z3qQ#NSSw$ znI&st7ZfY8^rsr;%X+>cNlWm|EVW+09YdNdgb!Zd?oZkL-4%2)EHfE3Vskc@|e8_1aas9i((>OzbcRQP1jXe*(KbV8P$!3NBT8qQ2EC)e)H>I zH0x>kUfJNB($1en{LfC=2&^CF?o8m0su4Q-KVZ4miT!0DD-PZ^*p#v9(z69RqVTQ8M4yz=>5vZB7CCbdIG`i1^MbSI<+Qe z!&0jrU0EeI@)g)&K9mu>eWjURWias*_ z(PBAKI(h~Q4@Et6UHB;7PGRkEN8;_0;)AE_qx7ac?vsjOVmptlJ@iwjgi+x3QQ#nDN6nSOFpXauJwfVBCv3>{CjS?uUB)E*1r?VHdZ4P4W31 z@(48*@L`rBg)i5>NkN3qKd}j_ed<;3d`#zkpIvomZ-JQySuYKkpzLize?wV&l4o!Y8j&$-}s2yi30W=gQAg zjLbrE+q#r*V+p-_!9K%cE>iXmL0_>o#@wfxfYe`!FfTAK49oN}t)~v@5!V-*SSIC4 z?g9Rzn*3E`^;_H7I^X$pQ&DbyXjnnwCq6V~qj}Nc7yV@#YT8rVY$~>3RPp^=bi=xt z^5lroOE49kAS(OaxM5STg42wd;qQZIK6O2MS!3t!=(Wz@y50H@bQMKq=mw_LByz`* z2!H@eo0b4ZZjU^kq3zq;K??nHpy}Gx4q;88n>X zjyAmSv-K=<7GtzEaDBhdo;1OS!}R?$TKV?|=^5^GOLSY=-sNd?TYYy3sape{FAhvPxdkx9S>kqxRf=f88MU(O-NFg_9vCNASeriPcpcv$ zV(<=*Uf={(wFtqf*iT7)%VoWxa?2D6!7(fs#K3|O9#93nq2vj{OE6DK!L*b9QI+!f zA*hr~W5B}yt^e%B zs*g@vBl|&vWt&!>i}lgpg-UA`t+vL8F{6vsO6|3OxQjJl`k!Ad-^IGjGkLYaxx1-`)g$fK_8@Gsji@F5tJS0Tc96T} zsAZ08%g>9uN#!!{&GKfD`&r7!|M33d|Iq*3HKG@HDvxvxQ)}{hAomo@dHyTle<)oP zIgiOBJM`JV-5g{u(R5s~pLt}ST>ty}g;kHLhDeM7-%>(|hl1jB84#fpf>3 zmGzANf)})d+4s3+coZ*dt#ZdAVRG}>)`rg5k{P2>t#a8Jw|qq~AsC1s+~rI+-9%R6 z=DHt}zfp=0ndZVJ&cQ(kSlwvuTula49Bzs4h`sDLby8|(sc5POpx-YK(3mdiMJ|)( z46a2by4(g87&g^7<^>R4R2!vrSJ7C$g#Z0y~h?+)BA z5gd=WVXKX}=;KO;+N`i%#YEz6xHMTd@H_!^p*o)TMe7hNesKc;JY+j6wI`xDv7BM? z$}mN(v%e;W{5o}VRFT<6?3_7!dVfgEdbEPIEw))Sd-Mhax4UYiO0ewU!B_ilc+0r#-F0$l|oN#-liXC|S|+%=@+`O}b#SB8(6c1lQI zo)nv*gcrS}-wA96e>5?%oXmFq+J+1Be@a-EV(iiYIGax0-|wV8cWKlvoPKZ1dv zj;9g#Fj%8}38%2;jD+^8Jdl*RVhdfn+h>WC4wXtgU->f5FdeG}3;>T%Recch6*+GF z!V>C>aX3Jm&w90i+lQi4y^PSrHc^vao@{sWw5mV*BLeM+$mQW-QK8@_reW--%J=57 z&<68+uNBj|YUg`UApsBU1}W2${E4)Zj*ee#@?WS@u_b#Kmx_yohUD>AMXH9|Y9wLZ zZOY2?}}&%#w^iaVGG?joe$ zyOPRUD#@`NTrk%N5`-cQy5|pOT@FVzYsbRB5tz;$sQu0k3QSm|Jq}n;`pUiK!YYHICd>X%NWcd#8 z_JFCdGQoK|d48wB$Sc_K(X){`_@0%d zQs%} zmM#zy%AalPu~oN5Tk~Xfyz{N%*EAw4Z{_hfh*9?|@uW|aeOlRTJaKmns?Mesyy)=C z{~)CP8gBR#$3gluKj>mbOo*L1Hb4QG;)5KP_!z#>46(7DI(2$|y##vr-|E{Q zd1LpsaT!^&abV}v&6(VFi85&QqWd5mov@ih5<_)wCXN$@ml0=6ui{&E{KKcom@Q$J zCrOsK3V$*|b>@I8TpL^s7VGL}6`{fWbX*#Kjz|()lbV=oTGNL-*|O;FbD-IiaL2PP z4OgR7ce8~gT(w~ux!)z~PXf4F=pR?Z+n+3k8F9NdP`6nFZ@{l`u-5e>M=|+irr0> z*=4e%^}S5&xQiet7Fa%Ox;eT;W#F4?2L8!$I}=Atl0KbDG-ywIoB+*=CM&jAAe|pu#Xc*r+|eg*WY%RpOGuCSK*Cq!AP@qPCOV-MXkvB>A5SI9mZ#gR{caJ zb_YJYT-#qMa{ zc|04U_3h@A{#jUdM9FOlzyBC1NS~)BF`we|C0&-PbM~5#0YE>Xg!g}T`jxNSYi5Bh zI0?y!nh$Ts$yC?(LD%-`T0jE)l*xs~U=xHOO0e&Xd3DXWOvaZjP+FUalc>YB7^ zmeMOQY!xl$7V~}r7pHchiuGrn+l`KRl>2^g?;_sbUl!>D33%uGiiyiJRw!FIr$ z8==?D_#52bP=YU0W#{60N%Ce}0wpnm?&EAtlmGNKKib9@h4{g?0f_vNO~QWyi7>VE z-^Z#=%E|%`GbUuA$ZImwA4nSu*os#7p}`DSQH5T2TR_hs{**T%(wgpa*I!tgig*z_ zq`vO1fz@xW@vi3yjr!8+X3OljGdO7;B%dnzsyDEo{4VYqS|+MTq>|WHW=ZaPSprA_ z&r-iUgfHmHnEL@F+0L7%kN2#4sZ3 zr;-98GXQN-eWK>n5!DV)x=~39s@53$>>1|evO=ZJLh5gz@v=JRQ>(~{I%W@)?5MaH zO-)MDJ)b{O+2RnQ#hJcwfBn3Swsz?vdDRKYv4y|)Hfju4!S}x(7^HfXI5H>SD;*i| z)@VgSV>xD})Er-NGaA;lM{f4*8y`d1FHMb6kpL|}bwq1U5D>>wl2i1Br<%f!yi#8i zHA%AuWu@LV#+Q%hpK%`(s+ivfB95ajUi*|h5iaxqZZ8RAvrPf}EiPU(bp6*Kn9Om& z5Y*>~hayjMU7p#pI|MZ$c_r7a{-UyaX)5F&!Uy^HOpAkPlgC2z_siZWBa6XawpK8m z1OTy189GOeTGp zLB9YZ1py<05}yip+lYAP>6=Xp%-z>g2X8j)5Z_V!DeyQ~-a1+^wJ!)d8Pd36{e?X= z@F9OV>$I_(G4L-q=HTe(9FbtxG3W+wr>QYFWGlVbR3?&{^rA)cQ)Nsdm1{Ob)W|+94caOUxuz=!! ztz#_rsBZsiym_kiJVPv(iHHff&BSH(^f^r_Qj~E%XVy+NOJn+);fWEs)NPY=6Kjlp z@xl(`v;2yjSEiSoYLkdKxr=(NItmP#sE*4lGt5UUh)Ny5xpgOrmK108=rrLn{Wcl7 z_`ZDk=hdU3bk|yL;N=eGt7#vyg(YyVu%$g4)bT&k zTB-H@Ti#aFiHl8ehbcK4eiy(7fp34ImBnBBvkMkNd52I`(UT>NNNSPmlDR4qcyvdrEIksBS*RORhqoxJa+Ry&*dMC z&dVxUIKqO>O-*YZdrikNZ#WdkbqjwB*q*(2f=Jle(m|qZw75 zHb=Hg|C(X8n(rP_o&W|iW(BB_fj)VEdpjt@XV*DBPX}DIFO^%${vh?-J%mkz2GY&v z4vz@$biJwM2g!aXyqB}kTTPj9e(g`*>RQ z+;qzWxTTz+I0&#hI-h-445&qmO=56pkZq(x#RIA}-h85A6j(>ST&d81I=wgUcMa4h zEQa>NE;Qj!XRr&c7;f7`D|%dnUMHOOjG&xo(~SF7LXzU$C-o%0g9hh(BTrARZ&3S5 zBCdzfl?)7%5+7U=Qvrj^ThmbfG4j2zF&<7gn-P$r_3Q(F=VNHH#Wrz(IV-fMKQWsA@Ba$5!8smZtruYWN4~+So#>RX~lJ? zzQ#KRWR2Dg{CczL&HG&A!lDICHH^;MPoB+C|C1r4wLnB1DMso#SbK#dsR0(Hj8kNx?(362l@Vc4e~ZQb)jgHRZjur_`QJ{p zvvT4tHipSrpbqIxo5Mm2ZpixvM;}^#I`>O(7k?`n(Pn|Yg2PQp{>z+YQovVjrcA^n zv(I}UH+S&q%StNJ@jFO_xko?H62=DzJvn=40?xxIR{~CNok&^R6zRaS2+cZ%8baGUy8fLNMRBk6^*t#o ziq^j!cH!}W=R2%aW>moHid)R&U%!Rc#QC;&yC~08z{I{5_Z7wFZ$Kya{ z30n4F*0n$%1cT~YR?q)kM^n%ynkh)x-(5X6;o(4;M7wOsBj{y+^f`HYO%QesZ*wtz|P( z)(?2yRvn*WEXL`#Lo0FugAy1p2|54DF5f?fv~RH8uatO-$N+yN!(Z{SWGRV}!dob| z*S$YK_AzcCmP=pxeR>?IFTqSebM9c>pIe{LUHgz3p<2+l`7%sIm(T8hr73kBxCoi~ zJOV!yKXj#D>Rb{+XE&&qCD>MzjG|mI|D5~eelf-qTTgF2(i8||4D^1nU;3a9S)#t9 zk-5;siGm@19R+M;_BParh!kR~{I4mlcX2>{)6lOG*8(-L{_O^y;H2=16A@v*nj}n& z|HzKjTNRom*U(gQ`TGBa3>K0!BIakV8K|?J&JW2h3tXO!>(S}M?JIY9)EL)|<$1Xa z%)B2qyVRQbB_zfK`$8jrXs6IzG)GoDn?t0M&(y9M;R&eQUozM>Om6zmL~!XNJ99A$ z`Yp{zL$HX@tmfNgo4w^lvV2-+AL0!=Rc=hr`2AC)_e!A=$05k|veOngqmxzr zM(Ob@U3~6~(9y)Af5s1Yn%moF4zZ!xjmJ|5-a7w)SMuu@(71Wn_lj6|vvGi*euS-y zxjrHnVFz+P-jxamHm$@{IfxIjG?ct*;5+BBFY@IOCJSM z+`SatYTI-ed<1t>U+Fdd960j22O00we*tY^9O^yaBxZuz9~+gm#j6LaUc}SPlI~yQ>W#jAdc=u;>4eViawS*BA%G-^2 z9x+r1Tef2D#Q*B1>RIsgvHAL>wWoct;``dhdF2@8+JM-6$>{v}--x&SHRAH+pO;>1 z|D&DMpj~Ri+mJCl;n55DjE5!63(2=_fK@3@sq-()FVMRw7}R-@;rh1b0Cq?g$+jq; z^xa@u=~>TCiooJ)M0+88r4aPbQugb_Em^p8!N3$NDFLGsHX5--YnSy}w&gFLCQvK> v+8b8c*Yd?(8}ApNkn&RC5EzjE_m6>u5ApvuC*(5*ygV)0GChDN5HJ7$SDMsT diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index dfcb7cd6266..071c2e7332d 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -102,10 +102,10 @@ }, "analyticRuleObject3": { "analyticRuleVersion3": "1.0.5", - "_analyticRulecontentId3": "ec07fcd3-724f-426d-9f53-041801ca5f6c", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + "_analyticRulecontentId3": "93e40501-f737-4281-9df9-505aa773d983", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '93e40501-f737-4281-9df9-505aa773d983')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('93e40501-f737-4281-9df9-505aa773d983')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','93e40501-f737-4281-9df9-505aa773d983','-', '1.0.5')))]" }, "analyticRuleObject4": { "analyticRuleVersion4": "1.0.5", @@ -116,17 +116,17 @@ }, "analyticRuleObject5": { "analyticRuleVersion5": "1.0.5", - "_analyticRulecontentId5": "ec07fcd3-724f-426d-9f53-041801ca5f6c", - "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + "_analyticRulecontentId5": "c18bd8c2-50f0-4aa2-8122-d449243627d7", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c18bd8c2-50f0-4aa2-8122-d449243627d7')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c18bd8c2-50f0-4aa2-8122-d449243627d7')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c18bd8c2-50f0-4aa2-8122-d449243627d7','-', '1.0.5')))]" }, "analyticRuleObject6": { "analyticRuleVersion6": "1.0.5", - "_analyticRulecontentId6": "ec07fcd3-724f-426d-9f53-041801ca5f6c", - "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + "_analyticRulecontentId6": "7379f752-18a2-43ca-8b74-70747dd792f8", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '7379f752-18a2-43ca-8b74-70747dd792f8')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('7379f752-18a2-43ca-8b74-70747dd792f8')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','7379f752-18a2-43ca-8b74-70747dd792f8','-', '1.0.5')))]" }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, From ce5e0e72b42f7177372574df269da6c3134a110a Mon Sep 17 00:00:00 2001 From: ashwin Date: Mon, 7 Oct 2024 14:53:37 -0700 Subject: [PATCH 03/11] fixed comma --- .../Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml index bb568d7e159..972804154f0 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml @@ -19,7 +19,7 @@ relevantTechniques: query: | Illumio_Auditable_Events_CL | where event_type has 'agent.clone_detected' - | extend hostname = created_by.agent.hostname + | extend hostname = created_by.agent.hostname, ven_href = created_by.ven.href eventGroupingSettings: aggregationKind: SingleAlert From 3452f1cb0534948a215ef0d5c4dc23bb61689c22 Mon Sep 17 00:00:00 2001 From: ashwin Date: Mon, 7 Oct 2024 16:49:34 -0700 Subject: [PATCH 04/11] change name of file --- ...N_Firewall_Tampering_Detection_Query.yaml} | 0 Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18825 -> 18822 bytes .../IllumioSaaS/Package/mainTemplate.json | 4 ++-- .../data/Solution_IllumioSaaS.json | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) rename Solutions/IllumioSaaS/Analytic Rules/{Illumio_Firewall_Tampering_Detection_Query.yaml => Illumio_VEN_Firewall_Tampering_Detection_Query.yaml} (100%) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml similarity index 100% rename from Solutions/IllumioSaaS/Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml rename to Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index 93e47f4344d4b46e8f69a060ba5b1754ebd5fc41..c1604514b98762a4cc060a67b8485eb2406a5c66 100644 GIT binary patch delta 2797 zcmVze5yno={b9lrj!}4%CB18Ng8Tj|tlisnM6?wzf6G;0g zaL$njGcU_a$vhDCsE6|BL^HP(J1~{_w-;_E6H^wZ(E;#^tdLE!PFCC&z6c5OZbDt- zgm2!BV=%fLJmUEClK6%Y7UMWFn18$w$M_TYUuDndR-7c6UBE~LE)ggyPbyHv$H_vX zv2)yF4eBM5W&3E(4+5ooo_#~y^GvS+pm8X8b+S>51uivOi8~eDndLaZrRZ$8s77e; zdrUGh)8e)gJm#W=bcUnb28b;PZE}-IrUmpqybQ@W+XB8e@GC`uI~h&u#(%msgrp4Z zOT3;Ws&jPeLfxocK9nf0LjwQ$Hl@yo(}U()ZPgDzg1}i=PeiFxVI+<_S8W#PP6g=( zn7!ly-VAE%?@Ow`S~}BlNK;wfOZNV+l!oCc5Jv@`w>SmbMwfwyz?&*8=%EGOKU~8m z3Gq-tLvjKOI~h~CsKVHf+J9c(N&Fnzjfk<3lhu~_MG;#H$QD>G*&Qfa7ma;ICp$56 zqpcgv&Py@|qk_D;wy2gY2a?#Az6)Hbg?ifR9kj~y0BN9D%SRtuRnhW zan|gjcE&F8oF$#;JE9<{s&&VFqm7+W?WxVLhPYWJquf0iQA z@rMT^&=J$l<>`|s^eqsm9Ot3Lio*|ahN5#}Sd&Re*a<_j?}hpvp{7kqUldk-$#M_h zgQ^aJV%q*#-NX`LCp`<+>eL$e{8{{Z?A+ZMljJne!m`W(;GOzBBI!T163X}gLk@v+ zg;rVOf%qoR9g>|38h={)!-wS?0WgKPcPJq(Ncp{0F%5cwAG{RWtNF(_+#E>8eunfb zIM3JJlyRt)Q+-K4--c7Y^2YKen|ou|Rtb48txh9sVdK2iX`VJG)4qI$i8i#+^h-88Uv3@kdmuM zxSw1NPJBr2Q=txY6&UWIFAb*Xx7VHqq*PCaj}IZ{S%f{Hm=GJQB&@e5#T7G`KSlIe zCLxcvtS8;nvs9{QM_bR|!JZy9)YHLKCkNHZL3MJV1Aq3-oE&5{$73EJ9N9FL;=xF@ z8ktfRS{<>72GtSECPyp^1NWg%Sr(vB9ke{~K}&wq4cpEKIcRBbcF>|gd((rKl{Vt{ za?n!F0m7kH2Q5qbsSaAIgO&{sT1u*fO%GaD@Hwq<(4ree`Y6H52Q4dt+=2r9@()@% zOAcB()qg?D77tq9kH?@}tJ4)d|A`!yulsbRqt)P@>U72UHNbZT@Vz=NFDoCH;4QnN zZ6a&;9#*f5s;43F!+^^^Oo@F}%iime_ry!55>ixszSdbye5qZWC1)G>yJ%Fq;EwzJ zF~SOC)$C```- z+Fuj++ly&>hC4IRBLhtW0Bg+f#uH4%pGO!$a{R$yzNJSw2lzYam+BOtIt8ds0iMPw zz!vidz6IZ{yxKmr(^l1Y<*j{SZ*AU)2Q&6TytSRpytN9nH}%%8WZ2(}x3=7dibJiu zwSPDi*Q3#~#Gn*xk(As6cyDZ{tb^>b-ay z%WVue)XLkqq@T*$Sa};a^fs1M2~XAAs6#&i(OucwxFX0csJ<`X+t^#;ZR}Ov#w~gq zUlQDrT~i;yx9(}oa~^Nl`?@`iJ+0R6Ri4JL)YIrBQePq%^xF*;U3v#KpA+GEU4Q0x zUG++7qjJ?&uG-2~Te)hh8>KT1s_PCm^<_(D|D%M>s`{^-*$?c@&hK}?;(rilc5gFh zwgT-=i+7LG^w4 z&g_FF&g_HAnY~44_Q^a#Qhf7{?0-Dh@rDOqwJBTK-e{Y%8B_<+H7Pww2E|)1dO%ZtAn;*6kyCY>T~D{@Mrj*XGT7Fl-;hUwg2b zzgB_vrvBQMO#OTD*OuF2aj2EQc1b^#zqaz%Zs@NqsS=*5zgCBS0^(q0e}Cb#KGGS}u@h6@yWdDd6+Urz1s%;qD{jV?*}QdvC%FkSEe9#5&J z{Au>{Pf;8O{^aL(K}>%5X`laPeDH`B5hH{RV`#*I5nmEx9C%)EgEtnkH>V8Ohn>3T z;TJ3y;tpVDKcD*m{Qv!*|9@+Iq!W>;VEkkm7!ddTJW-|-H@=*Ys2)8+e<}N~Dg0Uc zaY)Gi6zn7t?hCR;`w~(1KN5;Ejw5PJo%5Za`4@wJ`f1<#IfK_J^(sxRTNsT3A?wO& zOr!mXBOp+ZuKeJ}ccTdQ!_Wo&%V2+E4+ipz<@%H)NHsSy1iE!&R(~Ywv`EWFf@Tq` z{F(zONHm}rBt+)o6B!nN_YHb<(Q_3WmT+Xy=di{wtIWL?u_xq?{yZ^GI>u;jUy)cs zhcgHIDvZ?OB5_TtZiq^Mf>@1$;7Ts;q{W%byyZFv3r5f9ggVs4!~g}}5G(YJDN@lI z1@l4T3iK6x3rns`N^G5 zj3~4vl7!YxgNfrjA|Z#PmrO2{Z-PmX2qgZ|h^{B+JI0Oc#FqfQ-+%uJ&%g_AbtQtnsdP1K0LacOPrKtK|W1FS_fo#=Ba$$o9M=e7sBD zePcI_;tys~J2o=_q6JXF&@nCRA z9BLS*@s7l}2IUAP*T7SLD>h&U!o6fW>LClKQ8BV^vnAt}rNL&{GbP9l?CNIon1woh zclX`@2T)4^0u%!j0000803?Q!{YXO%B!)*>99|wMNk9Mq)00g}HU{iS00000x`%_j delta 2800 zcmV*$lL3j70Sr(}0|XQR000O8@lml1atICaQAb(oP~PoKKmY*Fvx^AdHGh2V zhUCWbyy2-eg?6w%9lj(YH18j{?;IZSiLgAJipUUuM+W}=^`v$zXG7kw^#oEr3S4vK z!K}-&QZffbJ?f$SInl~3#qLWb`t5}q$;6C>X>yW^|zD=p~;q;*SR$KK0kRWgt))NuxR2Yfl&Q%))x=TU20cJ0G za5sb6`umdVua?eq9MUwF_mZvuE2Uw03dB)?=Pgcww$WwaA@HUO3wmHd_YT*vK|(xK z(2$(K!cN9aE~+s0qqfy|5`Q0ub`xSO|Fs%qUa-(+KFRD0^SY;b9wqC3VjO%D#v*!vEtxEoS*327uIAF5_YRZM|i-~%s(_G-TI4L1jpv7aIR3Xb!2 zH)R}ZyHewN*miL#xvWTi7@+b=a04L;|9<#F4u($So+qFW>Ro zUgG#|SB~E;Ie!0m^=|k|ilcr(T`QIISIdgx=BuyU`Pesb{HF&yKd9zkfYFYN)4!sZI{6lY{EyKz|49n>jhiXpYA`J~*;z8pVT= zYBe&YDzrLc5e=#%mQ9XW6b9}?pRz1Kp*m=J;DeU@rW>}M4|34b-t3@7f%c{cEh}xr z@8zJSoCAbItqxk2^iv(QR0k~^9<-EH37a0Ytl)E6zM`h2akn)p(?I7`kp@OROucEKI@ z`D26?KtY2d820+;N`P3C+C{;|UySNcu2uE}bbrAxE|jAEll$St1wi}zyv(4UA5fT{ z2eiK?@V6J!^bB`qphpIp1OV2U;cX|FhCh!mg5>yv!F)@Pat`o!&@a^~Ky?aGodP_K zQ-Cez4}1&0TY0s8Xs4~J@5)>Iz~0)t5f5hUgLrE@n|W&$Xm9GRUCFS&7jJF34Hbu4 zd4Fq{^iz3jD{t+F-rABXVN-8ysV(msep(&+=>;V#`)OAMxdqkt<@;&7OZ>Fm%1^sR zKkW-IsJyfbxQ{pNe%)T$u2yq*D=+QW>7{MhRPr5)4RLB}N38aGlQc?t+0`bMm$C9P zDgjkq#>&gcekw0x!P7_WGHI=NKqq6q>wn7G_(;yiye$gW*n>D5yPG*16=-kjY+T7c zy%%R=xqShLS~(k+^iw$-D`(?|&c>1|;i)*Nr`6iM%F+0hIvSls>Py6ee!G#PORu2jbAKW{ zugm(D}b=$$FzHG_tf0U?MRsWSU`+=R=`TY)9{14*H z?rrAGR-nD9Gkc{y(7iab%k4cm)XJH?q@T)}T{*KibY_=S2~X9TtwTQn(OcP>y&}jh zsJ<`XnSHRtnSD?>v$yEXKAA^Iihpn3k)7u{-tge-c4QxDHTFT}$o@(l*%6cYS}AX> zaMP9xrd`=t%YQ1LZRNAAe72R(w({9#8dN^pO?|f9x_u;%ZL#;tU;DuR+Pqm0hV6s+ zYY#T_*DBE7)L*-jsedp2+HzYg4z=>vF6pQ8*H-@84gIwxRl-yC*XqzuKz|&p?5|xB z3upZxqTh{+E>?eo8k4<4~1VuY|^42?K2;!9$T1J4U?@WMj&b}Un0u>M?z7?aYT)&bH4L4|6V&5UWuTT*<|qv^aB@w_N97!RYy%P=~sh7@)u#Vuijj zMJigOU>+;{p_DTJ)_+fP24phVPGGCRC;XT4)PepBCmNrv6 zKe^M15rwuylF+(oFmaqmB;;`PlF5bgO)v=(fy6%=(e>nf$GCBw_!6M^d$UjQ=OsZk zpZxuEsl{GzNa!{p`W8x4e6b0>)bw82LVEOTsnD(sqwXl=cGo~Xqe3863tvuV&*jE`4 z;uYn>25p(AM2tkJ-Bkv0!`rNfzi9n5P;YO5di!xv?`(j2XKmCMdqnQx1@^_`QiE0O zHd>E9-qju{-hbYEACEQO)t(L5-o1H`HQv=O;M!j5?qiL2wLHM>MRz^ccvlM-*`9ZV zk9VoNZ|sIq{DJN7U$WpM^l)^|X3uPOGFGr~l;kX)#Mn!|Nhf1FHo%+&p~AXy0t|X8 z9t`e?Lk+_;-jNvBpd6v(8hFZY#Rlv^xR-24J!IiDDkw(QZFbzUG}sJ#rUco6UEORR zvrwn+?!No~P)h*<6ay3h000O8@llidNJ9 Cm5(O? diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index 071c2e7332d..0d4ebedbd29 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -747,7 +747,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Illumio_Firewall_Tampering_Detection_Query_AnalyticalRules Analytics Rule with template version 3.2.0", + "description": "Illumio_VEN_Firewall_Tampering_Detection_Query_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -1121,7 +1121,7 @@ "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", "displayName": "Illumio VEN Offline Detection Rule", "enabled": false, - "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.clone_detected'\n| extend hostname = created_by.agent.hostname\n ven_href = created_by.ven.href\n", + "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.clone_detected'\n| extend hostname = created_by.agent.hostname,\n ven_href = created_by.ven.href\n", "queryFrequency": "PT60M", "queryPeriod": "PT60M", "severity": "High", diff --git a/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json b/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json index 1f0eea09450..ae0456c5f53 100644 --- a/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json +++ b/Solutions/IllumioSaaS/data/Solution_IllumioSaaS.json @@ -12,7 +12,7 @@ "Workbooks/IllumioWorkloadsStats.json" ], "Analytic Rules": [ - "Analytic Rules/Illumio_Firewall_Tampering_Detection_Query.yaml", + "Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml", "Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml", "Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml", "Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml", From d62bdb95703e4d23155d8fbcbcc244d9452c5c8e Mon Sep 17 00:00:00 2001 From: ashwin Date: Mon, 7 Oct 2024 17:04:19 -0700 Subject: [PATCH 05/11] adjust description of alerts --- .../Illumio_VEN_Clone_Detection_Query.yaml | 4 ++-- .../Illumio_VEN_Deactivated_Query.yaml | 4 ++-- .../Illumio_VEN_Suspend_Query.yaml | 4 ++-- Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18822 -> 18919 bytes .../Package/createUiDefinition.json | 12 ++++++------ .../IllumioSaaS/Package/mainTemplate.json | 18 +++++++++--------- 6 files changed, 21 insertions(+), 21 deletions(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml index 972804154f0..6300b893afe 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml @@ -1,7 +1,7 @@ id: ec07fcd3-724f-426d-9f53-041801ca5f6c -name: Illumio VEN Offline Detection Rule +name: Illumio VEN Clone Detection Rule description: | - 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' + 'Create Microsoft Sentinel Incident When A Cloned Ven Is Detected' severity: High status: Available requiredDataConnectors: diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml index 34e70b9c0b1..edffecf8dee 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml @@ -1,7 +1,7 @@ id: c18bd8c2-50f0-4aa2-8122-d449243627d7 -name: Illumio VEN Offline Detection Rule +name: Illumio VEN Deactivated Detection Rule description: | - 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' + 'Create Microsoft Sentinel Incident When Ven Goes Into Deactivated state' severity: High status: Available requiredDataConnectors: diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml index 856c6bbb123..8996606cdbe 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml @@ -1,7 +1,7 @@ id: 7379f752-18a2-43ca-8b74-70747dd792f8 -name: Illumio VEN Offline Detection Rule +name: Illumio VEN Suspend Detection Rule description: | - 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' + 'Create Microsoft Sentinel Incident When Ven Goes Into Suspended state' severity: High status: Available requiredDataConnectors: diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index c1604514b98762a4cc060a67b8485eb2406a5c66..9ea1df79580295e9d6a61c9177897d06750588de 100644 GIT binary patch delta 3594 zcmV+l4)yVdlL6CY#vU9o#o@)e{hY{S#k|I#jT;FX(^cjgCtV14A>-OIj5k^^`9v6~OzAat|jQz2P(=9#@P zVLqRSqIlul&|Nq!)9OlKzyKQyDeN`rM`hetV0kPoe;Z2<80;`Xgn(b+Dhy1tN?>?8 zg3&V==g}p%VFB_1vkdlCn)1jhZ3yqDJ=oqpRr+$Q)TJAFMkB+N$!jYjc%Mt|hF>`Q z-*Bc=NN8znta1x=dO-!)ifdg;SN`q7zhG5MjqB$>uEB{_)D3!zlrs6)VS;XC|X zgL+zT%5~o{d6XJTFf*8=S53wuZU$L3_kdwp zvd*dNl{GXtT-M8Co{Pu{QUsX5le?&YzwulpRm9rdghh_U7#~aHR7^!2b62YVCSpo~ zN<|Om9H!iYutm&KzDqU5fGncNKr1Z!7>pI<#me=j=bT5L2e}Ba~XIo-orl_d}uMdwKF^GN9&fIi3IYvXr z&p@0-#Jw#q>TjDUKe0^o%ZB`NcV~B}zw_t*&eJWlb`{aydhF)6gKb|W2@;3{t+E5G z_P(%WV=hU$H3Bk;12ZM#f@6#vD8Qh7f8HhJW1KFgRy4<=50bD}sr16Yivn}EFfdkQ zo3f@gMRKu1`fI6X+K4DXb&v-Rn`@b`JJcOGo@fW+KaJ=i)Adgp<&r2Xy9e-^5~ zXa*;Rv(P+VDF&Xm7G=j1DPrrQtP)5$vM&?~s+dvTP+J3NspkVbJi)jrY{(c(+2Wk7i%)ZWJ||p=I2U z-4&u%8c6PNt|}6JnV&c%xfcFb4=Edx^V)9WxsKb_%zIGk?vvtvrFcp2f6aOq*S}Z1 z=SvM@nOQY!{>oeIaBoV1Ms3CIBGy$5jj99h*U?2$*UsUBOc~q!>_DX+OS)NGCR&ZV zTY;!;df?JvR!T!^N4 zd}}j6@BVIpcISKE+0kR-{OsOwCUm7@F^nwRSXMuK9I#zSt=pDF{4{p0Vu;pk05{VV z1(h?1>t@AanyGv1H(`4x%2gi2x7q?LEf0W7JKQ%O&4e_Xj8~>kqRLm`HgzSu*Z2H9>_@~q3Fo`~h_~kpS z&?r@}@`JlE`QYDd-7D{^oPPhj>y^-aj`0P@EXlA}VVE^;9`2`5*Y-b7p)PP~JFz%Q zBkakkh0_^N7tS~`r9ZF@p9(wMbpNgVbN@W+Fr6se#uH|+e?Ma>R)Y=V`$(+ow)mdl zzrqQo;TYm3ytqJll}kA&PLstIhhqgtvE+l31!*%R{7?aL|Ag%1@MrjCGQrx);lNcn zY7F-u3XjCe?h*>G6~@64aq!9^4~p#%8^Ly8stqIi!}pEsuy8@_AjU#oxPr$I1?%&T zz9QEoDxZWiAczbAZ4hujOgt2<@)v$|@6BGad00;nlh(}p50czxaKmY*R zvx^9sJAdD}m-fh@65>#I?Qz5x9K`?@uU8bvQ*qEXY%25)A4*N_gDrEj$+BxrDi34j zVN?RDJdBlxk^NL2#)6kGzgRq=gE8NA+kYBvMji4Ai0;a6#uY(sLGgY0ZpPjc zH)F4IGj7q%_>$m$?3#KAzI7L4p7VIa-q-D7>}hp&?;Ce9W&=SbNm(lxRBr!N{Ebe6 zQ;BHMZ#PzS=_S;BPK5t;nfGwx)+yrxjiU{TDi2B^i#RCE0^|$F71*k zVH+;(QXYae9NW4fBp`Y#JGNH@xdrw2Q#D#!K~9or}K2ubnHJGJv%#~U7e z-A?TTt=2xMoZ6C8n@h=>E^XfW$+)v4hJR13l+RW;Ys*B|uHmxfKb7aU^4wOQ+sboW zd2TZeD$nhvp4)Wgehj~DvG>Yr`@mk?ykQTf?Spu24>t4KD$w54YrB%Me=lC!a+@p; zwes37>8JAAR$ki;y|yJ)!Zy6NOEc7I*> zs?HC2Epu(oX}Cb4muG!7|K-&F&TKyN+~|^oFO}6Z0MqsU@9~ss%AaOG{}jbx;7@*j z7sTX;pZ57*#s`mB5ivs8Fos4P81W@B#)0PrH+XR&dwR-neb}jc9)7`cA?^TX_Vc+9 z!2jR>`M<_TIuV%)#!r@kVR6sT6MtnoapTMRi0aWJ^q8{$n!=;CABTkOPr*(i;l3bi zv@a25|0AI&<2a(m)H&bznSU|pr=Rw%pEG!!Qm@j~x`ojw5VEeU#x&ZGI06Fo=*kan zd^d_d)OL!etXW<{b-i?nPcXcn=`uQ`B%M1KQ{K|*9M zK9OPZ=ii`57d=<8VF^bDeHCjAv&!6S5qnAQ=+6`5q+^Wc_7#aGbU1UMufj+jE)v(Y z>V~NFCy3Q32(IMfPFkF~(_5}{uwe9jPN+*=Obk%q4Y5Msm?9OeQ814c9#Kk}f9t0? z12UOwC$LrE6aGtiYQX}tKz|8nmxpBK%va2HzahM5Pb`! zDZbbQUut@lxFL8@@rdjXzZ&D2=SV7VS~2JQzAwp)b1*S zxZ!Qq!(X(18mPB7K)wCAsCPC%y|Xszi#;Ou@DlstajC&7b{nlnAMa|96>sm|kH;GC zYR?C3@BX~U8t-Zsaer+uk@vC2yINM@_Tsx9YrLxkjBL+4!pFPR-8Xi_DE`3q_b*xa z5qdbfX0vCuIvFciI7)IBPh#vP-=veV9UEXyf>2>yIRS<}6%Ph?#G!^^8t+JqYfz3* zat%D?w_*c!Alyr~qaLzw8Wm&fHal)v8g7O?Q-bWku5LDuSs<{}cX!|Ye^5&S0u%!j z000080DOo?S*g<-k!uJ50BDm1NjM*Th(}p50czxaKmY*RHUa<<00000000000001_ QfuNIINhAhMNdN!<0GwC>`v3p{ delta 3541 zcmZvfbx_oSx5Wvi1wko6x*JwXDUn=2q;pB>R0Jfyv`9)UDJ3A?u{459NGu@8f=j2u z!jii*&)=JQ^Jd<>J9B3~bLaeZ|2T8bb{c+68b19iEy6nw@$m3S@VH{s&6q#uyjLW_ z!?RDJX94!iuRWRCsc#i^#pmeiUuy`W+DoFR7M{1{%_zO4SE)?wmmqM>Of~h%4B|q@ zi8`(1mnP5h{-waZ=&Ukw=k;4?#;Mzh%6?`@YKS@nWc>pRKri<2M`Amzs|wjt{bd^Qv^^?F(*)3X@i@bTTiz8MSi-t zwgGByGPGZ)y$Kq=!6bXXf?HBfg3DJ{T5<$IG8qzyQD3N*EfKsdLaNU6!`HeKsZ?j} zD|S8gn>bwBdm1mV+j61h<)s){D(L(3V@9M6?cCiD*{S-%s&XIr3;4&M!v`h!U81%U zQ~CECS!0pCz$JZ`4_&oR|NOK3Lms`YF2KND3iW4e(QG`RVL%U2y|5MAFvaGCKD*GH z;}#B^VGxyZWoi&KWJZYCwIn=eNHZR2B2Q2RiM6*WL)ObdYa(2h7BPovOgy z8nZfdH5MbhH3$LMIzv;D%${MM&x{>{#oXo)G71J81NP`{j+@~GCUT*B(GCVb0Q|_u zj(^x!GTX=rK{Xr<`AIe>55Ky2_tg~0o_{hUA{Iyruz^Z#U=~^2y$S?E#Eo|P6Xi-% zY{xdBwD?_G-2UGu@^0#6r^Qv8C8dliq9wWuz2|aVAYgjzUVmLZqV#09j6M@VYBYHo zSd}jEw>ih4>h*V7%Ub=%2e52@0K!pVL{ezZ8LF%c;$71*OCu_siyPM2&5}#H$DPF} zG*!uCi!U8n@=4ytG@}}{k)TFe!Q_3iQ@yfh)sWvPt8a$;A~O zts82qGQ2gZyx~y>hexPVWiW3oMAVy&>Gfzy4uy?<8B%hIth7V^T6~`g^phm4eRPH?isqn@5y_NC@?!ENqO5XOHs>rULK6MFNTzZLHsG7$)Rr|DZ^U%fR4Q1!mjO@Z_U06pw5yY9)GA{MXp! zYie|`P_@CjLDV0Q9hLFfUwkur;61GHtxfLZ*Y*+#DQ9)2tD-rAhN-9D904{*u0j&b z7dpDRp|&&byh1}V_R<(Kx}#NAf#|S-+B`!ZHjTsqgfajbX!!Q7t$)R}?{U@Dp{>mK z!i75qL7(u?44o!F4pFMg8X{jkh(9K~LKsjt%CNm6W_)V8`Xr*W$E0c0ce85t&~vjz zp)#ZaS7^maD!l${4npYK9`TyesZwYv_Y5ws*;3AOdcTofM)Z{D^KL!lV;8Y3MnQa^ zK7lE?PC6H8yXyWXFD)6%(^!eTYB585*ZD-4dkm~|%o zRI+`QG85efRt9OpzW-KsjmuU}AqMY52OzW8$P(bRo2yo*!H$&Yvb^z|^`&7EQKrP!?_*kfAV=G^v^@Y2rEDD|Vv)Sit zFVzpzkvU2d!Y|AxZC}vh$X6y``F&qW_3&-~w9N0E&!_V@Mpzt{vwY$?-8+sso;bnn zp@0>S>+4icE#{>_26apbD9H~O1nn#yIys&W!hr%z1nByQ8;M7E%97XJk$R)8+*81# zPGc#RAgQnqE^!h43{k#mXo>Ok?$h|-Al_jkE3y{lT3Zy_Nx4=^)A~;PzfUo32>1rR z8#d~l5kwpn3U_w{&9IU(9U3tmG+W}b?ZK@Kdo9XuyCsH+yg(05Ra!p8!g8fWbcA~{#uBI(Fkx&YsT7j26pe8+?alUmP_j4z71maJS?0&j~GI++{!xq zd?>iE>&711p1SaU(^s@*fTgmo*~-IyK)npy5D4Z?r87G(xbsP}uE0|9oa+B14J#Ht zO(i_MX(<9c>VNse!`8*q(80so-S(Y>h^vp6=U&q!N!T+0nu*;#`6=Zta85Z8BO}?u z**bR0GrBKTv5)}G)gvu`3o`ap!y2?RlGiG@W@*L`5C$?HLrj(i)sLjM67|G}Sm3C+ z#W7U5QjmeyI+$pu`#saB2ZhYc2&%25U<73vz$ASlm0?J#`wLb6LJ@xoGLLHG7#1$? z5nV>jSpaJuXrrY;;Xo#9nuQdI0c#&@-(}2)#cS@eLq1WyW_I5wf3R+5`VW`BH3!29 z>K-j5kXW+d!D;|x%O7$Ib}4@Q%eeOUh>=CRYZX%|=w9V6rPQf|mg8-4)Oh7Z-RF5K z^cVu;|7{Jp@8stNa%v^m)5)6`+za0y$cA`gfFDK12sHP#Ap$*;-CYFgECIi-M7Te` zAdOubL7-`$dpUsQ>7XvPS+=-1aiwVhWue*z^uu!^~*iX*cRtRqKM|1zL`9s z7zA_6qFeFx$_0C@tH(@qv#|~MKi3XDb1ArW2tJ6VrRI#fXYULTr?#fCXMS(x9Vt!M zC|yQ@{E*kNy-F`czeZ`}s911`cXfMRaO)Oa@*t(c=IS*g!+qS9oZi<5(mkJ(%UR@= z0shN6{wuS~HyXn?57AsS`{a#kmo$17o037e` z(tW{`M1K9LM|Y1+SE)+V&taiCAhxu2KLU%p3ah>8WpqMft4C~Oz|i~5u~)MI$Wh)0vl;LT3mbZS zX>e%ctUUd6}Mgqi554Mrohp9Ef|E620Si zoE7~v#2>eKOZ-X;pWq?k|5Lg6@bKvW8R7p-N%(&#El87-^}n0h|MAQJmAy;r*5o2W IYy9W(Um;%bE&u=k diff --git a/Solutions/IllumioSaaS/Package/createUiDefinition.json b/Solutions/IllumioSaaS/Package/createUiDefinition.json index 2feed2f85a0..26b06ba08b5 100644 --- a/Solutions/IllumioSaaS/Package/createUiDefinition.json +++ b/Solutions/IllumioSaaS/Package/createUiDefinition.json @@ -216,13 +216,13 @@ { "name": "analytic4", "type": "Microsoft.Common.Section", - "label": "Illumio VEN Offline Detection Rule", + "label": "Illumio VEN Clone Detection Rule", "elements": [ { "name": "analytic4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state" + "text": "Create Microsoft Sentinel Incident When A Cloned Ven Is Detected" } } ] @@ -230,13 +230,13 @@ { "name": "analytic5", "type": "Microsoft.Common.Section", - "label": "Illumio VEN Offline Detection Rule", + "label": "Illumio VEN Deactivated Detection Rule", "elements": [ { "name": "analytic5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state" + "text": "Create Microsoft Sentinel Incident When Ven Goes Into Deactivated state" } } ] @@ -244,13 +244,13 @@ { "name": "analytic6", "type": "Microsoft.Common.Section", - "label": "Illumio VEN Offline Detection Rule", + "label": "Illumio VEN Suspend Detection Rule", "elements": [ { "name": "analytic6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state" + "text": "Create Microsoft Sentinel Incident When Ven Goes Into Suspended state" } } ] diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index 0d4ebedbd29..f5806b0a1ff 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -1118,8 +1118,8 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", - "displayName": "Illumio VEN Offline Detection Rule", + "description": "Create Microsoft Sentinel Incident When A Cloned Ven Is Detected", + "displayName": "Illumio VEN Clone Detection Rule", "enabled": false, "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.clone_detected'\n| extend hostname = created_by.agent.hostname,\n ven_href = created_by.ven.href\n", "queryFrequency": "PT60M", @@ -1199,7 +1199,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "contentKind": "AnalyticsRule", - "displayName": "Illumio VEN Offline Detection Rule", + "displayName": "Illumio VEN Clone Detection Rule", "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" @@ -1228,8 +1228,8 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", - "displayName": "Illumio VEN Offline Detection Rule", + "description": "Create Microsoft Sentinel Incident When Ven Goes Into Deactivated state", + "displayName": "Illumio VEN Deactivated Detection Rule", "enabled": false, "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.deactivate'\n| mv-expand resource_changes\n| mv-expand resource_changes\n| extend hostname = resource_changes['resource']['workload']['hostname'],\n workload_href = resource_changes['resource']['workload']['href'],\n workload_labels = resource_changes['resource']['workload']['labels']\n| extend ipaddress = action.src_ip, \n ven_href = created_by.ven.href\n| project-away resource_changes, action, version \n", "queryFrequency": "PT60M", @@ -1318,7 +1318,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "contentKind": "AnalyticsRule", - "displayName": "Illumio VEN Offline Detection Rule", + "displayName": "Illumio VEN Deactivated Detection Rule", "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" @@ -1347,8 +1347,8 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Create Microsoft Sentinel Incident When Ven Goes Into Offline state", - "displayName": "Illumio VEN Offline Detection Rule", + "description": "Create Microsoft Sentinel Incident When Ven Goes Into Suspended state", + "displayName": "Illumio VEN Suspend Detection Rule", "enabled": false, "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.suspend'\n| extend ipaddress = action.src_ip,\n hostname = created_by.agent.hostname\n| project-away resource_changes, action, version \n", "queryFrequency": "PT60M", @@ -1437,7 +1437,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "contentKind": "AnalyticsRule", - "displayName": "Illumio VEN Offline Detection Rule", + "displayName": "Illumio VEN Suspend Detection Rule", "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" From ea65f486a016e954ff148744062690e5a47304f1 Mon Sep 17 00:00:00 2001 From: ashwin Date: Mon, 7 Oct 2024 17:17:30 -0700 Subject: [PATCH 06/11] fix variable references --- .../Illumio_VEN_Clone_Detection_Query.yaml | 4 +-- .../Illumio_VEN_Deactivated_Query.yaml | 4 +-- ...EN_Enforcement_Change_Detection_Query.yaml | 4 +-- ...EN_Firewall_Tampering_Detection_Query.yaml | 4 +-- .../Illumio_VEN_Offline_Detection_Query.yaml | 4 +-- .../Illumio_VEN_Suspend_Query.yaml | 4 +-- Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18919 -> 18925 bytes .../IllumioSaaS/Package/mainTemplate.json | 24 +++++++++--------- 8 files changed, 24 insertions(+), 24 deletions(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml index 6300b893afe..3337408954b 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml @@ -30,8 +30,8 @@ entityMappings: columnName: hostname alertDetailsOverride: alertDisplayNameFormat: | - Illumio VEN Clone Detection Incident: {{IncidentId}} + Illumio VEN Clone Detection Incident for {{hostname}} alertDescriptionFormat: | - Illumio VEN Clone Detection {{IncidentId}} generated at {{TimeGenerated}} + Illumio VEN Clone Detection for {{hostname}} generated at {{TimeGenerated}} version: 1.0.5 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml index edffecf8dee..f56afebd3f7 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml @@ -40,8 +40,8 @@ entityMappings: columnName: ipaddress alertDetailsOverride: alertDisplayNameFormat: | - Illumio VEN Deactivated Incident: {{IncidentId}} + Illumio VEN Deactivated Incident for {{hostname}} alertDescriptionFormat: | - Illumio VEN Deactivated Incident {{IncidentId}} generated at {{TimeGenerated}} + Illumio VEN Deactivated Incident for {{hostname}} generated at {{TimeGenerated}} version: 1.0.5 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml index ce5498aecea..f50d8a8e978 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml @@ -47,8 +47,8 @@ entityMappings: columnName: ipaddress alertDetailsOverride: alertDisplayNameFormat: | - Illumio Enforcement Change Incident: {{IncidentId}} + Illumio Enforcement Change Incident for {{workload_name}} alertDescriptionFormat: | - Illumio Enforcement Change Incident {{IncidentId}} generated at {{TimeGenerated}} + Illumio Enforcement Change Incident for {{workload_name}} generated at {{TimeGenerated}} version: 1.0.5 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml index 25d57e2b7b0..bd847f897b0 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml @@ -36,8 +36,8 @@ entityMappings: columnName: ipaddress alertDetailsOverride: alertDisplayNameFormat: | - Illumio Firewall Tamper Incident: {{IncidentId}} + Illumio Firewall Tamper Incident for {{hostname}} alertDescriptionFormat: | - Illumio Firewall Tamper Incident {{IncidentId}} generated at {{TimeGenerated}} + Illumio Firewall Tamper Incident for {{hostname}} generated at {{TimeGenerated}} version: 1.0.5 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml index 3d9ff5f2135..68d6bfce59c 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml @@ -33,8 +33,8 @@ entityMappings: columnName: hostname alertDetailsOverride: alertDisplayNameFormat: | - Illumio VEN Offline Incident: {{IncidentId}} + Illumio VEN Offline Incident for {{hostname}} alertDescriptionFormat: | - Illumio VEN Offline Incident {{IncidentId}} generated at {{TimeGenerated}} + Illumio VEN Offline Incident for {{hostname}} generated at {{TimeGenerated}} version: 1.0.5 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml index 8996606cdbe..916dbe90e3e 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Suspend_Query.yaml @@ -35,8 +35,8 @@ entityMappings: columnName: ipaddress alertDetailsOverride: alertDisplayNameFormat: | - Illumio VEN Suspended Incident: {{IncidentId}} + Illumio VEN Suspended Incident for {{hostname}} alertDescriptionFormat: | - Illumio VEN Suspended Incident {{IncidentId}} generated at {{TimeGenerated}} + Illumio VEN Suspended Incident for {{hostname}} generated at {{TimeGenerated}} version: 1.0.5 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index 9ea1df79580295e9d6a61c9177897d06750588de..f54aaf30ed6f0ac5c12f18be05593a2df9215d20 100644 GIT binary patch delta 2263 zcmV;|2q^dGlL76M0Sr(}0|XQR000O89E!0Fo(K&bibq*xGa`Y6KmY*tv$qH=IDZ%i zq4D{%V7I$FW0IT)S}~MljsWk}ClUz;shzL^2ImUJvcw7TO&&cYn-{dT^yd%D_X1!I zZ|__}T9fkIt70bf0#|q`v{!SHZ@52@?EMVsSMZ;&yD#HVE5G`Ze!dOAdgYMiO*VJP zuB{UCj#`~Y*uvg@A%Ee&E`unNHu-SQ1WqOUPKa$)nM0j)C@VX%yWh! zFGSUEL;Rc1K52{ye30GSKDk*Flr;t(mmnp#k8oGH8l3o$T&Y5R=qfPWM_(FD(RHsq z5J;(>3?JV@%(Do4Lop#XR)0xYZ%+y>W?p}a=(9{t9&cGsx~XTWRL_pKp1+1YJ#DC` zgQ*S=s>6fo@IVLbn>jqlXpYA`K{&E$HpPRHYBe&YDzrLf5e=$SmQ7As6b5eYm?I;a z_juZ}GA7lj%RQgEawJt>eQt= zb=mOLrKC#O^webq2harrpEhxY*|J0?k7fDwF#G2GD z3jY3Llz(#7vLB#7hH;@3{h!uV)vhDB1VOwrb#i3RX+a>)}4%^CMyP?Cjq)OP- zVOwg~yN0V)hkkl*$;z(U6+v!6^?muS+U^opZMSmOZqZfy!V4-#?E>!O4ZB~rqqeKn z+}&^7QF~-i34d{@$M!hl3yxv{i`Od(}1(ZCzX@2axy9b zRZhmr$;f^xCu70QmtQO%)W?|byz(_Zmaj2yih?orAil=#X1+!R+MD_sS29oU#n)JF zTfm`KzQ!f}RKCW_*SMjtv7}1ahOcqS-fay}qYn85M1OZ>PveRpx1jjGd{1LP^!|<+H7Pww2Ge^4V4wO=lWZS0HTa)Rv8s$BCXTg+b-j zzGts?et+u&#{YwOwR@X+wH0V@>eXIpJ9IBz?Q+{t4z==XFX^Z9YFA$E4ZYeWRl+vB z+NGQXYxuTxLr6gMR`zYL2yzSR@5}dXA1v{0A5^~WE&8@k<`I(OoA+zyxsEqH_`3bt z2U@LtQ2Dhbzc!bWHND!r^^@^vM+~1@DYvcg*MF9YuU*4y%YQ28ZRNbJoVS(pwsPKP z8dT2PO`W&t%KbR5+Yu~xLvvrUc+gtLq7p=u(H#3MUY!iefR9N72d>ke75U)Saq(* zYk!$*bAH1G3cWn*tNAad_IGCUk>^I2Bz&o?o&lJy_kWM4R8#&m`}wCR4g-Jk^SdA> zKm4@M|1v&!#EOU!!k#fS;=qV63D|p{7u?__hU`r$!}Vda?s@nH%Z0cDnAy+gJ^=rJ z|L6Z2AL&G7Di}Xm1_sAHKTnkD#EmcKBY&z#kI-q#{%Z=S)_xokvOfhoiG=%ttkJ$i zl>Lu{qKxB+8dK+d=V$)Kpr3x)w|>sxbxIveQ|lH+qd>^IvKrH9KjH`o)T1juxbfX6 zf-Nz0LH{z?pV)(eykfaNB?(f^jSPWq-Ix`LIxW(&k)T<`D!=9c3K9({1__b5_9@&$@z|P<2vyrK=1cvpWx3+f@(hb`{z=Nz21<}Z9?=dl&1J% z6MU)Zy|T$ITXjkkdqvY)hNm{A7n;y(n9d7L=JieGyUcn;9S*)-+`;Yyl7HLz=-tcQ zks0i}3CzLrGb%CdSqE%kC#`2pM{f8cd6HUrz@xFRG9bh=%Y_ZvGEa#ZiBP+%4C02j zSr32F`e~rv-T?LX##Y`BXd`+!2QwhH1PbF|I*5LdiAo zpx=rO*nw~_*^YY1!f8|tuiNanWog72_Dl(~1G~D}JZAAu-`#!p{|^CBO928D0~7!N l00;maij!MOLk%2?M_FYvB7uZJ008!rt4THnQ%L{-0063#jX3}S delta 2257 zcmV;?2rl>SlL6+W)_)Rb?#3Xupa8#o=Wlz7^S50&f4AuTeI>kLxdkq9?cKBU9n4WU->DlI(iRI%Tn$cqNbXai4s;b5?w~IXrs%iV zo(7~;Plk^VA?8_xJ)oEn8-J@LthXn{6*HGVMf6!FA&XpG?n7PNVOW7QWaVqv4{rM5z8h=ED8hnp-)*B zpimvOJn%tFe$x%x&IdVYX>WGWqCk7ogO-&x;`egUQqBRwp;iYiOMm*Q4qB>%mJJVD zN~(lS4_a36IjwQfq8mi|D8b4HEh~cDf&%>V4_Z1)4q7_ZLCY2oTHcSxpj)fc6+Qon z9G0*9bfu%!;GODp#rQSAcLnghIxa6OAD7@QyP|C(Yxf>juZyauA@IY1%RWqreO1fe z>yh`wOQ#Z2RDHhIS$|D@sa>2UXB+stXjHr4j{E#E!U~|EK@kjlfpjH6tV!*n;NmYv z^(R*=`vJOO7#B*>{>dHj;u4_!eO_iz&kra}&jZ?D6ZqSUX?lh`GteUgO#%RG%<#q& zOvRr^7(sIU!C=0nM>z-hJLs3{6refDCQcE4^fZC9(gyWhB% z_Q;?T;!t<(aeu@Y9K`?@uU8bvQ*qEXY%25)A4*N_gDrEj$+BxrDi34jVN?RDJdBlx zk^NL2#)6kGzgRq=gE8NA+Zt|09r6i??#gb)6@Ni)LGgY0ZpPjcH)F4IGj7q% z_>$m$?3#KAzI7L4p7VIa-q-D7>}hp&?;Ce9W&=SbNm(lxRBr!N{Ebe6Q;BHMZ#PzS z=_S;BPK5t;nfGwx)+yrxjiU{TDi2B^i#RCE0^|$F71*kVH+;(QXYae z9NW4fBp`Y#JGNH@xdrw2Q#D#!K~9or}K2ubnHJGJv%#~U7e-A?TTt=2xM zoZ6C8n@h=>E^XfW$+)v4hEJ`O&sI2V%S6_$;eWE_Kb7aU^4wOQ+sboWd2TZeD$nhv zp4)Wgehj~DvG>Yr`@mk?ykQTf?Spu24>t4KD$w54YrB%Me=lC!a+@p;wes37>8JAA zR$ki;y|yJ)!Zy6NOEc3t`M<_T zIuV%)#!r@kVR6sT6Jd_d)OL!etXW<{b-i?nPcXcn=`uQ`B%L<5RJLS!yJkzw)Y-+!P- z7d=<8VF^bDeHCjAv&!6S5qnAQ=+6`5q+^Wc_7#aGbU1UMufj+jE)v(Y>V~NFCy3Q3 z2(IMfPFkF~(_5}{uwe9jPN+*=Obk%q4Y5Msm?9OeQ814c9#Kk}f9t0?12UOwC$LrE z6aGtiYQX}tKnZAHzahM5Pb`!DZbbQUut@< zY;wz1ozlc!(X^J~sZHsHCiEJn^Fot(eN*`^vtChugKrmiusea|b3S_aGJkho2K#OT zbFln?N=$p!`&!sZ>lxFL8@@rdjXzZ&D2=SV7VS~2JQzAwp)b1*SxZ!Qq!(X(1 z8mPB7K)wCAsCPC%y|Xszi#;Ou@DlstajC&7b{nlnAMa|96>sm|kH;GCYR?C3@BX~U z8t-ZsacwV=_p!#iT2|op;(xmyYrLxkjBL+4!pFPR-8Xi_DE`3q_b*xa5qdbfX0vCu zIvFciI7)IBPh#vP-=veV9UEXyf>2>yIRS<}6%Ph?#G!^^8t+JqYfz3*at%D?w_*c! zAlyr~qaLzw8Wm&fHal)v8g7O?Q-bWku5LDuS+LW0ci;VgP)h*<6bSK+LN(KHU>>e00000Sh8p! diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index f5806b0a1ff..1016a7eb7b6 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -811,8 +811,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Illumio Firewall Tamper Incident {{IncidentId}} generated at {{TimeGenerated}}\n", - "alertDisplayNameFormat": "Illumio Firewall Tamper Incident: {{IncidentId}}\n" + "alertDescriptionFormat": "Illumio Firewall Tamper Incident for {{hostname}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio Firewall Tamper Incident for {{hostname}}\n" } } }, @@ -939,8 +939,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Illumio Enforcement Change Incident {{IncidentId}} generated at {{TimeGenerated}}\n", - "alertDisplayNameFormat": "Illumio Enforcement Change Incident: {{IncidentId}}\n" + "alertDescriptionFormat": "Illumio Enforcement Change Incident for {{workload_name}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio Enforcement Change Incident for {{workload_name}}\n" } } }, @@ -1049,8 +1049,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Illumio VEN Offline Incident {{IncidentId}} generated at {{TimeGenerated}}\n", - "alertDisplayNameFormat": "Illumio VEN Offline Incident: {{IncidentId}}\n" + "alertDescriptionFormat": "Illumio VEN Offline Incident for {{hostname}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Offline Incident for {{hostname}}\n" } } }, @@ -1159,8 +1159,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Illumio VEN Clone Detection {{IncidentId}} generated at {{TimeGenerated}}\n", - "alertDisplayNameFormat": "Illumio VEN Clone Detection Incident: {{IncidentId}}\n" + "alertDescriptionFormat": "Illumio VEN Clone Detection for {{hostname}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Clone Detection Incident for {{hostname}}\n" } } }, @@ -1278,8 +1278,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Illumio VEN Deactivated Incident {{IncidentId}} generated at {{TimeGenerated}}\n", - "alertDisplayNameFormat": "Illumio VEN Deactivated Incident: {{IncidentId}}\n" + "alertDescriptionFormat": "Illumio VEN Deactivated Incident for {{hostname}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Deactivated Incident for {{hostname}}\n" } } }, @@ -1397,8 +1397,8 @@ "aggregationKind": "SingleAlert" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Illumio VEN Suspended Incident {{IncidentId}} generated at {{TimeGenerated}}\n", - "alertDisplayNameFormat": "Illumio VEN Suspended Incident: {{IncidentId}}\n" + "alertDescriptionFormat": "Illumio VEN Suspended Incident for {{hostname}} generated at {{TimeGenerated}}\n", + "alertDisplayNameFormat": "Illumio VEN Suspended Incident for {{hostname}}\n" } } }, From bcf0ee8f155246fbbef322359dd332d4414c6a30 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Tue, 8 Oct 2024 11:26:10 +0530 Subject: [PATCH 07/11] version upgraded --- .../Illumio_VEN_Enforcement_Change_Detection_Query.yaml | 2 +- .../Illumio_VEN_Firewall_Tampering_Detection_Query.yaml | 2 +- .../Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml index f50d8a8e978..56d950252ea 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml @@ -50,5 +50,5 @@ alertDetailsOverride: Illumio Enforcement Change Incident for {{workload_name}} alertDescriptionFormat: | Illumio Enforcement Change Incident for {{workload_name}} generated at {{TimeGenerated}} -version: 1.0.5 +version: 1.0.6 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml index bd847f897b0..8ca1a9a8e73 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Firewall_Tampering_Detection_Query.yaml @@ -39,5 +39,5 @@ alertDetailsOverride: Illumio Firewall Tamper Incident for {{hostname}} alertDescriptionFormat: | Illumio Firewall Tamper Incident for {{hostname}} generated at {{TimeGenerated}} -version: 1.0.5 +version: 1.0.6 kind: Scheduled \ No newline at end of file diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml index 68d6bfce59c..04a14412ab7 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml @@ -36,5 +36,5 @@ alertDetailsOverride: Illumio VEN Offline Incident for {{hostname}} alertDescriptionFormat: | Illumio VEN Offline Incident for {{hostname}} generated at {{TimeGenerated}} -version: 1.0.5 +version: 1.0.6 kind: Scheduled \ No newline at end of file From dc9831868bcf58dc2e0c3daabaeb5b19a6814795 Mon Sep 17 00:00:00 2001 From: ashwin Date: Wed, 9 Oct 2024 15:38:16 -0700 Subject: [PATCH 08/11] fix IDs --- .../Illumio_VEN_Clone_Detection_Query.yaml | 2 +- .../Illumio_VEN_Offline_Detection_Query.yaml | 2 +- Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18925 -> 18929 bytes .../IllumioSaaS/Package/mainTemplate.json | 26 +++++++++--------- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml index 3337408954b..69314502cda 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Clone_Detection_Query.yaml @@ -1,4 +1,4 @@ -id: ec07fcd3-724f-426d-9f53-041801ca5f6c +id: b3c4b8f4-c12c-471e-9999-023c05852276 name: Illumio VEN Clone Detection Rule description: | 'Create Microsoft Sentinel Incident When A Cloned Ven Is Detected' diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml index 04a14412ab7..e7f7976415f 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Offline_Detection_Query.yaml @@ -1,4 +1,4 @@ -id: 93e40501-f737-4281-9df9-505aa773d983 +id: ec07fcd3-724f-426d-9f53-041801ca5f6c name: Illumio VEN Offline Detection Rule description: | 'Create Microsoft Sentinel Incident When Ven Goes Into Offline state' diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index f54aaf30ed6f0ac5c12f18be05593a2df9215d20..fb0b3bc601e87b31ce6a309d11bbe83d34a5c010 100644 GIT binary patch delta 15579 zcmYj&V{|6KvTbbJwr$(a#I|jGNhY@KOf<1=+qP}{&N=t3_uj8YRdw&`{?WavYF{M* z-z5RVE6IX_p#cE_K>?NdO4q^XKtca&wMt1(a>5%Lpc26VTvD7CqHVc3S~z0?uF@~N zy_azB@(mk2rx~Olv&X= z&}b)F{l?8r8ww+rEgdEe8xV4k2l^wn?mA&psdi7pkj?*D z2-WP#KH^&T;rcfgE=`w?HPVrn2mXN3hIh+k{4c=q)-}rZ70mV({ehmg%VJ$e(SXxR zqmJFi<+IKpUT@r*t;ePLP3?;POB08vhs!qof}hp)l>o~BBDxX~_=hKPu%k<*b3>=U zqw7DA)~f~*Tr69r^j+XWW6YYS27Yze@oZh^Z(ZRvekd4>baYMquWKzYQh-h!`+tC1 zUS2zOtfgoluKQ57`KhKl8qIqa2%|r`n%8*1KHKp(SP&(@s@EKzJNzK!vY%g-Mmiv~ z9_%yz<5nN(oqd~d^2yfkk&`VIQSJT?X^pqLD(22n9Uo5;n$lBQ>P2?7V%_RiL~?F6 zg?%nVHVfC@kl(lUBe5TV2Bubb{8Nj(B$@=|h&zjF*Xhkr@c0nHjD~pKjzfy7v6-W% zlQ3{XNs0bHju|9|6)?!~7-0-JKZfvzC-M0M~wN*k?C2NP^$mznZ~#F8*d0jd*#r=dyH_Vyp5wm*5s zwb`i=^DY@tbkVk!8+s*ls8$K|G~-FHZ`p6M=C@O7U)C0nDnH=Lwi#2gGH6K{xR$}T zmcq!7nfsZIJdhvg^3`V`LL zGHcg-LF~O;BGsG#{TV+TCd{jH;mKptnHUCXszBwHK#_!O`m>$&tBf=} ze7el#RvHXAXVP59164LW%H?%4DO%c`-n0q(<^BuCW7>gbbn0{G*s8r77HZtOS7(>R9l?X zdOl8Wl#_|nAt)jpiCn(H&d5z-CYqQSzUto5pQBQ`cEgIt8kIb(LS~1bpdZJVk;4?{ zV%?eFe%{hnLN~^kHdoRa&a*lQ*KarU1#x)wo}{p>B>4oN$)?mkIJI-Vu{dRL`Vh2b z43i0v6mOs}1`4MAs&2K|&~560WRp}J~C`iS&kJ&V;T%+2;E5~AeKZGdNLyHOww z)R=(_Ct2(|&t$>O2gCd(7vegarw zb7AD%nFszQeZz>qEA+$3r-VJ{9$JQ=p-vyb5Jv-uElH?g7xUmUxb~8svi9Uu$M8%R zXo&RJDeeN$U!5XD0$Cy?=k}OrLG+6z*yx z1n1mKA62vNj$BK7wF$^c*6heO&t+$H^2_vC>XiJ%6PDteUb&CcSgxcK(-Px6?3+4Z zm6y8aTUz1+dDMu^Ws&6m(Dp3Oy9pdFW#jmO5_c7oMte--z>;I&u)Yb4ZAI7$0Y3`k zqt{7C4JxRY@`tNHZ4cLLqWO0l;lVDxD@Lz#OAkR;9zSUOK#~TdKsS%ybESQ4k6`!v z)9Y8qUPn<&&3s%>*So=G9N_c&{6zyWup`**^-L#ws!k=pRn*XS()N95{8AbRMuzkV z;+CY{4QwZRzB?-P?p0%i7ZS8j^$G4U+n80;>roCF!*1}uLQ z!kWl7f;dv9Mva3EOtzoWy8AknwX;LeLkN=YT6h!}Bz}lpD*HRdba~IQbXk4BeqUAb z%au^S)3}-%WrL}Y6;svFqPK!cKvS`Lfwhv4mO6fnBZ0BpIoDZdd!ecU;c-0!r&zqqOA!iei0}R8K`eZK=uZo!C42zkAXFpI|2V$m4UZXn3Hs+Q?;6 z1$l|wCj5&r*mTgybLAG1s*f7Mf14PHB^oBFIXDw4t#MCLZ8+iN+Tx5+a3m!eg{LO@ z(kvFThHU~~?}sE!UdVYf9z4Cfkf-@YPGB;U`ayq_JXN_s4~WwN(y{hO1^zA^8NnQ* z<{W6$8frPm!55|MHNll)pZZI$#Z<>~`;&Ha$0eIHq4*2t4%9F?qyDgaDfN)yFk@9x_ z)>_VF=HmE4LF+Y_Ie9axJnyqW8R7-zMFWKsK%~NZhe9ug6ET7{f;(Q)DuI&8G4vP~ zOA_vsj0~PlA-j?k+mM#M7n6(7nmE*czPn63*iR@OnmJId4a}Z!L89`|BHeh-i zRj-FJa!Bi9or_FD@vWuuAqdnDq}dr*iBx*MeXV?+qv46yuz{jtkDcHe^BcvEgMNlA zew>DBbMGVP+da(KOOOSz;y`80AxvtNqz{j?=9zn_8#$?N_z(C>ejbF;TJyq5GFN4N zhrr0gB$WOD+A&DiRF@x?O>>f<2XCZQY(XewB5fg=uBNXmfki%T{|rw!O;&Qb+rjq? zk*`U;9S$QY<3Mz=hSogaN1L_Ao*z)b*rrX}vBWW%<%9-8mR&-j#Uv`*3=-PV5GCapyc)R zH~u9I>Y2k$HrRmHxon(HLtOCTs9s{T^f(xB8ta2%5qOG{_b#~IwT53ZW6@V{m)Iw{ zX?-yO#TrxPOTt=Xo-RIc{o)RVVj{>&_!KPV)4NPFqx$Z&i56j4}ICoZf zJLKZaPS76C?<0`XXg$Q}5RJUvQ4o_kkOGgI^7VWj&uF{ADx}q7eWs#Cuw-+W(-z^B zI@6FG>SbB2!^Mw4Gf;f5KB;In7jm&dYYG>@_%VOZ^YG%EzG1LL<`@%;YP1}75&sxj zKJNJDF~Z0o+5jPCGHyA908WuOTogh($*>D!sWDQ#TnY~rnG9o|ZzQ}qZDAye4NQ>7 z!N=NPJ|BpMClOnDDr*^nBi76()-SL>B()y5xia0P?xP;lpJ{o0;$!>YP|c=76QF0V%vI7+^daAO%WJ&4Oh8z12OgwMb;e)#9G~5h zUvj^if)DB)xqCAtFt2^#H89O2QvYB8(E2}9^)HhHNsUp|J*3TO^c|4O#)X+wE=VxI zDU9J&A!m>H>gUOg#;4I9$F@(^ll8#&$M{oZ2Ek=uZ))k55IrX7E-a0d$TRvS%&2)X zcNN{K-hq>A71eYDl-cs1k9JReZ7B$UziKew4vj0n)4GYs4uWKq^d0q_t%<7v<_3RZ zF2FOO#q3ave6VUPm1ohLag{@-?V;j`M=uTx+cjB z%o*#nauA0#k_34bKUdIH-k3rh!nMTkCG}@^D)^5r==^Syriuclo)=i23Ysg9@^y>) z9=`9fP1rGX(qKG~!h9%>dL54fv~&tkVP2qPT4CpUE9T>iVu2xZYq`H%X3P zQ|B$YAg=M*RN(qO$Noa4pIBZa+A{aboZ?K@Z{VsbsqNdQi!sl6%wS(IPxXS~kdD*h zr#F9cO^;^IJCe8K3FZKIN_h+`&3>-6Rnd@h@GP`~e=lcD>&}0Qq?gwKXvUY^lK-Lf z#kPXRB&YOo^42j*Tv4>>cwuWcGw!f&U-v61KRYoq;tA(~H#K^fOrEY&z>#dre?br0N-MFUlU>kE%vHWUIx@1g!oe&xP_x2>xlfgCSrr(eSE$gu z{G7^}rrG+$ob6xuJjiZkGCqY^zji^vV8);zh{Ftz(>M0!{r13C^3>rPVM3Lw7eF$tq$gO zcz5T!r(k4fH1$XkUrr zk!vQ}7biska(4}&Rf41PV$FDEH8}=ElffEImH(`_F^2ujKD2G|uL}er1|2wFhzcts zLD)=lu?r#l!eY=?3OB-B=w%+R7%|DO@=Yx1WK)=8w#OW71J*a2MZyX|Jr7MO_A(QA z?@ktw_ua#irluo*TytI%Q$3tnwDN($Q$hrq1k8W|n`7Da$9(f`8&&k_)9VB|O2-F( zcznb4R17TWn@fa5d+VCdEAt{#@5}Pm;X2;9!x?^O83fH1P|aZ#bFQ43f(G}Ikf@CdPqDvkBoS(Etv~)^tpvyy>88k%+uD0_crJbyLX>>`i zKkj09qOQ`{)&35~a#+L0zg;fM0Qtp*jbRM97-k)38s)a$y8mobjtb|`2G6zG;aGJN ziK&}@Tqnyjzod(u+M6{$@XP%{nS&r{=875scyUDHQDS}N&&}e*S$#5pg6RGU+1k}( zi=@YGG^>W>NG@1y!rY7K!JY5*y27L4vvxYzOU{rb7dFE^B2oYy!S7%?4iI3&N(s(z zNF7OPK4kq{kT;9z-S?w9yMpv6zHNksWt_Vtao9nWqj3P?WeXiXGE1H`>*gE>>k$d;tFMJ?rVjwGV zU_{Ocse-{UV6?fTC%aXdsA<9f`0g%-r4_oXZuC^FN)IgvHWd-TZu;SmlUnusW#Z=X zz#DGrgxKGIUC5lrz0Q&fP1JjTnoErIAz1tQ`RN-bQGLL8NhYNXYREuW3T(sxfD-)f z1B)XN=Ni6YqSA6FKT`z0%2{%}ZGwGfd=meAgefGA65T5cZLf0ISL`4TEG7B)=T$%R zfn;Hq+OjUYK~AD*MwSIMBxchQntf@L$f?hl81r_ZKswPEoSw=zhuKvOR*Mdg!P`o9 zqG!prY#P(&*G)#=dK>*?A~B;0psLxJbxKohn~MK5*SkC+a2Zw+2CIW0_i{&9yRH)M zOgI{LbOdVl34YaoUj~18QmC#P3IgaL170vzT0KT|m~Hu`ZEi5Q-j;n`@tWl#eHV0K9vDuT&+!92J7~w|i>+-(u_S(KiXlYoI=VjG8Ng ziYBPDjV<>Xye0|$2Ad}xz;S_z$7EmG##LO^a_a(*=7DC6jGOV?oRApBPxsXnem|aH z`PfKUr~=_xd`caSK7YVSMfM<_|CX5}9tDN{V?tO*c7rO@`;`VGmX`jz8O;4btfvx;KvgtHEgDCML^DxYw~MBI}9Yu|l7z{5L0f|vikQ}ESm z<87LiVyE|mF{30QgOD43g-ZJ&+6O_Pfjw1(YXs#Lv5BzD5M}bLUAI&nt4SQ)I;L1X zy5pV2lW606_6ZYYkf%~cD_}xtQ0B-f7?{3~sk{zv6|V9*d={^bICQvOzzvjcFjbwi zehJfk=wTd3YmP7$KtCJ4KJ9ExQPt_IrXpy%r&;fp3_5MgDclsY>($$!_JojcP-&?c zk#yeasysF7rsc6&U*%q55eqrhyoRsCQC8=)z<22??cwNY*_8R^=DJ4t*T$752GgN( z9_sf2U#vt0n{shPx3GL8)MrQUN?{hg$ptSdRxJIU86!2)A|aUkZx5#NCKYM^g-H-C$BpD3v^eZtWM`xfBWHJ2YZF^bBGV#sUj-9f|B>(cK7$tMK9_3A zzEW_zK++Q=K*449io0Y1k1%uVIsbRoKd0(^zNYidcui+@CQa8I2Qx0b=KNY6miEFS zb({jd$P}7u1{U{zPgAbo-;gxr%~`qnnY_3dyKP@B!Jl9txm@WTvs#o$R_Q0%)@W~) zjg_cAJG2FLQo&-aHL3ZkG$)PZ`? zO)~jEQge?V?L*CQM2UNp78$Yr z`cUkel2Cs&okCKTKSg-FcpQohQ^gD6wm9pQieUxtXlDRv=h5zDGP_7IWYvI37V1Da z(?s!kLxLsVBOi^m7v0QpI`FBbg)!d}YUNA-A0$Dh#LXkBnwBsB)Pg5+NsP1=;wwpX zy26+Eqp<>~9|T33$wSKw2ouz>iyKC|(6!{bt|$D5ikvTU%1&>Kge(8sT)dEAPt9fy zVa#FsW*VDO+$%?~pTEeG?EybL1aF7o(){J>klPy_p(1mSLbRfCob2QShJegnk+2)! z^5L+s4D3tydNWRXds7nR$E{`zlD2zsHZ$@vPJ)e)`BV_bIi#>pPc&C#smkL%=Z6PD z`;IurIl^4!Z#vc|%*+Yh#Ng(&5hhDph*w{mv(5Jy1vcJ6Tn zrUBMp0s)$$><0$|YS)K#?5YVu9+avT&x11C1$2z$nxpC8?rtZ2&DVUryu)Yeo(5lL zkXJPq^}qWaITAwte5JXp0eA69c;g)3UGrE1j6Cq;6Sl~^6jm;E^d>HwB?j>TZV28b z2dfGmo4ltSkW=g+*s~cNaLj*MG5dw`P~Xzgq%?>RTGJzUNVycK4Set{ss@> zns9$rVYxko3S5)DB{Hsg{}4L@$}u&3f0AK6r=%FOrgiMl6)G^t-XG_0ygw|9r_<;>H*Vgo?e zP(k|m%mII1G8*`}F!ID}SVnl06wihhRG!JUkrB}?;aGLH|KQG1hjB&&*x>R=WE723 z=DN2&qMz+}2Awm*Od8-P!q@C#c}kXSo8&4uiKfhVc*wroFffE+sg?PUx=a-oqM5A- z9$=$eXO`~a&sPdqt%gEHnHD0u>_+rw`yvi8gAc%w7l3Xq6}6}{^0KuHOZAOC_jj|r z<<7=9za?jNl8uvG-pIZH+4vDJr`&ICzOnjr2?}#Ftark6x+cFH6Gg4a1Buz*0%z(E z?nJxx1vl4$JyJ=dPlit}(|F&4HS0uf)mReX#86r3m>TTraYLS!d~0wO&?o^ZQiMr3 z?MBt_%nRU!=xCSi2X_o=g9j=&gndDzmND&fgL?Zu)od7z-gyoHa?(WIxA-E>=16~Z z-zeLf*?jU?MM6*JNdr)2#xyt*i4PHTvDK)_(r=x~l1VBe81%g3y8ZOL)ItW515cv| zHCD6r<|IU`+8GNp>|I9!(cl$$7k-76%#}u-3eK0c2q!`rQ0(5t_d|t~1=MKWp$9iX z|1$;M_T{3{yZsdau}>Z)warc)x{i^gFVFj-#AVqprkHS!@hnVjR+0Ve7`q5?-3;FD z;Y_O`!6YwVsfhv4C#z%dg4HQ1xY!SoUG^<8=Az(nLcfAQlcU)Hrm~s&Q!N+fm`fds zZ##C;F)Fz4P05Q0g9pVjD+Jf%CbH`ZRN1#GKVDL1zUVg zNb|JE2(MM#r>W=st!vk+z=b*;8%^cb+O~%5C)a-S-PeJ6B57-jKdcfLHTb}7`y2?r zXrVtK5%cH(4uVznME7X3Xpq=bSB&Z8D7wAY4oy&2nN!LxrtVkYy?BiXlI9IZ(LP`9 zr6yWe>{y6)WgrJ#$%h?mFJ>uXkF$JK@PGFEmcE4RL7kZ>sz8lnr5bG9KR`$DToEA6 z8@Nx`u9RC29+%fB_dj>F>jIVp!uOZb=>y+;H#w33b6t@BI@4N;8O1XHLb{bjMG6fj z>s7~CtyA_HznvP)`WbWFUksVB+#qcnvuY)sH=l*SI|C-f_^q>*PvUH|$$!BKXozRn zANN%|E98xXQ1n??pm4DAy+mR`KK=SB@JgN++E#`w>^$hOu6=U%Y6hb3m#@-#ar7}*paQ}!kD_#Yf* zhp4)F=|r=#=)o7-DJaHk{EHftU$`Fe*ty{=sIFSXxEUh+p~0cbt}H;%QTW9f&5jOM zDiMf1v*^6IXBx6b=w%IY>Nu`2GWbXu!{&0Xz+AZH>L*_nn{F9n=+5QD%c`R{4GoJ5 z!1_z;Snod{|7XDJ+|qKLTaK6MsvH4^(w6U|=10YbQ9)g!O0Pr2Yq}b75uJ;hlyb3b zL;LJH6V4%+hcHyYh-m+24y8Rrcs=c62T+$^r;Pgih0)XTB{i;O zbG44wX9yK~!COJA)UgsZcnt5RWB%R6h7lYmuHEE_%JgkWuj1;VF&Fgh>HXe@#fiB< z!zLR^y=_b?8@0hcB5{e9$LF`!nk}g*hc7XqD;qa(;iQZj{e^dY#;^tOSB_qVmGLUC}=I+D*&Wm-vMz?NTkoko}@K zh^%*SeCFQ*$}U$%h402q!j7ZRmy#x$pK>|e9;0WMr{f>}%Xk$NA?#-gY~Ba)sGQ;E zCiobj3LBQ8fqUjHPX+j zhXd>*ucG-EmUhKHWQ!cM`boIVBBS!_H>=#36)XC$>gZT&$J(ATG2Ic|CAp?k%pt zZ!?06XYXv|1bgQ}1d4eikxPAZ9=xIDp_t84sA_3T%a#@Tx)AIRoTO@Uccy0hk2w@v zEZ)UyxFG_H$V)?xCO18Dz;U#B)ciTwyE3VuF)HgqhQ~jX2-_{s!Dq9|U)}U|KEkYP zWOl~;^rAfXZl*TKpw^5LN2hiQxW zw#vO>7f`aYadYOjQ981jS{IenY+X)y@`rw1I#-T~b&OcKB^~Jl>Lg#WY4K)}n4kA3 zHwRrF4fAdwIjyVKF+M_vQrgXEoWMj;5^gh1ZJTsWULymUG`|-Wgu6iuo?6#hvclXq z@Z#n)wwm8dj#eSfJuV-!zgx}Xv@c%&-aRIFl&O#OI3yN=BiLZb32iNXqNVqHg{yM8 zD@w3Hxl8l-yhyzQa_&;0B+)FYTcon;fT|z&fF|8M?L!LOvg{Z^6|@CswwdYAbDLl= zr5_fo8ATUm^yDudx6T7_@=on$g8Z-clBK*7^dk`>7^a*`ikp1<&FljGSz-l`_f<2@0+K?KI4{ND zHHh?Iv)GOVXr(tse_KPo<<8IeNJt3RNp|2FcYH1}*vHP39%cMCr`>_XGip~`HZK;e zMA?D%g>szN+wIdiz+~*TRFVg^_p+hc+vzD?z73Kjb0+1Q3Ds)3$PkjBG?61|cvDrB zp2$Ien(+(Mp4lX~l4SEpVn|l$(^9!-@XM&4G)_$#y!n%?0HJw6+L6p z3R%lV7vJyZ*YcSIQDbj1xa}S^=m&cC{Dro{vQAa?gkjSq9_6H5wPWK}onzVbgsu_! zqLPCSAb-lMO{AeMYwN3|%aGN7WSVW-H@;=lCpnwVV#ar03sQ&TklPYw+vg`^b)9-$ z1<^!kSX@0Ie8flnEf`M*TtL^!2&B{_&r{{O6Ud$=H#uCcHc&qGcW&T2Co7%p5 z-!5sRf$T((kq7fd;^|M^=XaC%i+IjF1!bjxTiF6>?IXmWM9sSdF19Q~J2ezc~i;)DH z#UV7~aK6E2R;2#m^ot;I3s`=GA6~PdKbP=!j`!wW00ld}^G%q@vsem;-LV>ybY8Of z+yw6=m~PtotGkh6)3JLg#j*9Tb+!|%(cOr=A8*pDRBCHxU7}gxpa)dzZk(IdJKJeg zU;PubH81>==hP^-H6QWI9<48{mFaE_;r!S7pN7Lw6a9`N`~LOeYeZWc=KiZA!%d0n zl6snQI|OsmmPQK3zMK) z@O2=`alkvOAc~2KB19$XXqL9G2-JO@N zSpYj`1-{ejC6sVb^aY9semor`Lu*4(XEl1WNpk|ViATL`Xh>Ui=GTPO?CVqR8vxtp z+aGh{Huo|4I`Dc>@+kaQPg0e4jCir!b^WeX1=9nt7OMPKR5}~C?RJWig~}y(#A9bp zk*2P!BJO1__jNQ|J4F9Tww=H|5Pst{u>k#CZzTqP!qC^Bs|KJ?+%~^yM8kN4wY#X^ z3&{akiawhaQqPg3vKNSM_QH#?I6x@a(^~>?VO*T?-j#6Qs*o_aE8MKMF9Y1FM29c3 zi{EQ(99;CBIgyCZ5GRySc>q$ZJ^Z!?C{JLU=vl0OBK93V(*f}1Lz0f+m({@+)YJMJ zcm;&aV3^=DnTw_R6vpyt%X-_>s+wV(|D- zzD4jlQOb;H1(DnFEgoGVCDiE0Y-s1rQO8jDsPMuU5-^ct4lr9zvT zBWc2AqPqE}Q|5;5fuW}Fw1D@l2`_w%0Ov2U2W*+~`q1{<@y#wNqSqmas2kxa_trs1DyDzQpTyc@0gu?j-JL zm*n_Nd0VO2!rI3oFhEx!{2FtXUJ881dTb;!R4*l~@d25eDaxfM@CGDRY3#mrBu$39 zoQ}lJS9IzIcTpW-xU==>P3T!oQ$1Keuh0_2Er9@KNlU;`G^>{g7mtz5$s-AN>hSW^ zMyoDjA(v<1kr-tiI7dl5!ZTfJ?MiU5g)7cgrEWjXS=8EC6@bf_k+R15Qr5)!jj5J8 zy3Xj!h5)5`f3DuLXUi5IE9r6o&a3ZA&6wUA-#>3|Nd$_$oq-ZEr&F1nUo#SPw340| z`ri+5H@vJ?B6T&#tTp6X6VtW??YDHYo)K4;l-Rs}rRN;E=Db2g4zVrle-oBTTV@${ zD`&;H*v8?2P{@s3q_;f(LOyGukybAhAGl-7!khZNB>U)+ketW!jy{wLVaYl?GN4<0 z+0N=zF2=Q059c}mo1k=}WU@`f$*OYCqJ~8q_aLx{PaL&?nHj$Ywizo;v()SdC@N}g zd_S%dof+nctBK(5TBDf0^O$YJTeLf-}sPiJec?-vN(!ED<^7=JCJuIv!cdeOz!XEz-QOZYbV_nQY z?0pf397(atQDpzJVMux}>k!94*o1WM)xH$mZ(by+*4CQoR2!{fL;x-cR>b!Q?)0$!A_H5e+b#iGSV`nk6VDN z2frqM(BgyV8_6WFi{BT-8?Dq_o)(PMkFt>EuR}sr~Gznlp2JknN?7p=Tsn zqn)GP6Eb59VF6}_Fe*KKBXx>m(ToU^-HyP>jL$6@FmqfN~&kQ|)REfN`;r+zIOuywJ`~B$6 zyRXy=UXhzBdOk_ZM#7-d&>e0SKY}D z%ci@#iBW@U*gpS7HtwWB00Q_4w{A!ZRd}OqH^aVcebG9gjTNS6BP;Wzsgh10q>1;u zjfx+c?cKaNig9z&GW}`SgE7cb7uVO-i?~-JuRi5dcR)9Fg80Py6`$iG$(oRe2;rNL6&8!jFz9NMc7TnYe57K7e~NvAqj@ z9)w>=IGd7%S;Wyvo-N@ft~(zC=Jo)pKMK#^>K}tCix77sz~RWbhj4(>z=n5`e_PDX znsv=3J3RBQwjQ*d6c~MEe$)EoC(>AftuWno=~U)8m)_<2t8hd^!NYe*km8W4Dh}>A zKhk{f?u;PFM#)~C+lrk9!B?>%Ha?UZF##glD}Q2efIM;747Q*Qrw9~+v;f6mVygp` zjnd>uHZWorI_Tj#JAe|Ey7$6V4nLtjsdrszuG%#-tk>+Qa$oh1kDPp)+RR=mS$ADM==y8?IEyeF?dtb4-5+<)3JA= zHmq@^<|Pq-H=^dWsDg`v@gdE5#gwSKL1$(R%}I6r;liGZPC)e3JqyoEQd$Abpq?Nj zY1|=<7xr5TEghYKwtgr$|ITprm(w+}c}%0V5B!^rfJu@1k&P{-fe94v{hkdc8E5JV zykZq~V+jBGEjjX@*H3TP$!)k|=+U05Sm-M+%k51KWtRyz?R{t!W&E@9ZZ;{RxqfO| zq8HJ*GUCxp1i;*$+TD=m&Vg}Lj-rH4t_XA&U5hx&Jg2gi-WM6=a4Wcd7<#7@cf`<@ z+jH>lg!~Skm~Pm~l*x-Y_KxzlXFPYNic6ZMBOn1vmqbY|S1mt0E-6IJd6=BAXCXR?t60ku;;l)7R?O^C~qm;Cw_XxEmiz=y0azq?y7= zfP1;wDbs5qkkv8zVYaHkJ~b}!TBd=9j?;Df0bq6XU5#ou)GM#34FKN=`;}|rSJ8U= z+_F4#9%8~u>KCzZ61coY>#8kwMJ}*OXR!FRjWL;mi$0u7*YXWNbmD~vh=>yTq$N2M z3zW*IIz&p`)1ndRVTAi|;wSyJ6iM;5sG+7iuuuFV@>z-9RF&_EM+DuF>i8f-jbC-` zfC%zl1#gVXrE+#A1d)RWi#~e~k6|)y#71MPF+AYyaz!!}I2B$aP`GLINV5pk{VYCj zDGo+Uo3k0h)En?#obBzl;6{q07L6gfQ}F6r70a4qk{w3?(b@<0e9f+)frr6x!7u+O z@-JUp|EF={i7eaecs(8RL;NP5nA(soz=KMU-J38Ok+$q-8}9GTAdt`dubwON?;ZD} zpRK~5mlQOGuOM#?nxC3f^dWFfgO;C`D)r+lhs~c4$WKAk#L;-Lu+SkS(1ATTxU(Ha zbaA!Cf zMnzxsSsAvoamERpxPJKGozPd#JimD?hDZ|y2f*zWsgZFtoV7~fOUqNr& zOO$Kze9=r=aH(9@?Yw@kTvj@z_N;sY2BC~yLC^KK6d|?d+oG9xypB?U!FRc=#aOv) zDUaLQe)+`59hR$&+hXB~V8X(^8)1`cBTlC(eiK#?#OpLrx53Df*--;(r<+Ejyy?~U zz@?k=GaH#dmg8C&bzO}$V9iJ1-rnmhTqLr7W`(CBg0U&8;V>T*fEi*v*fTQ$cMbs(a^@xUVFLp2 zVU}NUw18;0$d?8(jKSUx2r7SjfEtjF6~vmHd!z~j0YHAK;6tkcBte!EdKb7*R*ePv zT6RZMG&aHzQy7BSow5nq}Y1 z@tRWx+(pCe{vB8OK=Wd?2fRiV!q?+=Vv1f9ZO~@W`NzFp(-wL4y8Y4Lt-^}u5KOh$ zb@0s*T=yP(NjnWdMO(*CYti#)KFYpQ+?CTHCf*PbMvVsAsOsGuhb_$`0-=ojRVcm7 z+E{&-0u80fk*ONU-|Xm=q=YXuh2fwq#vV<+vN+})uOk~@Is=n!G;otkVc(doDc_iX zfS=f_O>?)SYU(zd14OHQWBvj5jY+9-5;ZXS2N>Sq0Fcr2a`@&*AAWSZ;MN6h; z|D&cGs}Q6bkv{9dY3zEowCJl44C|f&>b{g!5;Jb0^JYt%XLr<4#gIA8R#q*vx>!z+ zOCE>H572@6Jzn8Aqkr|e3>p0cd1w8?@nB6myS-S^HSd0^-?@I&T!3eNw4^_;c(hdA zxsL1IB>Okm&a+9D8+!TH?jkfk;I!&;Lm&ANV{s?#W4w_ zW!eSb!SmMbqY1H5`y>C}M%Lesf!xNs$?Jmh05BJeCD5c|ud`P}k802nx{~^%HoY2a@jhy@ocyy5PtA%$U0I5awU)7Lc8|y zvfoPIGPAElJ93riPcve7)Vek6q@zM^JK)seO4u2?@GHz8WZ%%N^eU35CI9_;&5E`& z0&wwayYf_fuA8vJvU2Dq8%YOnNsz1d8P)pH|NgipqEp z--jn2!gBtvR(U^WzPI7%$fUviCYFPN$Ob62FMN!xeX?+CS!$sd1Lj)~x3Hc?cT&jf#T!U#zwK#%;h2*alG=-`!E;3U9j5`YS z3%FL1Uj)?$A+$L52r_%gze38H&nRKRuSSQj?7oX+p45_M`e=#3c(;F*|8xF>$Vg?9 z8vc$49m-%j#-~BwX0?KKkf2^e&VDi|e=>2gLAKhNX;Iv?|Co^qH-xMEPXU0@$Z(Y4 zP)JF9$Nc`}*S2%cZ}6fM7m==WW8(l2hj8@wVYG6~m>{o8$4Hg&PaVN2?D#QV z-oPr5yjz2DRagKo_4gJuS#7H8`tKtPHRJULgw=ip?V0r0&0Fz%vZnh0NfQGzp>T^-*nhQ=xhTvi1@0QygYXUw z1mA^E3qoC8z~@&Z;$02E=Q&Nv2A9ZfVU+8bakB8g>NYI--#s;ahCF>70{E8y^<)fv zFwgjxJpmdW2{t}wopJ2jOU|GznEOwf2YU48ras%q0^7yc-F3JUcaY6JfH9Kz*?~Fs zEdGY2G0nby<-`V06cffb3jElsRUj9XV3><>Xr}vePmWen1a`OuPf26l-_F5_HoL+- z=(x3@d;0bGPw^oOWmx(xYfcmM;jEV#D5j9^Za58IllwW{9Us>}ph~j9AZVcfm#v&+ WEG_c?*vd&&(mW6v(*LN;K>q`%a*fL|nlBP+>5LScb{fx&?hg-g~UXTib$TQ!W?$^8Nw8sOrgfRmz(hCJ<= zX@)4HZ|#Mic6u%_@5O7@#P^eN-Y2Q=J{`uSvGygF#D%^_JQ4D-5W>Xnl#z8=dcO|t zG}A5@cxUvlX<)*!kJ7pi$Q};#OHGUlhISBEOm+tm16x^W4uc2zDu0+5?oYUphIel0 z_IF&&cgk8mzy#D8qOO0%2Z(u0To=#NLlgkL=Bnw|9c#^yElAmsjtIHn_)e|j*ZIy@ zGMFHL*9qi&fvajmBC9l4S!8qL?F)uKTMFjeMVzq2^VSdPjE(GWefdc#nK0 z4I6w`%~loMLbcAF8(aQUO8NgP+VEz`$Xg^Ezq5I~ac^0SRXy6;#@N0{I?~Zxupy4l z6zxF9;Di|%u3taWuh`cgbU|77E~(ky+CKU}r`qtO+-Bqs1#UYxJiWFVISZ5A zANAm`ND}{nU?vClweDDEREhT1Y}7H{*)3kBznk=Ixb_a3$DlfQde-t@C7*V4T#*Q1 zTqP5Vxo-=){TG9(Gs7u~bcbLdqO&Q4I^Q9@J5fYO^w;=d_^VR9=ssmMq=cgctTqoE zvnQxk7%{+d1@QBE;4Q{nfrMTms6dTL0vIdS4=ODK}p$)CiwWRQ`6+(U2LFSFFg&m86eAkLb$^ zVa>4+GLRbaut;Wd7k4a?LYdfGYANIJzKl?lxf>jp%-z0<4dLeKxDX2=^7u#@cf5c* zcTKU8u0gQ^c{Jemtrvfv58cKpPzatfabjshmAh?scIo4mroK5Ds_F@n~KKh%_6vzfh=~4Ia(+S64SP9)j*?1 z!BK2XiB`V(D>8-_2Q3SwkwM`gyAK~^0=18Aa$kedV4nFp+!I9uXK3hTnc1!^;*7^& z4Mh9V)H=*$wb#vA*qB~6iPH0X2KgDA+Rz))3C^@OXZFuG4iiOiy2Uk~rtO3qAmzM_ z4i!d%`g@CV07T8t2qilFnW(bA=G>ySU0#?tu^*%H#FIIMW9lB3%x2Io%2-k>j7bE9Cx3X zTxfjpT5~O5f$4B;Y_O_3k1*jf$QUZd^jPC}-<75^i%2E{bZ2 zI_wz=UKjzjz9=EPfmc{VD|hrCD$3(`D5*`#+#<5N*6Z^!2Bx=u8wZG~@*^vgKqyX? ztSuxCYk1&`EVn=L)&(u75#1xyozo0yJC}&yr#PhYPq%LZvRk#^umcZj+6XZut%;9j zkGEbB(1H|V~L^%1Jb2)m98V~T}0F$k}+2u?-^_FseJd)>F=Y=!Ir9i zu*6WI!SQa1f1fCg3+~yI2!CN+1*Xh*J8Hq#C1arVAcOR{MvjoJGy^hDUiGlFs%?w4 zbXHjX?&MDlZHZlUCB{9EjV6wY4?QAF-l`Y7T8(B3cv8=BPlMj*Kv{`uz$azFJKOH6WY;=G@VNEeO#(6q5xeT3!k!~T-(gJ?Dg8W`BP3cp!h5%skq+wnZUT_0 zRDK=RX}r<58DoEq!iT8Ww(&b=dnOxv^v_rYF6r+qAx~BA)g98`?;dX-Ti0828)~N` zJG$@84iNtl;h_n>^!JD$38Q5 z-SZpenGN-J6}T+Yt}ny*?b#NqyRqk&**L zPZrsSXkX|>mNZk)3N((eGBTu8n~?9rnh0TvHzir&qY4UAa!pLKCmK%W_c_0LJ?|CN zy~bxvx(jq|!yS|4IR;Hi|MB}C_p;m;_=g-v4$0mKAYD4WWr4m6o4%n}uVrW(37#9j z)(l=ia_T7rNvMqw^`P%$O3JX~!S|5P{87Ve3j@-^AXwtuk{<=xBjlE6Av}4+t!7rE zl!yr!8ze&n!Q1;WP@(v#x}n)ULD#=Xg}Sb_`-OkBn|5c<1|6-jfA^j?mP(aH9E{cn zPe`HyblOpSgGuoyw9(nvXNiNNRSMPEmcDdI_;pkofFWy(h0fUiQg1YsSBw%03}n(; zX2#zmq zz6o9BeI6q(sg7IS=e_OFy~UX3mW>yw8`t3tPzVW%zy(j5v4+-Lr*$=qn2uAIY@1^p zK;fiRf{ZD@DI`e2N2Apf>~0kF91e~JA^D0+-toX_Dru5C_I>U(eDdsLE4quDZ*|lY zEQFFqj(}6K2h^#RQaaqppQi3$trI3bX4{i2d_I#QY$}SO%Y&%84gBLpDQJG`M8tsr z+H-fy`sp#KJy%LvE^tgL@n*>huO3x|Jq|gH_IM#rAemND-85Ps<=RfON`Mx8M)z1qJGzbfa#;86kC znkgXb)i|@v=O-cqqU^m_T%!9#He%FP$25Hb284W*pJw!UrOzaMqsMXT|52)&_ zS@-ajdUxoYYG#}dzm;hk-e=p_ax~3iE+W7>&3^AidUFhYNOq(JH;4Xo+4kEZ{B-bB z9kF_APjSW5fwub+J>6%3l|wSTGH3J%2+X?RGRPAL5{=V% z7GqO{7bDwyy76j=n}ci_sy&FJAXoL|vycwsWambf(s()jf_f}s`D zUK#?WR|h*MA+Cg&?{5`&PX>oH?@4@lR0e)>3%j>F_aO3eGlPl<;1mWoeE140?>(*J zY;h`?Epst&;u;?L%gm?=awrR)M{a*;WM^bF0@?JY|)M^wZDb9o~owEIMnmQ~I^PRTC@myaWbQ=CG1nkS2Q zjxbv?!Td-)z=jbyUj}d!IYq6Qe3LOpQRMIXQlj4IGCqGFWE`xURIOA*FJRW*A5IuY z$CxK0`_w#-AyY(ANh7Yvf1&5z-WNVlHIGo<=wA}AT5HbNCs_Z{lEzir<>ZH5ViMKp zi@X4?Dprf|TGRh=MF9egx!wo{UjK&RPh9c6Gocy*=RbTNoiiFAIA_ktPpx$*vpgF( z-HBh%+vMAydXEEsQ|e$gVA$tEgMgP8cR2)7DHI{htd%nB5wuUDfy}O z-k&0fvy?~3c9OIQe3D@mf6N4uJHZo!_`^DE||W_

fw*mM^#&J{L<3Wy;wspijStyM9B*ano|mq-Du6Eg-;t!78De^OBoCVETIs1kDm+ zbk=gOvd2ph#nxd@_BCg;J_&lJX=bZ%DQ&@~D70;6 zG=sDS8kiqAFF^p`j&zsN_x8)yA?IVSV}(y1^I{oC&eS?af#%NsC$Z2VQ&~*|j+S!n zmtA!&=Ve84S@%Un>)@?7BC(XdDdz7dN{MEXb6d&0-=$NS0}1W)NhO*OYbKFNuk{Y0 zG=+?9R`(d_N3?8`nb{&>e?1I2?{7Ept!nue6QgQ84LJ_zJ9^>A-;kuc(Av%>11cuh zp4DF%BLmXrEO2CveauaoU>kYHHIfy>O%2%KMOKY-T_gQjr+%DsrVqtG{j7kEg^^}Z&=;b!#ZA(-34dl z$j+?cMrZ~IGlN9e${hM5Kqwv!U`G1Pnwdq7aD3qTfHTea+gvjd3?(D4v#mf9jw^xI zBd!N`kj-~HT~M${np$t{#wUy7bL*oV&`SLFqjm5czmXC|%JffiPwY!;-Qq9JDxM&A z?S9gpSi-%KU$Gz|vCddf-0H+mSJ(##G(!y`>Z}P9wrkaJoHE{%|zi!eWe9m!KiALpFIzKMwV> z*o4T4yzay}l|)D3#2{f5+FeVIfiIYt=+GAm`H_AwnvTS(+A=GI-rd!3G^C3%hudl+ zbo_urp5j-NQh}QZH%kui_6T4zCe|C3Fk<}t>MdYD=N_kti?Ps>5<1zh3LR0C()5Ib z;Z}CIvJveK?92yY=entBc9y8h4Je7QeaVSj|IC)8v=XSOYwvg_7OQWC)z^2OOPwLI z#-D&f({p#4K?{8+Rrm4n=@z9}xxsb8C@ckM!A)N9Wx)+3{nP{eC1c2m_FeH389L(c zOMD-uEqI>RpDc$XlgVjBa$Cn?(fP;eD)mU`6W5K0z93fcoIH`EC ziQ_RAn^LE$RhI^sFwog1k~k@LEslOW52A*S)In8zuw|-JR}H==8-_kGggSYFu@bf~ zLNPSSRab+8^u3u3CLJj(AO2!UaQ?b!W+0-$l@=p`?lWvFJnMMN4+?)rM!1e1M!>6@ z08Nu#7hSL@HXP2v!3ekdRWCOE1x3~UCE7s`MeAY&bD0IM;Y;n|wI2c>J{(EmjDDks zT)wGYlh0d1)MN7=|F}ulY_Q71T^;%0$<6An+v5f|UPTg3$<-Q$jytwf(Zrg4+yQKf zZt#pqh)4fG{JyzXrk!1c4@mpYFRQWilhgLVi-O11S5G)%#U*A*Gw}Yxro%K^vmkq| z>4oubwvHb-(p$WE7*Vy{G$*dKuaqd_t2;3xBToQ!9*$7-qq`Rm_C-ZYVw^_D)v;?x zdiQ@R7~u3=vhko`VsgKX4(Lp;(c-;7RNzK3Fu$`wySpf!NbA1b)bQfjH5L#+Ll+w>L^w)s-9wI(VJ+ZhB`Uz;5Y^o<%DZzh#h&&Iy2!P_u12{B>@2ftW67Yjvu=B-$w7N1zs;Iz z#}fNUfXN0ZnvrmEwbh)&rM-}!N1#!2>VvNxgt^4Ymoyx~t!f_FXHOzo@GHG^UTi1# zt0vTk&aUO$RC3+lthfN<1>4d+8n^0ARb@bx`d%p3m>_g%k2Yzi89pdd0JRD8osUts z63I=y4P{!oyLFU3;!nz-VdvK9nyiOEdUkfRml@XcR~cK=fBblBH;5a=B?L=Wob*U% z4J?oIgWSY*hpJKtcT_hu)3v1W&Qf=O;lccI5OTIpsRXyrq*b=35z)yRdx0$BJ$V3# z7R;kjr))fD`=!-il{$@^9yf&}Pe--C#gfYp(zX^~Q?++4cA1 zg!5?Exb>M6j`r@lSKd0ltB12-N5s&!2d29;_Jsn~8tG=WDw{>41=`mZ?eDsY(2*cb zy6*C*`1PR3*udkV?7ByaYbjpth6CWH|E3&{0#*Z`_m*YJPV$OOPfh=@d;dnf8(EFN z6Z@0?_gCk1{z3h__zkSh3u8q#M;qC~KTpgfHL{S^j*;i9e*8Elc)~AH`?26f8Oytx<`@mZCV$QN|yDC7Q zO!CIb{zqr0MnVgTH1gSysPaI8>kE82LwEL(c_-Y$aA6~?7rKO8$p^UyYe|L>WWq$< z^M)xn9@KstAEF%DBZV_lXRtTz*Y419+g&Y+_Utz^sob0$wae)k2?w1^+4NdTFT!0R z;XI4xn{1eXES*{la~IHFyH|2dN$PLv;gZr3sv~zq(xRuiT)qc)haZ57zYmk^;Rp7(4ARIV7K; zW5;CUqnqWW30~QkXD;38AG-a?2yHg^lLC1QwT}0fMFjjAzlSP2dGLY8mja{@T45Im91s4E&s}lZ8VyBFNBLY99 z6FI_Qyrncm{oI)_FFAz53bb2ER!KK=`hM0xL^=1{+b3=sC;p41D^;^cn0ASse;?rY zs^FKS?Z&xbrxA>rtR?8MT z$p<-OOP*D)gO~OysCy&3Dn7=5NSso^v4U=EXUP4vVZukU*AE2mr$^EtJpVeWK|&NU zldqPxpEXu;zh_SCiE$Mgg1`}+#%Mbqb&@zhC_xachz=B$)Q+3&TzX5qauFNwP7Tzp z1se~7xFm@eESfcomk47`8f=NuH8K4>E4jqT=?=&pbtCl zJ3dTgd5Ki2e{rKrlY+?)!^cTo<64Un@ucZqL8cB*=#eRmkw)HPQF~84g_uJ?aM`+X z!=>A^r;Uoy>qBpp*fQH=x)D?(K-BD-X^BUdt_HkDe=ul?_aJnOH>;V=VvLlacH$k? z_?4!}!k`y;e_Tx-taUF>W3%2E3*lHjW)DZQ z<(U9E;!)lvu%dpl6LsL-cMh!Gx6Ay(mkv7a7p9)zf#B>rtU)wq{4CLmOJsNea* zap$iDGQolw@&0n1Zj+z-L*y`~d$zaE!R#B}qN(|PWm~Gm10&{Vb9$Z;77TD%@OQB0 znR+pFuWaqIGPU-x?06qNu#~GsWI)rr_XNprf(ig*~C7NU+{M&+E?425Vj&I@I4?zF}Wp2RRchC zM=%Qyh&+10oy34=(raqb4CI(PD&=MCZ~^pCG(#vF)*Obrd^#5DDjx_UL%3A@ZggdC zb<$t!Wyn3uND^Uw-t3-zkgb99;w3DDvq~1Oady1>8KUroKsKxq-Gd%VH|#ymL74VF zc2(-V7NlY~7L&=}y!C7{#!j{&djQ7c%96>SR7;w;%X2?U)>to89g#LoS|Ea*IPc+g>hPzmgx_AOZ;5AXN!AEOxzBtzs6dP&HWRa=Fkb zlyO^lE+i;+kgN%J5R_N;vF>Y3i_gm|?8v8&(yMvUtL)ff7CCu{#}=3K`e>iWsMEua z1_K4nb58>o952mg51_K9g@LjOUUA|L?vh&0A9o3Q(!@RX4%7W*?VXIn_-WNJb6h3V zqZNR0^P+RRLsoM;N(n8fVVI8v_9r$nmcp`92qSd`;cz;Fzj8ruq^Sk(nO%K9C`N!2 z(uv2o#L(a+P9mMxxdd;{roFpZRZ^}|f`vb`H7l)(={PV59%%`i2hb2Umzw{>;mpBt zK~zkf`k(?Egvpitz56u$Sw2c|w*YlRo8eOc*Jb z!ytBP-jUdytrI6FM~R=eI*z;uO}$Vs=S7fW8C zhB}l8@Dgi|fnGcIMV8N8 zDhD4NWHYj{&eKA^YuDw?c~ZVjyU7Lu z6yfYET7^^UU}`URU`KocE&a3YQ_U&h)KxjASE)G8GnzpWh0o?qDPJt8zHVS8_$@R@ zzJIKO8Y{EctkFjV1VAWq6Xb=0XH9(j+k7>gdvO^uatD}$zl_C&B;@pk13M`TG~{*X zP0mMU=RK(0$1u9%Q>sQ~xioPpkUvQPu)Z7pAWxpH-~U?Wxts^b8KMNQjq|cr&IE}# zfj6+cRx*?$G!W4t9AcNwKDew`K+JargmWSXK4^pLUgtAV3cqae-}`$nZ3dllQZf1YDd}9t&aku?O#uEpmO7{T<+H+)~|7EZ)GKghtuIN$K9e;rkC-J6zLt( zxH4tC47Bbk-IMB>SP1Ob5M1?umVd%T5YLL{q-XOGCFP(Rx0363TX&UTxC@yfwp;To zhDqb+hbr5*?mETq9$FsO_g?x!g9B!D$WBV@J03FEc}}U7{Z=#K~9p zZol`K^}##^=)*1XtrM3$BAT}IhgwUQubTK)6dKoG!s&-R%cjHQUli2==_KsMO+D4* zNh)R!yc11(RyP9XIH!}TRFn>@J~}AE;!84u8-n$w3g!uzsyTd%r|9Y)kUu?Qx$^Z9Pkd3Xh5B14!zxc2V{kq;5L7L$z-0jO(ftb&WW~uJo9>$mj5IM zr?F6x1Ph{D0?@y8|4UFJ1`kC@zdeJ?<%8gK>*5GmDC0BW!z&Of5-#&*&D5 zA91Ai7tnmvD$0<%((tP`>y`^pF0=+g|ljYJa--n$^wUX%POT_ z+d~BZ&HlHgX6(4Dz|rlF8aq2Pp~H7&OZ-6r^I^;FulbQ*Ww1K<_=xWnEx0sUQAOWAA2h%|qBez&VOd6NKu_Yke+&LVC+s$zqj&C0FM2}m z5X}8OkQDWQc>_kl=0+szt{-ysta5W9_+ZQ!g>Yf43Usc#*wOO3_6VVJ zRldPVw!mCffM@k?<~d0+k3~MAq~3r%JdZKfel*_r1bSS6{C`1G?G5C7Z!KiX+1W4S z{1S(kollaIbWBDQbrb`$WZ;hgQlLn*rJz!q{M9E3@d-HBjKR`(CyqrdmAQSGiQSYfX(8Y)ep!N>N|K64Ue zxyUy%D*H_6&9H={l%}IT4KvOvr9W%jV%fV+OQz@OQYN#R+Mgg>{KBMEZ^F*f@lBNN z9s7OiuoFN*{MP1^|BOUstRd+II8>rK5KqBq>{%_d%b!Uudm{&$>>MIwe&8r@amS_^ zCQ|xAKe%((g{}^#38iP|#NtaJflf+7fWmfZJPE@PxY2TQ7Sz8#KszxNbqZO~G~1?# zYb7F=a(Ex*cr{C=JSDj~vufuF27`IY;51ru(0>P(W0&=l&FA;?QAn&}0|C~GKUT*(Nwx>vY9DXApSP99@p=3 zXfha=ut&=(opTyzoc!PY#e9(IdXJC0&C`!LD%oVG-Jue(s-lI67OIX@2Oo?@ey`RJ z>;09`XqSL%$@3|%&Wf_L!nR9>1>Rxgw&fxXU+{FTqMjgwmrp34`5dS*`!65F9W`b{ zguib)OKsR7^OdV9danq-B)}xXy%7%?~lJr=H&Wh9Ij1~J?b8fU9$r29mHI* z+f@((3?<~*i90O*k{tIfq;}f=hCxl#Y*ckHDF0?d5JgBFkMufP zua8)wRC{jWUVE+zsQ_Km2TRUY?~55FC!$_pfX-WPO~!M3Fc}+{99*PfQTP1s5OKZd z%OiGJ!3R-#-7?gBT9k!mq7&UY{+<*2mw^BqOyH7acm6K%l{)YI0ND0I>3>Sm$|Ls^ z_M!0a!glN%hLhh8K@pTTWB;;Egg~YKv9)}{*7{7fn>3t^8wW}{NwmvlOBYG=#S5ra zzI}^p700g>>!Z37LzI_NT+pxQZQ49p`u(kU!S@IIkIair%?H*$q0D0X@GUa=X~EQc z#^9!Knlgp3O8x~cJb+`h_}2XKp1YrF-kWwbAPIf^HWS+Y$zy_NJp z1Za%pO361tyfcBZ*1YXSvio$Hky zZ{57+7VR@Pe!yaz5_!QJ-g-Jv;#pO?{(EKN{dQ5~Ym^Law4pKjkOV4q&gzDPMu2z} zlZ}-@wr{6b*w5K#i6XL4)nq?14<2~9{9DVZD67*hVRwxDYiDL+Sb8|*ONzNEv|;H^ ztwGlIt9O0&7GbQP)SjQ^-g`0@0Z;p2gK&xt!3(__-oTfCmoPi2-!>cPekHcryxF{) zt@W1wOcGR*PU7&l#CzIiTvljXa8nefC6ovZ4%R6^kBTd!-m~TPzy_|b3`2^Bid>wz z@}2sERnuYDpBGqCd&G2>KP8aC1d!8fY@ljQP^tSWdwxQYgZ^Ny7h;5RLg)XjLKv*F zRW4Ka27bt92<7TgdRJ2tt%BH)yrzd#y34l=byX2W=6pi$B9n)888dI0!lM>Me18+pfSBN@YOSbXW>L)(}b zn*FPEXuxnTi<^h!Z7q0`VQ(kTs&jEUseIc^#tpHamdznV>>LKJysdy8(~ z$<=`8+S9l>*Z+usX5!Qg}R~7xtPl1dj3poq`KCU_u$; ztQ``hi=pp@I+4bBHXypWuIa`7`0?e>hub*=3z05lJF_Xv9i7fZwn}w`5@~8gAwFNY zil##r0*v22K%c^-b{&9kBUzkZ$(HwM@-5g)0m>TN zvJW3MiNSwp(Ila>TX>+?B~tuCdNb%4PV%6)gtZ60!rv%;7j=L@ zej{3s3ayJxSW12tN7q6a#ZhNkBc{>Bjq(oA3ZkzxYHOATL4q{|(2Wr(a=$0Q6YlHz<`(;qR%P`YTCRNr6e?D1hx$}ru zK~&a{i?WU8xwfFO`=Ds-b%`m`v#tz_$Ko|0nSAah1eRhJePR0WG=b)x5v`QyIBzg~ z0M$M?-%(#ZL0W1RUbOxy=!GP&SYG-!ma6xd1L{sdIf|db`iJ_~Ach__Ac(kpwn%^n zn|Jfvpx4sDZy28mtI3*Z6b*K@NR0sxQ*KJwo?hg8H&%z@ zKCzk|-UM;objumbgH&YQoAh<5Bck@+dWY#Te`>K^w=y?Nr6MId0MZ7%yImSm(29Pa zd(cFX7lUImA*dZj)LAs|rl`GPxq6x!o;s3cmE!cCP`b4@)D^>sSkhZ@T14Wln{*5& zXBJzs6@AN?5i*a2^NQWt5NgxFOyqAK~H|Ja< zh$dB*jYPU5GT8tJc#5)q;Zl`Ww^c-7G|>gZPa5PDNNhC}+sjPLRA!=^vwMOC1+7a< z0?JTO%Lf9^uD`*8GI#|>&7wyHzVpzW78S~@-Y*(M!!8n(FtvX#jKQk(I;$riWu)n4{#-0-I9M!F&T6;1Sv-7qLuzm0 zvzWWf88v@ykJ04QMBXlo){OiO>17JGQ?q|tf4c_1-A=#$wch1Q|Dm16lK?{)sTDMk zxT@9!5+rp8S~{J?zKE|KTV^c{rmPQXIL!L>L`XCtUJlLV&{l#W5McGy;!3MQ45lwK zA$)uoBmxdg^`yDN!S;Dr?>U?J%uLYhJIBT_&X9in_X4@^oPIrBsl}G9?2udRvy@=9 z!$`K@`WD~Z1OHHtkRlzKc_fPZ^#u5oMMITS_?<}syXHjjR;)R@T6PEH6&C{`<0)rd z4y)S@16;Nv0aUMKC>zrzC|c0#8GKf1^%qw|`dT)MLwTww8&vNqC>!JY9eD%I|8Cc! zzLv#GM{tE|h>wTu*m(6i_P_V}ulIBH`Xz>%b&JE2&D^ioendLS3y8~o_izBI5owuAq$u+FD;r^@-WZlD;CfySM3VtC_V^h2uT2Z&r z>djN_9{yKw_we{iYhF#=zk-8n?8mmPkpaa5lxHY0S7XKfaI%)%r*1DrL));DIyHBK zmJ@R?X**dL`7EfN_7v6`_fGw*^9QzvM!t^6C{O%`Ke_RRmDm_`EdU*pBz0eznA}MV zA#3}+g@q7xKXk_=c*mLig2Z7%l~;4pO!MuUDz3aKfr=WL)!AZlRQyO-He=BDLtv@f zw8q8f9CG+Gz^%zM!@UXH%=T_X4?Vo$6OVSLb?B zCY0ql!!*#Ivi3M{81s8*5UP?hD43X2m1)_`Qrr%j33aZh@!v_jOp! zDsQFdCaNB;lz7gr_0GQuH)fJZIe;c@OV#yCa#)SdfaL^0cWiywS(Vw6bl2>#Z99Tob?OAI>I%w}%o3^j&_fQ8Za;;g2IZ4!0BKV^D#xaWX!Dj_=hDz$+8a-M!hgJe^}tFf8|`aSmJw3V1DF& zD1q`nBBklaP;QRTdW+BWuColWtnxXIM8UVw_J7QOGvPfrxWxi`;ntfi8h=Jsr|+L^ zt2wIyew_wwLR9cSr=pPjY_?Ld!}u8I>*I1Y2I+c^zz{Hy0U8+ixV9&;;GvzM01_Q1 z-JxJAFZ}zqO4dobyIOHjSlj=npi7?pGwFAUK=HRtN_(N4Fn>OWOtpZlH9msh-2TYN zwr#r4f9{SqPuH21^_w5}AcD7HxJsi$pMWZlIIZzVRn8I8s8MxRud1Ko6Z2siG~y%# z6_Be#5}(BWo3$kxN6l}Z(Yn~h$Dst10>L_rGS7KIZ;vNNYV^+uRRZE+h8_kbL>R!4 ze?ImcZNJZVL-p6YZa`E2sVSHng&$UYJDj~l5Nh8L#PQGv7<+@gUB%)OZBZf}GAeb~?6 zUIY6(ylc@Z&E1XHnU-ALlyS|8UU-op=R+vGXB7d$P4p0gVDnB2*6Q!PB4eD_xjW&=tA2LOYtbH~{pKo2 zH5;H-WAj1$2RZn9$d2|k0h1dXg`F+$$4_u2S#Ss}$p2L;Czwc!{6D2~LY*`pjI#7U I88g`b0P;e^*#H0l diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index 1016a7eb7b6..57cee262a04 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -87,32 +87,32 @@ "_workbookContentId3": "[variables('workbookContentId3')]", "_workbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId3'),'-', variables('workbookVersion3'))))]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.5", + "analyticRuleVersion1": "1.0.6", "_analyticRulecontentId1": "e9e4e466-3970-4165-bc8d-7721c6ef34a6", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e9e4e466-3970-4165-bc8d-7721c6ef34a6')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e9e4e466-3970-4165-bc8d-7721c6ef34a6')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e9e4e466-3970-4165-bc8d-7721c6ef34a6','-', '1.0.5')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e9e4e466-3970-4165-bc8d-7721c6ef34a6','-', '1.0.6')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.5", + "analyticRuleVersion2": "1.0.6", "_analyticRulecontentId2": "599fdc92-eb6d-4b54-8d79-2a3f740a846a", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '599fdc92-eb6d-4b54-8d79-2a3f740a846a')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('599fdc92-eb6d-4b54-8d79-2a3f740a846a')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','599fdc92-eb6d-4b54-8d79-2a3f740a846a','-', '1.0.5')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','599fdc92-eb6d-4b54-8d79-2a3f740a846a','-', '1.0.6')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.5", - "_analyticRulecontentId3": "93e40501-f737-4281-9df9-505aa773d983", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '93e40501-f737-4281-9df9-505aa773d983')]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('93e40501-f737-4281-9df9-505aa773d983')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','93e40501-f737-4281-9df9-505aa773d983','-', '1.0.5')))]" + "analyticRuleVersion3": "1.0.6", + "_analyticRulecontentId3": "ec07fcd3-724f-426d-9f53-041801ca5f6c", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.6')))]" }, "analyticRuleObject4": { "analyticRuleVersion4": "1.0.5", - "_analyticRulecontentId4": "ec07fcd3-724f-426d-9f53-041801ca5f6c", - "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ec07fcd3-724f-426d-9f53-041801ca5f6c')]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ec07fcd3-724f-426d-9f53-041801ca5f6c')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ec07fcd3-724f-426d-9f53-041801ca5f6c','-', '1.0.5')))]" + "_analyticRulecontentId4": "b3c4b8f4-c12c-471e-9999-023c05852276", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b3c4b8f4-c12c-471e-9999-023c05852276')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b3c4b8f4-c12c-471e-9999-023c05852276')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b3c4b8f4-c12c-471e-9999-023c05852276','-', '1.0.5')))]" }, "analyticRuleObject5": { "analyticRuleVersion5": "1.0.5", From 21a786bd6b59abd3dafba8f8cf2d2d933358b0a6 Mon Sep 17 00:00:00 2001 From: ashwin Date: Thu, 10 Oct 2024 21:02:02 -0700 Subject: [PATCH 09/11] remove duplicated line --- .../Analytic Rules/Illumio_VEN_Deactivated_Query.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml index f56afebd3f7..8f18e9e10cb 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Deactivated_Query.yaml @@ -20,7 +20,6 @@ query: | Illumio_Auditable_Events_CL | where event_type has 'agent.deactivate' | mv-expand resource_changes - | mv-expand resource_changes | extend hostname = resource_changes['resource']['workload']['hostname'], workload_href = resource_changes['resource']['workload']['href'], workload_labels = resource_changes['resource']['workload']['labels'] From c409aea822fb57177ad92b0ed569ff9d4f7a66ad Mon Sep 17 00:00:00 2001 From: ashwin Date: Thu, 10 Oct 2024 21:14:03 -0700 Subject: [PATCH 10/11] update package --- Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18929 -> 18925 bytes .../IllumioSaaS/Package/mainTemplate.json | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index fb0b3bc601e87b31ce6a309d11bbe83d34a5c010..0d8d477fb25a9baf8e0803a10c543cc5cc425d07 100644 GIT binary patch delta 1169 zcmV;C1aABBlL76M0S!<~0|XQR000O8p{Yu-4V?%Lp{Yt)rUiU?gg^iQ*t53?Ydn9` zHy#tZ^zvy=b>U=P=3-s-E@`9k%2r<4$}3xWWvi>CGYzUs4mNdL%Vx*p#K)Gxpz>Sa zv)?+uxdHS3LHyRe&HUC1v^Vuzue9O07r%A6jV6a$`K_1qQ~9kczx9TG>yj#A8-D9j zZh$qs*SaAjAbKl%uU7=Q1@-skd#`^FmUyoZD)03cz1Ju62ubnHd#>|b#~U7e-Ja_M zt=2xMJlB%vnoG%=erw+P$@r`zhEJ`O+gA8%%S6zw;kD&ImGic8-d4`r%6VHkZ!--l z=k2D>+jQlA9M^4${wv4rJv(mmwmn$458}8z*vxUOKzmci?Mn9ky*O^m?X!P4)XH(Y zq@T)hTRCnwbljFy3EOboF5L&O;k4DEpMW@6*=f5X$StV8dv@9iZ{j*W+jTvxI#=Yi z%(Xec;R1zTp7quIms9&Yv-!w#qe~LLR94RbOxOFr$5W~)f13ULQxu1RKl%Ax5R)H% z+UI{6A3S13#0X)}7#eY4#Fu{r>^;v5Zt$8y_Ue@3`mkB|Jp6*?Lfiq&?B{bIfd9Y$ z^M8$xbRsepjGrt6gX5l`C(3l<#+UOE)uTt~G-dxag;Q%k4hh+xf}KRdeL>b}Un0u> zM?z7?aYT)&bH4L4|6V& z5UWuTT*<|qv^aBvw_JbcV8Q75oKUa2m>8hI8)AjNF-0m`qhKB@oT8L6|JF})24phV zPGGCRC;XT4)PepBCmNrv6Ke^M15rwuylF+(oFmaqmB;;`P zlF5bgO)v=(fy6%=(e>nf$GCBw_!6M^d$UjQ=OsZkpZxuEsl|U@Z%F7iA^H|dQ+%-r zzSQ(y+2oe3I;DxdqG>I|Q=8HYP3SdD=Y=No`lj+-X1$^g2j4F4V0Qw^?R@m^W$wrf z_T2>LVEGx9nD(p#wy=}dGo~Xqe33jltvuk-*jE`4;vwb225p(AM2tkJ-Bkv0!`rNf zzi9n5P;YO5di#HIQSWSkdS`9a7kfnR;Su)5<5GiF>^54DKHk;dDc;^IACEQO)gBAj z-c@;zHQv?k+}d8k?qiL2wd}v`g?K&Icvp)V*`9ZVk9VoNZ|sIq{DJN7U$O`!^l)^| zX3uPOGFGr~l;kX)#Mn!|Nrz)QHo%+&p~AXy0*rhro()Luh(is-G~SUI*PtAsl8zqkuJzENc z%By|PUhVwW2aNv*@oM)r^J**5-qfqT(st-xyxQfqp&V-E)n3w1<<+jd+8cVcOR9uz zc(qG83D)p!>xPhk=&kJAUJ>LL)Zc%X@7q3D;@du`eA`>}ZJ*2|B*i!H*UobtZ+P%^ z`?U|WTKk~#YfFA@E+uPvwR!6&7KDAPATj8%Q6JNWA*OvcO&fCg)TRCql=WXS@ z%`~W-x0^a|)0O*iT(>3quN=4c?6}R__F&yUh~xHPGsmq0?M)rGE7|+^;<$e;x6k5G zE644Uek#Xp<+$C@aa&R)Y{PN8bRWEi(^iLm0^(q0r|pU$x1jp&*=Z}hiR<`m*Y&XK zT#?r@*XI0&3lw^J)>rdiPVMi^<|EIIE=l-OSv>U(QEVj~=1Zl>OHfPObeoBxHXIb`lBq1zDqg zi75LY2}K#l5jCdH`OeS$i$OpAv~T^K!RwSdmZsJ%j7EWwb!9cC(SCo#5fG?HSAKBg zyHNyNV(5bYWw1Z72LpMfi78c+-pB6IPH z42!=D2R*vzyowD=_%i5oS!0-0=3$H26LUv@o){+`V>Gv~NGzelnFHMwM(T5sxTaM% zM5RALtVTg_B^P(n;>>^j-g2FT1*7M4LcQu@Vt@i~h!y(A6sc&9f_bcPic-q_TR+Vi zkjY#-fvp0c@L$SP3l^9KN6xtF=LhGi%#Bm;x zki*eSCKt*#!6Zlo68~sK*OT)d~2y}f?{>g~rxy|V%8owZS4>=C(#C)yW}OAS`B+h{%dcvpMHczbVvJl1$u zdrDw?7wJ9LcvriTYkTRuk2T)aas#&);`LbLT`gv0d)^T~-lguou^UG52e!X|$s&-@ z!_hUHJ+sxxSi!JfgK~tD zYv4h@6&tVv;a;*G^^k?rs2ETI#h%@Y&5@ZK`sC-FTrz7W`h(G`U_LH$mHU?Ko00000j+### diff --git a/Solutions/IllumioSaaS/Package/mainTemplate.json b/Solutions/IllumioSaaS/Package/mainTemplate.json index 57cee262a04..0417e823f1a 100644 --- a/Solutions/IllumioSaaS/Package/mainTemplate.json +++ b/Solutions/IllumioSaaS/Package/mainTemplate.json @@ -1231,7 +1231,7 @@ "description": "Create Microsoft Sentinel Incident When Ven Goes Into Deactivated state", "displayName": "Illumio VEN Deactivated Detection Rule", "enabled": false, - "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.deactivate'\n| mv-expand resource_changes\n| mv-expand resource_changes\n| extend hostname = resource_changes['resource']['workload']['hostname'],\n workload_href = resource_changes['resource']['workload']['href'],\n workload_labels = resource_changes['resource']['workload']['labels']\n| extend ipaddress = action.src_ip, \n ven_href = created_by.ven.href\n| project-away resource_changes, action, version \n", + "query": "Illumio_Auditable_Events_CL\n| where event_type has 'agent.deactivate'\n| mv-expand resource_changes\n| extend hostname = resource_changes['resource']['workload']['hostname'],\n workload_href = resource_changes['resource']['workload']['href'],\n workload_labels = resource_changes['resource']['workload']['labels']\n| extend ipaddress = action.src_ip, \n ven_href = created_by.ven.href\n| project-away resource_changes, action, version \n", "queryFrequency": "PT60M", "queryPeriod": "PT60M", "severity": "High", From 3c609bcca3498b165cc83dc9280376a8243ba5ea Mon Sep 17 00:00:00 2001 From: ashwin Date: Thu, 10 Oct 2024 21:43:17 -0700 Subject: [PATCH 11/11] minor changes to query --- ...EN_Enforcement_Change_Detection_Query.yaml | 2 +- Solutions/IllumioSaaS/Package/3.2.0.zip | Bin 18925 -> 18925 bytes .../IllumioSaaS/Package/mainTemplate.json | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml index 56d950252ea..9b0bf4427c0 100644 --- a/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml +++ b/Solutions/IllumioSaaS/Analytic Rules/Illumio_VEN_Enforcement_Change_Detection_Query.yaml @@ -18,7 +18,7 @@ relevantTechniques: - T1562 query: | let enf_state = dynamic(["full", "selective"]); - let visibility_state = dynamic(["visibility", "idle"]); + let visibility_state = dynamic(["visibility_only", "idle"]); Illumio_Auditable_Events_CL | extend temp_resource_changes = parse_json(resource_changes)[0] | where event_type == 'workloads.update' diff --git a/Solutions/IllumioSaaS/Package/3.2.0.zip b/Solutions/IllumioSaaS/Package/3.2.0.zip index 0d8d477fb25a9baf8e0803a10c543cc5cc425d07..2ea39e721188a156984c10ae9ca6465d37d0357f 100644 GIT binary patch delta 1990 zcmV;%2RZodlL76M0Sr(}0|XQR000O8@T;*5o(K)_t4di26<%6|KmY*Uv$qH|Ie%>~ ze}REutlOBPWhk5UBHh4B)ijk`6gNBl$8PT0C;g0&!V2b{G?WsUY z^50xR3`{JVBgFMLPm2u<}t#NO;ai!j8vQHy9$9kpz7)S|F*b7vhH(Y(ha zmz6Q8j$ZEh=q0}mhmGii9KEzRJ9<%|z3I`*N?Y@LIeIDQ65&v*qn9Q9RDVY=)zQm_ zM=vE+!lp+rD|n&SIC{|yB7Lb~<)fDsL2f|-e)&f)oh3&vo$Baii$^c-$79f~)p?7a z|3qTT*L~j7(Q5Ecb>3q98sK9C_=p{smz57t@akRBHj%Y^kG0o@+S9oBVZdb{ro_Ig zWiR{4yXB=L3Mte+U+b(UzJJs%&XR);{9QDvU2rdc{!C#7P|%v)vgF~3##wSchz>6xN5tVt9Fa7+816>IcgVhA8*+Gx*fG$t>*52 z1 zR!&CtQ#lz6Zod3t@t{7&eCL&~@v(f3c~caOu?O)rb~p1iD$w54*SL~-dN01la@zt9 zwemGC>8J8FR=&m!eT^km!Zv)3OZIMScp7!cCm^~jdm2{+xqk)4_vL#UdrLfxy~@+L zMNi{Pf?Kj{>LmEqy^MLz;|+UXx0kV})!Dso+{>5^2bCmct&mW;{Znx{ItfnScueTh z8>l(eg_Cuei*?ltrH#rfTX|(GuWaR&t?rY~G^j2)*wk$;n;nl6A6p88%5Qzoe(U_^ z2F&{h@mu#c^M6|_(B9N{Pf;8O{^aL(K}>%5X`laP zeDH`B5hH{>V`#*I5nmFp_dGAS!D|ZHt5b&S!)D#{@C%j;aR)H7pU-^&{{Q~Z|200+ ziO5tiezFVU(QEVj~=1Zl>OHfPJgZaI3#3$3U(3+_XSy_eTgXh9|=Vn z#}PHA&iT&I{EI<9{j_iWoWbjqI+mu^EsREikacA>rqO=H5fG?HSAKBgyHNyNV(5bY zWw1Z72LpMfi78c+-pB6IPH42wVi20gmy zynl)fOZYPAgIHsjRpw!f*h_Lpf1Vg89b+`NuShJR!g~rxy|V%8owZS4>=C(#m)IANOAS`B+h{%dcvpL@czdsWJl1$udn{mkSLHp{ zcvrh~YkLX1k2T)avj4Uh;`LbLU4JcRWP9EbKHjD7zOfrd@dviQf5{?{(8JL+n?1AD z$ymX{QIfNG5@RpJfgK~tDYv4h@6&tVv z;a;*G^^k?rs2ETI#h%@Y&5@ZK5a$=e13`Jgu zs^5nAH=ljd7!mj&ySIIEvnD8O3_LDDN^T$Fu5vXv@gccVh5FD{V7QOIG?=36UV9*r zQau?yzJ-`)5%z{+LTs#(u-={&T7S&E{uI$?nVdY{vYvEP&r+$L9c?{-4SRapP)`R_ z9UfGN2i4($4%jzyc#zQ?k9mS{WYcVl2P4&LWJ*eOXPKY!J!OLgk9 z;i*eWm9Xil%L)#tHBMc0gGe7KSozdtMUY!ifM5QpOJ~WcOQ$+@+2X0o`|%ibYjxD3 z=Rc9t@^v4zbhH}0QysM!zXtfu0KQ+xei(4shbghI zYT0`}@@{$Qh(e08&(}JuiGMG(i?igQ1AiBdY8Tv#pFdMr0TeVSf?+R`t^|lRsa+KO z{lzH%&qKz|J5LMi$`xiel|3ben^%M9uU0)^>$K>KR~e|s@a*KlVBx@VwC0AP(7 z-hhIs`SS?FNsd1l%+d5HhXQ{G{ZbtXR7V2Uk-*b964+us!MEVZm48>;hYyu6)qCZz zy=RAQ-i`-L_CXxBoy{D!3bZ$M*sf&T-;2Yx+@6X=0##D5nY#Q+wsR}{!o@zFMHD)bH?N=@yCEpyq)vYSpSCu8MgR067; zjFpp-{ZvlIf}1bDSUjkYG2eORYkVwUW8M@6W9&hEjorU=P=3-s-E@`9k%2r<4$}3xWWvi>CGYzUs4mNdL%Vx*p#K)Gxpz>Sav)?+u zxdHS3LHyRe&42vX3bZ%%Td%a?xfj26xs4`=TKTP)^i%n*E5G%Ie(RDdVH|b#~U7e-Ja_Mt=2xM zJlB%vnoG%=erw+P$@r`zhEJ`O+gA8%%S6zw;kD&Im4EZLa^6^;v5Zt$8y_Ue@3`mkB|Jp6*?Lfiq&?B{bIfd9Y$^M8$x zbRsepjGrt6gX5l`C(3l<#+UOE)uTt~G-dxag@03PKMo1mpMsr4!hJ#3XkQ}A{zpPl z#&JZAsdK*bGyh`HPe1KjKWFedrH-Ykbqk|WAY@%xjcK$WaRdbF(Ul+E_-+)zmKeIA ze;Mpg?7=`@v0R^$1gYjmhCsJ&%!)*v7HQc?&@5t=UvmHji3SvdgveZcBE#Y@zd?^K zI)ATX!xFv>`XJUAW|eu^BKC;f(Vr*ANyiw??JE*X=y2vhcZHGqTqLe()eTYUPY|n7 z5M0T{owPV}gSTAgV8Q75oKUa2m>8hI8)AjNF-0m`qhKB@oT8L6|JF})24phVPGGCR zC;XT4)PepBCmVY)=J3qP8i4ldiM3T_DX)tk|MI|Q=8HYP3SdD=Y=No`lj+-X1$^g2j4F4V0Qw^?R@m^W$wrf_J7?3 z=3x05m6-Od1Gcb})-$FfH++#iI;}k5(b!iR5aJ=_!Uk=br$mfIsNGctal_lJhrek3 zG*EAEfO`9JQSWSkdS`9a7kfnR;Su)5<5GiF>^54DKHk;dDc;^IACEQO)gBAj-c@;z zHQv?k+}d8k?qiL2wd}v`g?K&Icz;)m8QGq9gpYTryKn4