From b6dd8f3988a981ca8129e051932d11ec5867cab3 Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Wed, 30 Aug 2023 15:04:36 +0530 Subject: [PATCH 1/5] Repackaging - Forcepoint NGFW (MMA to AMA Migration) --- .../Data Connectors/FORCEPOINT_NGFW.json | 2 +- .../template_FORCEPOINT_NGFWAMA.json | 152 +++++ .../Data/Solution_ForcepointNGFW.json | 7 +- Solutions/Forcepoint NGFW/Package/3.0.0.zip | Bin 0 -> 19824 bytes .../Package/createUiDefinition.json | 49 +- .../Forcepoint NGFW/Package/mainTemplate.json | 575 +++++++++++++++--- Solutions/Forcepoint NGFW/ReleaseNotes.md | 5 + .../WorkbookMetadata/WorkbooksMetadata.json | 3 +- 8 files changed, 708 insertions(+), 85 deletions(-) create mode 100644 Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json create mode 100644 Solutions/Forcepoint NGFW/Package/3.0.0.zip create mode 100644 Solutions/Forcepoint NGFW/ReleaseNotes.md diff --git a/Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json b/Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json index 01d424f40fc..9d146cb3c7a 100644 --- a/Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json +++ b/Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json @@ -1,6 +1,6 @@ { "id": "ForcepointNgfw", - "title": "Forcepoint NGFW", + "title": "[Deprecated] Forcepoint NGFW via Legacy Agent", "publisher": "Forcepoint", "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", "graphQueries": [ diff --git a/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json b/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json new file mode 100644 index 00000000000..8552cdb7d56 --- /dev/null +++ b/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json @@ -0,0 +1,152 @@ +{ + "id": "ForcepointNgfwAma", + "title": "[Recommended] Forcepoint NGFW via AMA", + "publisher": "Forcepoint", + "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "Forcepoint NGFW log results", + "legend": "CommonSecurityLog", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Show all terminated actions from the Forcepoint NGFW", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" + }, + { + "description": "Show all Forcepoint NGFW with suspected compromise behaviour", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" + }, + { + "description": "Show chart grouping all Forcepoint NGFW events by Activity type", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (ForcePointNGFW)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "instructions": [ + ] + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address.", + "instructions": [ + ] + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + + + { + "title": "2. Secure your machine ", + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)" + }, + { + "title": "3. Forcepoint integration installation guide ", + "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)" + } + ], + "metadata":{ + "id": "e002d400-e0b0-4673-959a-eec31378d17c", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "community" + }, + "author": { + "name": "Forcepoint" + }, + "support": { + "name": "Forcepoint", + "link": "https://support.forcepoint.com/", + "tier": "developer" + } + } +} diff --git a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json index 8da9f276182..8176cbbeb84 100644 --- a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json +++ b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json @@ -2,16 +2,17 @@ "Name": "Forcepoint NGFW", "Author": "Forcepoint", "Logo": "", - "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/)\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n- [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)", + "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\r\n1. **Forcepoint NGFW via AMA** -This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Forcepoint NGFW via Legacy Agent** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends Installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31.2024,** and thus should only be installed where AMA is not supported.Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ - "Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json" + "Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json", + "Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json" ], "Workbooks": [ "Solutions/Forcepoint NGFW/Workbooks/ForcepointNGFW.json", "Solutions/Forcepoint NGFW/Workbooks/ForcepointNGFWAdvanced.json" ], "BasePath": "C:\\Sentinel-Repos\\19.05.22\\Azure-Sentinel", - "Version": "2.0.1", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Forcepoint NGFW/Package/3.0.0.zip b/Solutions/Forcepoint NGFW/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..4c1e39d7546f0e5a056ea1e416d1db43df5a36b2 GIT binary patch literal 19824 zcmV)ZK&!t{O9KQH000080OWHXSMQ%zswN2l0H+@S02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH-C65y8@Uz!U!d@YYAj;EOscT#L-FOA?%{P69mSjkj6sng&hS5E$z z1b??W{ncRN?^^RTQo_((7cw;3>Xi%To_C8wNqi@a1tTKvTvl#p-0(y=5P{+&EnzX# z=}N}U0+ytGCx7B5!s3c6D<<{Ml3N+tHZc|>VM8M`SKj<5nZ(SR@WrA=$M8)MOSjIK zxfKRCIzouB@tPDrrdtdDZ_AXuw*hWTfjSK$p`|JZg*Fwf? zSAT!ANEhjN{6;%*G9I(qY}c^0VO^@xie(kqW~-V6UYS8=M+7Qf@YzU{#;< zm}N#sdFW9n574Sh$)xnTP=90B#~R62WfSowRZ(m2~&TaeoUBoxDS& zW8a8Sn+P{9@BK{^9OX-eomFmtv0>OZLKT>8;7lyyj_hqqXdlg)T2 zV8<#!q{sw?AubAl**vDC#?A#dX#rOOQ*-GjPqS+Z>INo7yn>|8`xF`;mpY_prIyoB ztfoBSBZ8+fBl%eZ{NW|l<$&ju;CWfWGad&8w8#6PJr^+#?+XzLWA?Q`R>j3#Lhf-c zQ~Y;VuPDXu)cD&XKNXIsS3Pk`uW677Doq=$5V+QhvO@;8StHt!bgOvKl!_yPq8p+x z``{jr=XuP2i&}hm{JRMxrPzeSBXHI_R|wox`3znrQ=HoP#7=^NbE+M)c}A&9M8OXp znG0+Y8zO;b7BwApAY8*A5aKERL23e?mPf=0*Tb{%0O5PwS~{ML;G>x6X`U! z+a3t7n`l@=%7t_(|kO%Ayc|=wH{pP zIXPvE?G0*gWfTeDHvUycbPpY+2EGz2QMIyr zM6V2bW^|tQ<17tR3eStde{MRI0{I^(d2M+Gw4G7544?bmy@hDjU0osS65xn z#NguA{zlvn_ZYT=6Bo&7a?px~rv}iUc_ydj$n*mF`EYvp$LZnG0R-M<-CCqwR@^+% zfG<&;FzKBdot>fw?@%kg6pF}qdqbwMveqgprol^ZAI909tGB!$!i^El2pg#sQ)G8v zdg{|HkFd{l35%+Ns%m>S^?@UzAGw0by#W)R4GV`H7U3~G=mx;SD7Yi?2`lMF?8P@! zkZDG-L#NNd(Ug0z{Aj|ewVnPq0>Mx^k$66sfUOvoUUcwrQDD9poGb;OLjDM=skM%W^a64f%-2f1-HE;IxDJXuapowx}$RV zdN3(FtD=qDYFcS-{A9oC559c$ny4{9?i&aLHebOf_q`-cSn<+AO~3EO{J>W<Q*E_np@97jqdoP!)G2J6 zuaNIjgt@`UOAWl|2ps+Rv16pKli~l1EvFFu_V`QNk}lb`(au7>4!snTVDXR@xx3es zdM+^Fp!L{F4+T$~iiz{I;=IlHp}WupyZNZw-A{J_y{@`j)BD?KWX?;9Zso)biK+>2 zshX{qwZoAk?rGr%83wxUxl^6C`{Pa_>Sq7l5Tl`um)qUoHTDEwn! z%>6q>(GeE;oKSUMS!d`0KozZykJRUFV1H2E%FAV(iLjLmvwae)p zldEa@q&cND?nC@}q5Uj4kDiX?C8aZ+_72p5vy${|30WgYCCl3&%^f8*1}Eu^LhU8 zjAHs3{ejJ+J8B%F`py2cd&us#&y#*>58=MYrpE-z#R3U67SttG{|5rKZP~^7c8h1t zvu4}1p6)$C{qEj6gLXfrgl&bPR{@j@uH5?P`&aYPv=YTH^{|JAD9gJ8bn~PzZ9S|F zt`R@h4gbeE8t4sw#wJ>0|XQR000O8u5un%`s>WnOhW(w=O_XI5dZ)HZDDC{RAp^&Y+-a| zE^2dcZtZ>fcigy<@bCNH{tt+fjijV+wJv+)jV$@l8_Cv68qfRI(o@(Zy2ZGg>>=5b zl^O5f{#D^1K@z_yV1h`i0>mB7?u%W4}QlN@XDA3H?D_8-@2Yj$FA)JyflM1!nS<; zeC`e>0YD{zXqog~k3^Nohj(v(UBQaqcw=M3GoV4}i_+ZCHI0DxO}v7a!Tp$G6Mo>? z&Oo+~{k5HA>I{M#_}Y$MTeNRXhQTLeIAQfZd(?L)(2;kZI~lL7H)JbUDy-Dl1uWn6 z?6K(6$_F$02wBzHHqc|&ZUSk$v`p~=4I zj#%;IeG*n!k^TP0|M({7DGjn5ev^o-jIPf>anRt}>KPp{+HeUcQQ}K-k#pmddY$+b zsRC&S$0s`ruZPsczgBAz)vT?`@2l(USH)wG4LN6I+0<5Q$iK?=hyxvEOmOTD$i8C? z?*rTPVJ@jh$%$=xuJ85(at<71J9LQC>(gK|&K*k6b-%Rh2zt6HR2h*Bz zt?kh}V>l#h$g1nbd{z!2A0!%(T;&i7$Jlw0F_L}j)^JQm+$McUcDbS zU3UikyL8hW^5<|IYpcL@^bv@<|1ZlL8+c5EZU> zz*SvABRN&n1~ZCfHZDN`@lglo<4g#-BWulz{#*@(K;z?BP^d9Hf*OOHz;A|<%U`V# zRqll!K=9Rw0_B{V6Avaa1QF{Mf>8#QHFzdX^%yEbO&(69L2^E(CX#bo)ejk?tF1P3 z2De%(s$I9t`f3g6`nL(?Qe&+g0@kxeA^3}Rz8zz*I5c5toqDb{F+-9P{SAySG}aN7 zQEHnl?D=YK)iPJvAA}F!oDV?2$gIw)9;$ueP)ZG)x0f}&a_|WRMeNu~^V&Yxvl^c6 zWb<^Vn5T={$*EP$*4gb#5YLgVJGpF~kD5H3B-y(2RN1;yf~`AM**Z4bC(72Hl5Cws zkThDdMV>4XNst6zf{Bu}tHMfBCh8d{#w}PpLFMVDS9N`V6s2?5%cD+h&ttr)N9*T; z(Z>hRdJ~DK6sAYHA}UOGYg7JLjV@|sU%35B{vFF~}7PQqA=#re_ON0Vc zV{9wy=}xP&!QHI&u}5!hdZ!c>&WdasDy4}O3MDbW=gMa-E7c=!ms-)HW9nG`M<+rH zd;j=Gs-#21{9+7f(n?jSLGj*QMI(bLf{q2Y>Jbq`j(J)VJ`sXwC#J+ZxwC_t$R~Zv z=aa;oBMj=uupK!`@dnA_J@a8hX39gKNl}rSx=H|vd)B|jKZf8m-!wcXpWov@Rgy1K z0Qu^p*no|hc1j0Q?AfljHni*+R+&Lg#MfLJ*weCb2;htDFk#KymA3iIk)})*Q-lRV z!v94qsP*Nbq@D8DsXjMt7g@c)4u*W<4=G?8MntWvWT1!K+6FnM1H-&0`vV%qj1s`c zlitwwZ)iq@DN$PC{1e0bV!3w=+ZQ)9)&5$R=XYI^4e-;w^U1wC!N`O$3EUABHsSR> zpySa6I!aDir&jf|NZc*gkV zeotLsWu!0E{=XeM)-t#<;aX;XWnw?QxR*jJ|3p9B*9$!G)$_1_fmH*tbJ_V3!d+S^Nq`~lL-0jq-a43CX? zE|LH>zy)ApDk&hXxfFuP8biaWbYQIKNnFDZ&_{VjO^Rs>4<<(er^=&F!v$zxvPVY7 z*ERf87zET>Pgdb=*uLZ9Vj;L^#nNopxIO(2N=1w$ta5};lZ(ko&N+_jCCl{JAdTeHusackH^VKHTy z*{GodBbeZfw=*Vc#r99dlH~>I8$+M!%IO8{${4kqkE@`JB>^iXS9YgjJ(EWhnH0#^ zAF_VwMN~F@#=C!L`>-&+zW~D>!F!k$g{JBqG7V7*5(6mCqrXkSq_;9GPzhf2SHPAA zW$56}t?ZlbxI%H+qth}o64o)$LJhnL%>fMs84^mBwCIqAMYBt437vh&1V3-WX!@Z0 zsP!|wpNU3P%7C>L2THyG)K~%zPs)ms4*7gedDflfniF)+@C6k>8B)V@U~vS+jh;IR z6c7mcYEAlqpr+r5!YSzfVU8gFZ(S^}n&|R@-oQs(4cG5rtq)7jKf66Nvg(nGz_#i@ z^L1!reJaW>MCJn!HD4~wK!N%XT8W(@6)~&Qo3MVI2Xs7@zD?MtK)?aoqbQP0<|e^q zHp{`Zoyk|iCKgG@bcdL(h;9XsaNSDYpwWt^?8pen+QFN*>*W02$93$8`ab$c8C;-{ zJHxXO>WFCF3Jp}KugC{C0DTMP034&=aP^N}^jNl~4{Hzj(WAr%3Ivw09affSQ^N1N zVhR96f+j9NAwKyO5&DeUjW!I0p$Ayg1pWolZU_vH4D$xYm`9JAWkUfpjw6kKh9L*D zZVjKI1sLk=|J46yO4j8CV(kgbuQD}LpnNVRzI68^^OUw}%;w3&y zX|4+A4}`Jp2QVk1i(vI3&v^HQdFWKW37H8hu|{rZ(GM za&d4fc(C0dC&m}xC*EU&aXf)FJte32!Hw&LLzP3B_=pA^L*GT$BXhcefPf*qAY)#q zEd6GuOnNPV`VEsXJa zc%Npu7iESJF5y;iipkx82BiLxn6!T_nxI}|d{3k~;u&|10ibl!L!Yt;Co!vpi5&iK zT{1&+1PdqXHDifIeiORcOt$dXzp@SpDowTjd+Qtdz5T5a$$4^&KjAv}z#ZSC)BBhq zJil6|ErCzQQV*ZZdfB9)3REG)gevD2fRti97^H_XyR(c2St<%mU|6rG>3gk!O*TcbzY#PhLw(!*yw?#;0-mu5W63tkgq?4nQSOs zjvItMs}WBl+@c{%Y_O&n0$(gtCx&r**2*k8G1t^Bs}A!Gt}1GJF#Mkt#Awj9xRg7Lv#H28Lt*n$wN zWTKIxLMWqHx(&iB#AVH*&~xFkxE}i5LfrwD5tol{pDz!UIM!JB$>DE0;D$m?Fd(Zx zm|(PhXggmp1%Se9Cb2&ssc_%1LJFq(o;eomf;+UrJzS+Qw%JfSsB|no7~ZovL`C$w z=wd~9f(mW5I###Us?%1lRqt+XZ`5};ca1uw=0Tn^^-~xsCFJ+R2QsSV5V4 z6U*|+EX{rCdD1-u7;dbqNPE%7>*AQ5k~dSa5q~m9gRW{T+4O`oi-p51Io?2{A691c znM;w}iEPnZAbe2hRftXVGW9C)B8i(6B4$Y%3#mLc-U`X3VU;;$+=<%p-6WWgi{aZf ze>}9~Nxq4_KrD5>8P7geI$4;Z2EAr!eQYF;o~0U3>npXDDkC3}gxQHY zSK6xhF{54~{it;Wcb>C_b=F3CwdB-%ECKvn#KtRDJbE{EO08@$zUw2i=gHEk0cetg zs{yDgmt@t%c@QDj%~uOo(7sPv>t=8N$Oom}a4~HHd-hI^?@!gwE*c6|du7&9>*`f` zfeJ6Dx~r?~m@d()=zP^21CXJLi&Sut>YZKXhN?7EcFjqIl%lp6XO`b0GmCtUGnN8# zYKfAw6((ESn6e95TVLj~b*0>vmE~5Ir@mFCV2euH4KTx&lxka19(4;!d|i;BX(Kbi zJdLhd63V~-MDjc|n@X4^Ct*C>QB|BEo|hQ@h&XnfY5WvbSL5Z@q}mQ~p+qQd=yv{_rU> z=hG7!@7^4@QcSglqGXnNmF)7utrEpsB#O31qlmjt3siA_@TBY6mCh-&)^)kApBrk4|D;sLfp=0i@|bh!9vm~7rwQi zWDcd4its6&J6Sq!viz2Ta$5!R5-Uq4RnEFK;CtB;keyChDV0*6byh-0r>An3)c)#g zx@VZeKmXMI%4l1r=>K>r`X$tg-Y_YnPD-hg5~=rDnxUjtm?G8wJ4&(F>w?mHpptAa zl{#NpELEIwc{DqfsJFhhLae4Hb0JMozQ)X4zLBW{y! zer7U6xdGq%5x1R0mQzZxCp>D;?}*!uKBc@u{!UnB204+H#}mSymW4wAPw9x;G*yN5 zqCBB9iY6KcrZN(R_D}XRfRxG;3QI5Zg`Rl6P&iZH$5dc+x6b{1D51pTU}j`8c9}LbjFC=W}0g*Vb{1Ew6kpwv@ zjq=H!j9F3~Lm-){jtdmf3zpCil|(6@Dif|c)}G>Nyw7^pr^w};LjtFKG%+81s!+%B zMBh?t#@y)SV$#qe@KdCtg_X-?28G2dWC$sBmM8ia9zwfJZ_^>ATAEu}?*WK4gN5>EU=ybf z6I~BmtB(Qgj6Hb8}8STBpYt=c$Pn+Zz22I`MTPq%-9lC3DfR6h)<*yPPj~H`PWETfbS2+ ztv$f#EoRHfFiT{h*6a0GA>z43%U&JE1HrwaVNt?}wS#FM=qY0s^J*aiR+B+x7FxlK zIXhqgHvp$BRgNd6F+Tw42g1At=yyCkIE!e*Qdv@3oUjr$c?`zwGZfXxflQot=pBQw z#)c$Z5ID}W$&jwI^p`+l_$a`(y(l!NX4Q^t#~w{aq}}Ljhp}*IkBL+!EGo*#(rSsv z$+=eI-!aT)49U9CiX!7K!ksl44{bb!fDPU70oN>r-!yP@0Lm#*!n|jM(rpl#LnbrF z#G)Y-Ge~`UnkFc~(+sRl(U+Ncg>6w5636bmN)l+F`QKbcFE=*fsHL{9;X-1_-LjG{~l zyZIePd#74?=|9XIiGJGY&tb3C{VOHXpye|&dY)Z+bT|+-ZGP%BY57!%#Vt<==T8>x zEl&tvo)Dg_GN*)PbGEZeJ3smf;Th@Nr26rpSxL&p$B2d{D;y`9+1m1iaD23YmnVc9 z%M-#Y^YQd2gjd~>FyqPKsg74Y89W7`syvca7qK($dpH?fuWhq;&EO1_N%ZcEr z3iI0{u-F{}70ymTf_UVk#utd@1>^al_TS`9ps57A9^(-6XFYq5vybMg{Om3dLNBvX zw%BpJ&<(K*^C!#WW!He86RYC?u zPe%XndB~kn%N)jYp1!B8PK!i-^{q_HElkTTOq>vk&5!8G zp-6m6nIuZ_2iT(Y18z;q7AX9gVk=V4_MyzJLm73n<@H^zytOF3)QG>R?8|@JTZXD` z6{v|XJ1vKV0Awa1j~QtS z=u#wiVCpnQ^YR=FJ%t%<;si874%*pm}a}tx?HJUuGqkrK79HN1(BxU z&vxxnG6DR8_sAuz_Mh3pNTk^DbO4@o7z_Ddu6zRs*iBX`K^1}T!v^nX9HJ!VtRVp`TpsRW8&!a2@_ixp);?knftWFQXR3x zYMAP{nm2Dx81);^1oet2<(O}`=7;jF&8@92Lpck|bhlo# zTK~%tx#)T6!uu=ufU!Wi7&@|85$TSo$5(Z1$YKq~%4xP}g=>-K{+I`qpj&mhE~$t6 zLz=yz+mrr94l-P{G`K|mcIjPe9sY^qL-bZ~#^$&XEzyEJ%aF!^*udp!suCkb`7Oo% zs2ThtRZgwwAW=Q!sTFc&v$xR7>1B({nU1PRtnB{ry9E6+z2DP&B3_~i>AtmxY)|{% z+tcfJ9;MFpn-O$wbba>jHDIgZ-ws|91^V8?7mY7TxasDQIgzMi0?@tld*F;w<6{qZ z7ks|r#UdYkepxZ;MMO0N!|0wD8P}~-hoQlL!C3lgizC7*& zA1&bLd)$X^G?v1=nM2|_ondoj|HENMM@_NGYh{|#>{Y%<*;o1oSw(frJW8&NI9pcG zu4IoCF*4|D6j)eGzk@%cPrBEd_+3#(_41gOsg7wW6u8L~T6FSudLL==sVuU3vS6y8 znxI+fx)t<NiE4OKSbE=(e5W-WY|rA7TnaF5(0R{u$#d$ zLea0wau$X|djO^nX1MX=D5#~Rn>ZFRBELaw=~aGp)gUK4Ay%ye%fA8UvG~+OHXt|D z7zQ^F7qsg^&W+vyM4pj?({ob=C(1Pe!k(m zoRL;R#|N(I4t-6Ze>o`ZGwt^*qr26wxBETpbGuXDg@5bR>~ywv+Z&s^t)2PwSt=?b zMU|$*=SPJdZkv|1+p{+7?H$^!cTKZj-`(nO*E{CM&eqmOw@Y_6=hNZ+iDd_xPVQe6 zcGB9}F*=*ZR=wA6(R#PDVb+Z;Yp1^5+TGaP?oisdcIVScSSAgqN8U40qUr4MdwplG zVh&lxbm{QXZY|$YekwZ_W9mrsT*lbgYHjp3w#;t5-{0M>cdb^dzGJqxLBd;Bi}u>a z4y6o0saC?iqaXXsa0a}t=y@0ZwEZ)&+v1YP<`A^Nb<#QB-ROkT2m}!i6Y>p5s4&@F z$#KOXY>4{F_q!SI+dCN_Hny^Abh{Z}qTVOJ>}+M#X>WJ3dJqO@(x0|k-K<*ePHQ)- z>z!^p6QmjnN`BjH?{u@iZEtUHiEkJ~V5edou)UaKy4hUjhD1W_sJz?l_1hiV?$@o| zO^}G)U0UyLbav~2<871D=o@id%|X9sUiKOTL!Sd}FcaafWa_~+&E_%9E?@#1KQ)nZXC z!#8DFd29`1DLk+yDh72>z`;vD@X)m%`?d;#3RX3&2_6HJT>V-6`Qimo!{y4AmYEF; z#JY{EF1bSc$Sg%)4}kOjzAC2o@mq}t{|{;3fT_9^DFGE|t~TfRnnJ;yj@j;Qx9aAO z0rpbcYJ(o?ZGh3#-Q3vhceghUYYGbHA>rpkyu2g^SASRN=fx1^_%{}F6){+xPy7j> zR9b~a!F2Y!8K5JkK^%mWWIp zO;#ClN2c{87gH?7DC9Mk@Dp~5!fYV1vQL`D*1Yl<7SAvWWKOF2Kx3T2pz^c~t>=zTBU?UYyUvkHk@IbTg6nxBkR&m-smPK- zBIf5-{AydcZh)_w32`rzG!~S?_^gR8CGLf%z1Fjx_z``z_RV@eF^RSO>wEH6?g{4; z{#1#F^=p`1B7rURnz7YolpVuKP&OX2ux0NG3+tWd`mGOV;kvoNc%x93^p0p z>B^n(MWn@kN0~i@o^zbw;kiPjvpiqEt(up^;4FgKhOe#)U}Sv7ZT08&z_I(bX*j{5 zJ+K2`%&z$S*5fB8h2J{g@TtIfiB$Exq|rC}Q||<$yN*=rpTZM-B`yR(eF#_6!Ucgl z)PUAy6Sn{6Hz0@$H)d3Dub3_m^|8|ILo1MR^}+ozRL$`1jnv32zfy%srDW}?GFYX9YjQW zJ{hrZ{KR>_cO_Acf6A(eOU?s#=z7{Ix?H)TMgW}`(i+NT0dic6GC*%_I=}BLzRkR!CfdLyr2M;Qv#I9Ui+x4jpNm~PnZiD{EaxUYUzlfWfy)PTEY*r_ z9IgFv_2AY|6v6%;d{JpPuX1AlcjZ8k9^A5~kn|uhp+>l7@oNY#VEcM1aY_ZtieE6p zEOyEb1%987a{cX=vy!LpB0HA4QxOQ|T5aT9js#W+B^jRhZTyi3x{R{LaoKof7Af$h*e{_V|I zAX?1FJgg}i>k$3A4kI1>sq89~$v5ya44u4@37~%MgddkzlMDIjby)=tog?FDIb-+X z8ROXtehyGWI669(7zl~(6pu;N6jXvBfPKu`J9&+f!O3V1U%b8#sE^T*?#|}+7O4?& z+mQ|9wXh@>l=s8L3j;lm(veLq;V1f;im-4%HKmKmj_@kt-%LfPG>)9kv1gca3tS0} zSCx@;s!oG~e7%=0|JEJ`B9-ewRp7w0t@uJNT=Gg=F1b36=8Qp5m&o0k)}w%qk0Xv+12!@J^90SQEd_E%4^s7ij3?e$n765xFs$4c(-xibP}YyXpylHaDloYzk;PV_ zRgqI5-k-$_QPi{5;h#}0t*<2iq8C+TpqM#Me7$xzeT+SrxIU8*^UO&w!T_x>z5Df;o2vXO%=sX#u|p;+9$|c{Af)*=yA%tOY|p7rD-;AK=(BK z0L9(l9!2TRq~8a=D>C$i6Pet1a%ytQHNupRf9cqjSc%F$klUkjCS!4$hB}t& zDH`Sjrz`3gJDEud(Kl^A178ru@>>L5dhXpZZs@>H;I#QL$MOR3DDJO}9t(U#81ieU z(qe0KDdQeO#&LjxG%k`uv~qGi3#rk2*Tl5MQDvQ@lfTiDVZ zftesmpyRuc!9Z9$$SxFsCxuVjk zjv+tgs8*~wIC`Ff@`yQ?G;&aPyGSLsN4vcgR8tBnb!ZVQ#rc_kO|o?OR?pQ-3AlI( zm~;@$Px3`>q_q7@N=Q7#07i4@jP^mO+`OIyK^T{P0)nT&0L!@b=)vu>(qgdn5Zi0; z0L7TK_(ps1;aWBHFnDGczJXGFxo2Kj0=775PxKp>sw_VObu(lxZl3n}F zGFX_*#Gh*)Xn-{Nf(wfp7DFsu+gA7rI|=546I`3FMK!Ong7SLe1m68MOiHpm|Dcp! zC!ha;LZ!q&nx6WrVfwdN@#dyijA0U3S5yfvjl?$bNiAU}qEG zw+$vznbiN{88E)^_dDu(1LgZ0pm2x(R=aU@ip>`2<+zsnQ_7v1zQIY9xsZ1_sj^u5 z9pg^LqTC=gWFIvoMgpS6)p~L}U4$ z&yW3c$}e!=QvwZ%cB8>?fcJZ9n>7+cMoRZ28xq<_Q8#gi3+R{&&*;NCn;(lE4Tpr| zNot%T%X!g?C6Yx`q&OuJ#Nbp+b^@5zdlzFNn(U_9th>l#^pNUa*?r_$LEYLz`C_Uo z&)L@yOO3MBC`*kpor+KwD4Y4~lg-c#Bkl}BZ@n{kJ{n}YXm-1^6jDne^-P2mAITXV z(62C>Rp#gUybhS)jegzX4C5+U6G&f|D_Eogvi!c(Ce|;Km3TqwyO* zC;@g8HzZPW2liAPw(UEx9v_W^d&$>Fr|am-Qa-#H8TL@j{aEA~CCiA)F?z}1xf zQFC|V#nH7reuGnh`#sp7&nfN$2wgdbEsvq~Ibl0YuRrSUWY*ms)Bh3~%z9qZ$|YXt4oxNv)NZsrhDU zw&UVGbPkB=B&3srXloYqBVcZSjYX&( z6=qSF;c4D11j*qkUsAjhj$yqPji;sp)3p^NA7LEw|0}Q%6}Wi{@h6SuOKZG%o$|Ua zHoT;nnt}1yj(~)9OysRKsslwaQDaS~2Zk27)3+@&7tYbM729FV`&VeIzIFo#q>$E7 z%|HuB` z@GNp_c);=dK>%9B55F85_ee6)S!NS7Za^`3v_Ise*EB}sAqxaD@ovN*h$goyH2FUt zFAl@@Y84yWtl0%P`l?3Q^?zfK zt{xqMRYjsJ+KKPon)+4>=6B{+wo_wy4g;u&>1<=y;n+r{Ny!61fbW)fzLo=I(&p(_n_TU9c6ILQg*8An~ z6#64+T2IAWY5DPhjdwCf9%~9U&N#n4EnwZKW&*silRxn}C_6sfKW!f1zgmb{gjpS8 zw_8ONCZ?%L_6sFnx0{xHY3!c71|#*34u|B6@8swy+t&i-}|s&)I-UYs)bNCT4{BsB`v&_)c8%ECNcIJ3TYrUd}TW(uE&GK5@}fJpF4$V@tsDm3aQQVXXS*My0ji2o`_w`rVCA`Q}euKNxt_ z&zP||?aenR9YREj!NB+bs=_GV320z7J-BCv*5h7-`W{6-Ilv!Z`FW zc3a&F^qB#py)`pFb~{yY`etbOV0eQV##1KZfHvj@Xm_XBEf}?Me$qTYI3XA4vkM4@ z>b<^^T*9?G8b6HAm3Bf$reWSB{UNhbZf9ly+pTum2aqjJU1#7PzK(&AX{#jeP?j%K zamb1h$g+E`({<(^BgD6hi)@CcoRC+f#kv^V_KR<$O3fw;>svJD?OO~NADy!G%7n+E zNZ)fu@xYYYpoq?isPrDsKePR70c70{Q@iW_6(J9#beH!K-2z!Y9!V(>@(R;$#dxh01y_-UJl0|Y1 zQMuF1GcB^~Jlf$Fco>qz$DFRb)s3?Hxk+Zm_Pb6^8?AigLz9$~Qadeu?6b?s7URot zGy{JOY(5*Dw8w^J*=!pGA#;g6x&8olgp6lOrSa`P|J|%GGw|8na&!_T!u_b zLRyAQr;1uGL#7n~FGHrzGGw|8nJz=7%aG}`P?jOnWyo|MEiFT)6@#0Lfw~NtE<>id zFqR?HWylm?E<>ivkm-{MnHC)Wl<3qG52K2Wn|0&PP*(!n0+fZq=qaB744x)8aT@qa z4i=xH7dm^ClM`*pEI8Lm^^bl{W)>|I0z;E ze$f&!V3KiNY*8$D;Q`sat)8hJmKdTvWx+!kpH0Ob=X2)XGJqIa1u?!&oU;)IZcd|7h>=u>%v(vqj!Of}8rF}vn&L1WS8UOel1`8GX ze*N*{97eu8r+s-&`|_OjZHc0b{aDx_y&IJ;ip!c71bT);nVO=tD-YJ z4$nU*HK`0JiD z81Os1*jros?-!qq`oH(<|9kZZ^ML&E`7ibBe>DF3clhg1f4daVn*3wEcJ&9;`7bPM z)cgDOw^z!a>+64CN6^5nH3H_S&FK-Bzz)0iENKiwAA&s}maV}W_OHhJ|B{1fX$tQJ zF3UIR5}Nq7~d3VZNMb6YLOJf#3w zS~*Uo~6e z?yfBT%=;_9bK^OwTczb6-8>5fBk$z0^%iT|C46m&95;D9af z)&+7vi@k@w4~0LK`Y<;1{{`s#xk1+}^@xdi8#uxVW?8deV#<8t_L-yo1^~a{AlEd= z4#gpf^#X<*xU7vt@8lpr?SmZ5g_s7&dYJ&Y{!Bd3MRre0RED9y%KqmCm>Y{UHgYIB zZEqIqF}>F1e}t+xL0gd$7VqP{R@7*@D>93q%&3CZ5y{3MKo2uLT1FZ3K1Dj1|HZ=0 z$@OwF3@yt3;!_W=^NfCRC!ccaa9rc_CeJ7^njf$gwgOqLAA5;SXjbA8ULLN!ycroiS0frf|JF^8o1X&^Ndn|dM6(W}FxfnO^Pi5Nfopzev23C` zQDXERcSV0XPI{u*n_NfqlJyqMdeW*$Fjk8BVgpx~-;wGkwIbE83@NVNd2eF>mSpRL z_!Zkv`*;OBIswcpShpOw!=W+u={wH`1ynAvOg!5ceYO2Jzd`peTt1dikeweTM2i#yU`%p65N2V<1r0knKU30tfE7Xy z);p|XC~pS%D?~ko5rycpK`tR)K0k~oOGX(d&=*xC@UmHHIYU_W1&05nd=20;AibON z6)=wNk6pKqC-;}Gb>>cxz{ssl@3L!YM4(nnr>aU)g23n7HjqzsocA{y;M>N9 z8YN~`?Gh?xHD>Kmdn;WsJ&W+_`Tp{r z^S+OzI(ZbX%F2O_#3=duZ z>Y)vS{<^gDp_ft*KwA`&l^h5CGrGvjgw?bTtk%tb)3Zl& z--21mN$GB9+N%_|uCUIF(i^!iSOsGwL)$ma6!V9U?cc?@Sp;cAn?n`u-zU0`ws6&4 zzppqDeLM530@yveLU3P?!0MX8Df_sunLbv-km+#oR<;zRc!^cgr43Fxtn=6ZSU1^e zF27!F;joTZnNjsH&{1ycdxpY7!gNO+pZ^KuvGdgi#V6oIn;>KLto!Y@p0VR!8s}if z>=?O{a;2+Dv2o6Ex7K`W(m5o(PLp zsmp1V+rJzuyD9>jAK0fAOR!cxF_U2t;n|z`{2aol374G??xGB~PUw2kWmz4)$7@=? zuY5;%vD`6=i)Z2z)Xr`oc7th?u2o3rj`{H!pI%%X9m<%r#|v8MY8e>LU_pp2$DXBCOwaFV+& z>bBtH+T8pZh1>AJilreAw~Uas^Tm_Z+w7C89{#UCcQ_O#>`Bx{1*<%@z>WUJq%7E~8}5|umfEy^U$>ZEaXGvQW%;=RcA#`Uu=&hkV$Lza}>*FstK zC=hRRk)%iq^g3;Dx?y2u4EQZQUv;jTnXs9rqGGeEIYKP^((HZV#~GDxAH-QvyM(S} z9oJNjAmim`CDPZ1wfGDrK>Z9@@sEm2N1d&f?>XtHS(c_suPINv+`B~Bx zE2m~!xkgQi88w@^%TWGL$VWHH5|;hQFcOQ0IjjD7-U!)&ZOI5(TlEC|Lg_7Ess2QA z?HSNf3W8I@MeS{(wEgUci;G8bryW7=omt*eMDp~-!GY=M8s ztpOoZEDLF&Q0JV{<}h)f_+NMAf}%c>fU&XfnuzG$%p}8p)@ERm6dClHUli}WLqaSN z9gVuF4rKgs!kU6NMR4Zw2zq*$@P^!2?Wu=%>m2)|S$`FR-uv3*8+H8Xzf4k!#|a>W zby$H4s?ql*QJB7m^-XOKwu#G4ye@;zDwgggN7Z?_Q(?qPNPR!OhE5T;KBqMog})yc zH|@HmQ=f~Ja1}jK-kOZYW!P)zJz@R6iM%D7|2}n&+kylG=)I8Pr$@CYJ^A!;XLfE#r zcSl4+gkF+Xf7mILF2W~b_b6cqIHMK*W#TloVeUxY<@CjQuSZ}tGe1f@^+kI;wen$_p)Z&7OEzQM<3eTortxv zFDcULU278zP->*T`}1I?)OUeXbU;)}hzX>IVJmCo-$IGoETqcV%L+-dNww2r4kfgc zw`{DtFQ9P9wmOEAkmvb(7rqb?us4)Wb^}k7`F(YW7;3CIbXi+SL;k%fIFvM^Zt0n5 zbgg7e-zFDqB!fsF!^TBk09f$iFj;T>5T=zg2>y19ay zy(7UD<|OUyT+lj2aAEOUVE`va@+2U(^0S@XkS1{}6%BSh04Fov2LQB=fv_SjW%jn?D#)MU)A zybTI@7dS^*%FA-@cD@c)*|B@NLoLbZcs|M8g)#O$SdWl1(CSy>&fHH^Q{6c{E{U$) zML&a|m)j9_w+?XV1Uoaw5ABQCdwYc{(utM<7v#?~H0} z;To0AHhz{|rkpD5s~<&TA!4kf5P`SMq5}d>tJdabXYEUGgWlnoU5t(lDbsal0k7JX zsYZ6+I%ea?R`wEZ$bfLc{_oU%w-HS?OI*XpTi0Tu3i?udN=Uy1_8Q;n4(wO5dUjac zo?*j5`%?eTxsP8r?$1(xebTogidI$MhXai`(}&H)^HG*hYh(A5y(QZRBw)LFyMa>= zX{#k*U}9WMC&Jr0rql)e4&NK+IMQn%8BrtUOFR4&spKzxZ4J++FC8*{M)iiBBCH0y`gnir)@m-neAc82#tp~+E5F(VIS`-|rce8!md z0~Z9zLrlnrp$OjamgEXo(xC>Sh`-7`aQ-tMv+eNeAegbhY@e>}s+`|ye)hfA>^aH_ zdiJGk_JS{vAqbnajg@WW9B+iX#+=5IJZ#j&Knkt8A+U+1J;>-#heT$-V2EppB~8}Q z4)YqOKXci4PyO?kwgCIdeBZv5w zi-27%MyyQ~*URw1wW-aDHW3U&9r^&o&n_Jc^e=>ec(=4gu>^D=;mc0WuckoWT_xMU z7Je1;pDhGpv_1n)+iVls5<#Td3|7be`9QIdPFr#2Ly`!E&5v1Qa6E;EsA<)Ylj!2z zYs$Q=qNHCA#_LoTg|6|qah}`;0-nOG(l9rpr3DKz*|~ISB9DesrTo@!sOV0semzV{ z^obxfMXJX$z837|*IU#eh&1A=q6286OHbuUGs@DfvCz>XSs@wYVXN|?3(V9$B)PbO z@?|BNxJAirU5uic{3vutCe{_4O0GZsr3{IfF*qCKrj6asp|(-P8&xuxBS}p@ZKwzA zkJqm6dtrP@rw94i$}jfA}j33 zEvAH8$HTkzL0C(mDh!Flpe>euB4*2OZnzfEh|K$C;2ZP?><>KSZK~~LaA?l;1*W#z z!=5K%5-#`p*sJpW6IfzWSfn{S^jn9#**J%TCs?ob=|~hf2->6j?2*BGg15K*~(=-??U2{0$NS3C};d rI{$@o_P?9_e*}+zU;op@_6nKye|R1y`s5Vk literal 0 HcmV?d00001 diff --git a/Solutions/Forcepoint NGFW/Package/createUiDefinition.json b/Solutions/Forcepoint NGFW/Package/createUiDefinition.json index 6c8073ca094..7503e8b4ecb 100644 --- a/Solutions/Forcepoint NGFW/Package/createUiDefinition.json +++ b/Solutions/Forcepoint NGFW/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/)\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n- [Agent-based log collection (CEF over Syslog)](https://docs.microsoft.com/azure/sentinel/connect-common-event-format)\n\n**Data Connectors:** 1, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\r\n1. **Forcepoint NGFW via AMA** -This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Forcepoint NGFW via Legacy Agent** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends Installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31.2024,** and thus should only be installed where AMA is not supported.Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -62,6 +62,23 @@ "options": { "text": "This solution installs the data connector for ingesting Forcepoint NGFW logs in the CEF format into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } + }, + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Forcepoint NGFW. You can get Forcepoint NGFW CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link2", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } } ] }, @@ -78,7 +95,7 @@ "name": "workbooks-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences." + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." } }, { @@ -90,6 +107,34 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" } } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "Forcepoint Next Generation Firewall (NGFW)", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Get insights on firewall activities with the Forcepoint NGFW (Next Generation Firewall) workbook." + } + } + ] + }, + { + "name": "workbook2", + "type": "Microsoft.Common.Section", + "label": "Forcepoint Next Generation Firewall (NGFW) Advanced Workbook", + "elements": [ + { + "name": "workbook2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Gain threat intelligence correlated security and application insights on Forcepoint NGFW (Next Generation Firewall). Monitor Forcepoint logging servers health." + } + } + ] } ] } diff --git a/Solutions/Forcepoint NGFW/Package/mainTemplate.json b/Solutions/Forcepoint NGFW/Package/mainTemplate.json index 86255c7a8ff..d7202172005 100644 --- a/Solutions/Forcepoint NGFW/Package/mainTemplate.json +++ b/Solutions/Forcepoint NGFW/Package/mainTemplate.json @@ -46,57 +46,54 @@ } }, "variables": { + "_solutionName": "Forcepoint NGFW", + "_solutionVersion": "3.0.0", "solutionId": "microsoftsentinelcommunity.azure-sentinel-solution-forcepoint-ngfw", "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "uiConfigId1": "ForcepointNgfw", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "ForcepointNgfw", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "uiConfigId2": "ForcepointNgfwAma", + "_uiConfigId2": "[variables('uiConfigId2')]", + "dataConnectorContentId2": "ForcepointNgfwAma", + "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", + "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "_dataConnectorId2": "[variables('dataConnectorId2')]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", + "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "workbookVersion1": "1.0.0", "workbookContentId1": "ForcepointNGFWWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "workbookVersion2": "1.0.0", "workbookContentId2": "ForcepointNGFWAdvanced", "workbookId2": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId2'))]", - "workbookTemplateSpecName2": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2')))]", - "_workbookContentId2": "[variables('workbookContentId2')]" + "workbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId2'))))]", + "_workbookContentId2": "[variables('workbookContentId2')]", + "_workbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId2'),'-', variables('workbookVersion2'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "Forcepoint NGFW data connector with template", - "displayName": "Forcepoint NGFW template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Forcepoint NGFW data connector with template version 2.0.1", + "description": "Forcepoint NGFW data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -112,7 +109,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "Forcepoint NGFW", + "title": "[Deprecated] Forcepoint NGFW via Legacy Agent", "publisher": "Forcepoint", "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", "graphQueries": [ @@ -256,7 +253,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -279,12 +276,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Forcepoint NGFW via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -318,7 +326,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Forcepoint NGFW", + "title": "[Deprecated] Forcepoint NGFW via Legacy Agent", "publisher": "Forcepoint", "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", "graphQueries": [ @@ -446,33 +454,394 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", - "name": "[variables('workbookTemplateSpecName1')]", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName2')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Forcepoint NGFW data connector with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion2')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Recommended] Forcepoint NGFW via AMA", + "publisher": "Forcepoint", + "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "Forcepoint NGFW log results", + "legend": "CommonSecurityLog", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Show all terminated actions from the Forcepoint NGFW", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" + }, + { + "description": "Show all Forcepoint NGFW with suspected compromise behaviour", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" + }, + { + "description": "Show chart grouping all Forcepoint NGFW events by Activity type", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (ForcePointNGFW)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ], + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + }, + { + "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)", + "title": "3. Forcepoint integration installation guide " + } + ], + "metadata": { + "id": "e002d400-e0b0-4673-959a-eec31378d17c", + "version": "1.0.0", + "kind": "dataConnector", + "source": { + "kind": "community" + }, + "author": { + "name": "Forcepoint" + }, + "support": { + "name": "Forcepoint", + "link": "https://support.forcepoint.com/", + "tier": "developer" + } + } + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Forcepoint NGFW", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Forcepoint" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Recommended] Forcepoint NGFW via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId2')]" + ], "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "properties": { - "description": "Forcepoint NGFW Workbook with template", - "displayName": "Forcepoint NGFW workbook template" + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Forcepoint NGFW", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Forcepoint" + }, + "support": { + "name": "Community", + "tier": "Community", + "link": "https://github.com/Azure/Azure-Sentinel/issues" + } } }, { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Recommended] Forcepoint NGFW via AMA", + "publisher": "Forcepoint", + "descriptionMarkdown": "The Forcepoint NGFW (Next Generation Firewall) connector allows you to automatically export user-defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "Forcepoint NGFW log results", + "legend": "CommonSecurityLog", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (ForcePointNGFW)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Forcepoint'\n |where DeviceProduct =~ 'NGFW'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Show all terminated actions from the Forcepoint NGFW", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where DeviceAction == \"Terminate\"\n" + }, + { + "description": "Show all Forcepoint NGFW with suspected compromise behaviour", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| where Activity contains \"compromise\"\n" + }, + { + "description": "Show chart grouping all Forcepoint NGFW events by Activity type", + "query": "\nCommonSecurityLog\n| where DeviceVendor == \"Forcepoint\"\n| where DeviceProduct == \"NGFW\"\n| summarize count=count() by Activity\n | render barchart\n" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ], + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + + }, + { + "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", + "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." + + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + }, + { + "description": "To complete the installation of this Forcepoint product integration, follow the guide linked below.\n\n[Installation Guide >](https://frcpnt.com/ngfw-sentinel)", + "title": "3. Forcepoint integration installation guide " + } + ], + "id": "[variables('_uiConfigId2')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ForcepointNGFWWorkbook Workbook with template version 2.0.1", + "description": "ForcepointNGFWWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -518,41 +887,47 @@ "name": "Community", "tier": "Community", "link": "https://github.com/Azure/Azure-Sentinel/issues" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "ForcepointNgfw", + "kind": "DataConnector" + } + ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "Forcepoint NGFW Workbook with template", - "displayName": "Forcepoint NGFW workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName2'),'/',variables('workbookVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ForcepointNGFWAdvancedWorkbook Workbook with template version 2.0.1", + "description": "ForcepointNGFWAdvancedWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -598,21 +973,60 @@ "name": "Community", "tier": "Community", "link": "https://github.com/Azure/Azure-Sentinel/issues" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "ThreatIntelligenceIndicator", + "kind": "DataType" + }, + { + "contentId": "ForcepointNgfw", + "kind": "DataConnector" + }, + { + "contentId": "ThreatIntelligence", + "kind": "DataConnector" + } + ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId2')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook2-name')]", + "contentProductId": "[variables('_workbookcontentProductId2')]", + "id": "[variables('_workbookcontentProductId2')]", + "version": "[variables('workbookVersion2')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "2.0.1", + "version": "3.0.0", "kind": "Solution", - "contentSchemaVersion": "2.0.0", + "contentSchemaVersion": "3.0.0", + "displayName": "Forcepoint NGFW", + "publisherDisplayName": "Community", + "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Forcepoint NGFW (Next Generation Firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.

\n

For more details about this solution refer to integration documentation

\n
    \n

  1. Forcepoint NGFW via AMA -This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Forcepoint NGFW via Legacy Agent - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends Installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31.2024, and thus should only be installed where AMA is not supported.Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Workbooks: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -636,6 +1050,11 @@ "contentId": "[variables('_dataConnectorContentId1')]", "version": "[variables('dataConnectorVersion1')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, { "kind": "Workbook", "contentId": "[variables('_workbookContentId1')]", diff --git a/Solutions/Forcepoint NGFW/ReleaseNotes.md b/Solutions/Forcepoint NGFW/ReleaseNotes.md new file mode 100644 index 00000000000..8ca2f13a34f --- /dev/null +++ b/Solutions/Forcepoint NGFW/ReleaseNotes.md @@ -0,0 +1,5 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.0 | 29-08-2023 | Addition of new Forcepoint NGFW AMA **Data Connector ** | | + + diff --git a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json index 918354e9fc3..7aa0a41d803 100644 --- a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json +++ b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json @@ -967,7 +967,8 @@ "CommonSecurityLog" ], "dataConnectorsDependencies": [ - "ForcepointNgfw" + "ForcepointNgfw", + "ForcepointNgfwAma" ], "previewImagesFileNames": [ "ForcepointNGFWWhite.png", From fee75cc19192f970a652d05891ea2ee3e83dcadb Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Wed, 30 Aug 2023 15:56:27 +0530 Subject: [PATCH 2/5] updated template_FORCEPOINT_NGFWAMA --- .../template_FORCEPOINT_NGFWAMA.json | 2 +- Solutions/Forcepoint NGFW/Package/3.0.0.zip | Bin 19824 -> 19832 bytes .../Forcepoint NGFW/Package/mainTemplate.json | 16 ++++++++++------ 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json b/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json index 8552cdb7d56..afcb3900164 100644 --- a/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json +++ b/Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json @@ -85,7 +85,7 @@ "instructionSteps": [ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine", "instructions": [ ] }, diff --git a/Solutions/Forcepoint NGFW/Package/3.0.0.zip b/Solutions/Forcepoint NGFW/Package/3.0.0.zip index 4c1e39d7546f0e5a056ea1e416d1db43df5a36b2..44d739c69ea5dd1480b338ac8976746b50c6f9f3 100644 GIT binary patch delta 12120 zcmV-eFQ?G(ngRHl0kCBW4ljNlR|nP@N>oDt0F)`Sa|vP-f2}^?5}B&?di_;61>Ck} zuMXoO;oi`&C}CvV!GsU=nK9dWwGb7n$?!4@vS99<9Wa0!fL)d}$J5i8M*uVhVg3X3 zKpq~PMO0#`%qeY8SQDE(8sqjEvTEc&rqDa|jzL&sLlVvi9Ov0&NY_~+OdxT66kyw4 z6r@x0Ye%+Ye~%_3(r$FN!>Bm4$Al{r8x^HxX$8e2=3GDV?-+11hGbpnN0ECM;m(?j zhc=!^z=m%4fNPe_ZyLBw040_vVcs*6={AVWCX+d2V)+mX9Hc`%brTfjX;#)I>&u+H zVtyzpk*7NOQ=QRYPo0HY*qJngKZAtb;z1RaSi~$Hf9MnL3R_A~!P89seJ;7bi%R_! zvQ;RXIp+Op2%@}Y6g?#<7N1JiQuHh?zc>A4Z2gdS!ZpbH#b*9;0oTlHFrEdR+qF8b zH%bUCe2N7Ve@f>Jr=QH_O7vvJ7^0^DMsEH5Ax06Wgbn=;BfnFv!t@_zj!Hl6ROqnR z>Ry%-e<{)OnHfFLE>$`lh?+t_b;`7Ss>J1%r-kz;i}seMg)dJFPga>z^0GPGxuu;S z{j~6m)NWG!DABBh<>Dhn!;%$_7R_vJd0IF=TENTG!j0u=;g$J#`qRRz?oOETl<-u? ztDX{`0#H>R$*POkCHFm?60X;_**oa+K`l=Sf1gst&n^-QReELCQR^;G3ICx_2~W^# zg~4Vy=O`dSJo2&Q z3q^NTN=GccvPvuRq(_v_y zf16()5=ryg^qR++%R|u%cN$H(8*QpxXeBr5RN0_YxZA9Fms!#7vb1YB1!i6oxI7fS z{I0R8yTukke6t>ko)kMdn_6@vw%ou{dIL*2p8avQs3a*dN52*CSV$Wxxx2IUytE|d z(!{I}zLrAkcTCb6d7DnA`k{AMmB<~|e-lxeyx>Ldo+=@Oq9>z&_&nq;spamd^V7UcEmt24algR}*4j<|X1Y^RJjUh-CSNTWuAiWcx zu}fgl-yO45OL&1H%aiIMGZbY2V_lXqQ=Z^9%M)CNXgg;ESDceEA{Ymf9>uG2bG{(b-6C7hdV`@y`kHa{zVQl zT(mT}ME-W^U1}ZviGxJ+R&d5PxezVUf;`KR#(>zs>Zna%QtP)5_^(i_4h~tw^lw{_(p6{WA`|-_v^{UZM%kU5d4 zV*=2<^LyZoQR8C|_ZfV?;>98#e12Im=|>}U`N%PA$_YN&W2f=FB+S#er;Z|{|1dJ# z;qx+d=$x?~W|M&<9w5Y=MO0PK0V(PAP}~-hoQlL!C3lgizC8E?A1&bLd+?LLBNcz$ zYh{`*;o1oSw(g8JW8&NI9pcGu4IoCF*4|D6j)eGznA|3`m{gNsN%3dAtserjTQrR!EuU$WNs5d~acq`sIa z;J$ThI3~3uxBL*%z(>1GeUZ^X{b7G~Q*%lP;1Q#N21`^$cQZ?+7!K_LSY()Z$Ir{4 zmXZbISj33j8L<^%`9)uYobWtdwGOOG2bf;tQxDmI+)!f}+&o+?vGV}2#FWQfg>Vd} zcFgDJ2lqqaRyTS)c!1`(1Zr~^m0?=Fes|ZZ_qR>6-tBj-xzy}c#AVQ7OL+jYP;i;C%HbD0~d39+N{ZnxKOcWAp`w{|x{B6fFay|>ZXtpkp? zt#;pRcXwM;kf|EIR|vI}L8zn2FtE=V-9;~do45gow#r~wbZCE%Y$h09uot!5Fxus% zmlum0xyr}lX>`!7e_m+77Ml+zA4Mfb9ER?;fXp? zF{pzA4qp0!hY^R^w^a~Su&QBA@X(y(>d)fO7cYPsE?2I!%xqX7)@@vM$raj1W-0o5 z0G#*tRWZGf-)et6C*hFx4VbD+k*QFD=4x{e`zaLM>6q=_cB^jg7+^28tv2YP-Ub*= z-OY{7es_D*u%@739;tpl#LG)!%=dSNeqIbwj(=mJU=bR|`NW?9N~Kj;G_0vLzpa;I z3pK2t%NMcue-2}))WcV3Tp3uG|S5WqqSRmQOIc>qxc!DLi6W;zAJAhj2A5ToAZ%4rpCAVf$}> z1A>3JaAQUV_loJ#V;?K~KePfFS1(M!%vZW(i55ARHIf!9Bq3K4X^D?5EuuW(2dBU( z_8vs+^E5XZ#Hji?67@meW`<`--iAkw1!%*hkEpsXJP3DJJb6`EyW|JM$1xW~lNPw+ z*|23oRq9QHuLs4#$QZ|QFm%l$r|kL9(P)e%3$4~o%fky`sk)BUR>>EE4 zpKqy2RO6qrD&ms!z#Y1tc8V@nZm1DJ=Y_O}a#?^J*P;y2TbmB8L>~l{Q-u}>n67(< z9;I(HZ}W-vl?f^T?%C}1dG=yok@x3fGf}3nk1fl&NzWJN*;?T8!5mAqVjD+me_Ve( zxb+i7u)haiRNBp}Tq*EfIS`}=x2!27JqS#w5w2PM8o~?McB4w1Qo*v~H{dWi9?~pk zjtDN{pHEX{&4+g`PL@=Piug%7xbn!{i!Q)L2>m?z){FgTN9F3!L^<4I_j{ZMzO5oO z&D%tiai~&_kU#NKDvD&>gx$$84v>FtW5LH7?~?Sg)jruC(8L>OU^{e=e|z&4h!*oP z4{M6XIz+#&!$=2zDx2M8@(sKULnm)!0;pd*;m7#ZiZ=g2r(&e(l;#(4IE zp99noj*gBc2124c#p4?_1(hHOU>~#gPF`bVa57rM7q9OF>SHvdyR*5yMQVRUT*qX? zcr7f61?2@c@xnmQqjY3bOZbU?rXnmHP)+G#vLn2T_%~D0DUBnibL<(W+?iKG<5guO zovPEIAYbpL%fGdUfk@?gP!%}vY%9Ky3zxjomP@XVqd8*`)FpDaru8VGjNhwRqZo_K9RuMX{5yh9S823Gx;{T2l{toHFkc{fSa(n#~)~Jqev5h z{Ppkf*Ps4&DV{a?$9nDR52*8BSk|cb_v>%3lt0(k|Gs~Yplc+{!-+OM(k!O(VwA2k6C>1B5CdMS4C@|YN9`B%FU_=(u=7`_5(CwM-pyGR#FF3 zuBddXW5`cAsugPvj-IEWJYvozjU3cndQ!>l(QYpV)s%ut9a_Xnaen4slPn#+)pPYy z0xn(xCLKiclYEgIDQ*9f5)w}_fYBT}qkRx6H?MyuK@i4epMc;gFu*b{V|sAAth5+x zJ;e4JJU}sKExyqny!b4(+BBPlQ{0R2hG;xO705hQ$y|*R~bD!cKzu-~`vEYf;T>tf0J}IDvP64U>{A z&p&@CrPs;lf1pq)F_5OG{%V;1EmpjG84d7!;*V|9b|?M;YYFf9*kgBauxTJ`ngX&P zpAp#E#P@B3iBu-_zjy|WFZ}(Ey52zf{st)A;lI^x9Gzmb1$sHI<^Gg%r=~BK5@jyr z)l#Y~mVU>$Q?V#FNDbLX4T+J!C_nwE8mGu|UbJF~WYH8UPDunYI2Dtf0H*cc#aM_YyQwzoF7g;Xq`FsjA9;UP zP`CC_zL@IDbM`gFQll(2%2K0Dry|q^%4YuhWHWTbh^vgyTki~>j|Q18n%(X!h160= zJrg0tM{-67^ec>JmHByoZ`U@^S;d}4)mN(uWGi68?zLfl0qE@;<&*82v2R^Ve7s=y zT^u>lbr(mlPB!tHu{dsHNeATB9x;Cg?wSgAoniOQ*Rjo6{}2jdCGtvMB%G9%$9R`d z5Vpq(16*%#4JJ%-AJpI0`RSRW@R1eo9!pDLX%=Yj@o&J>r?&Y8h2UgNTxSUNKOU_5 zB)BmG#%TP;4@!XD#Kn!2+<`q6hi&@~tj9;=;9m0e(djz6vXl>RMut5Ub3cC;c}B@H zqH>I$GRjCQS`SCEkKN|IA!8TCn{5nXL?hs69FRlWpr{0P*s*>r$!UbPCt?6864VI( z84d#PuJnT%0(OXt;C*8EIeMTO)}uz)g9~08@x|)Fv^sTGhA>wM=@~wd25!8S{X=~7 zE)e4u5M&6qi&WIyop^C{ZI6H7;1uBg54+!A(_*|9bv*ntj>{5oIZ)*bC)=DE2-}J{ zTdh8qHnr4KBf8hR)?socKF*Ep0Kb6h2faoDmwcggOh6U)N#B6^!bUxIl{xV#-ZOJo zLxN|F;ZQbpRLmAs7Q{rA*&Knw=0*fAE%^D7NGn*`$2vVUmTqxQ*v@|(iJO19z-M@| z&z{=BwP#|u&F%_VN2d4-hV>gU`q(3X@z6MG#8;QO`X_8Y)=o|IrIs2A!<)S3sK&)T zT5LdFQfsAUYQ9;T?YMXkodaSz3F+h@+L{IZ2$;%>Hz0Q``v{; zs*zSreqYyAJvh%{QiWO6Wq6u53qf*t%9j+cgkxB*MdPWdz;u6Y#mGk(hy4EvEJOuv zoM*#J@{N@w9(7@qB_*Xq~{>IjnR0> z0)b4t8!-r?$?XbF{?EsY!?3+t#fEk(G<0x-7f?FWw$*=WF(`owfYWIQ&~CTOG;wx%P*Y(L zr4iP7Y&?Ghbio8n2YNRJ`WJ^?G95)oK72s5WJ8Wa>{OXav7}%IK`7ZO&TV^RvkZFP zU@jcH-}=NDgTAT}cKzQNq^n0qU{#Umigx0Ax2C?8g87}fmF?76-ouEghxwx+su|*X zw(Aqj7$oO-mbNJ;EDlNS@3fG1s`UvikAY{5a-n~f?pFb{H2vm66CN);uq~Yw=FHH{ zrs4AsCyYIKLDGbkNRst_IXs2_NSfAD@m5-XJYeIU%#p{MLX9)dZ%+$YH>#NcZ|vkx zd=AQv5BE=-2l%fRVisXmhuG~_5rv6qYLfjz$=B_sC0`o5C$GUsy`#e+`Qo^D5)!$E zhR}bxsleN8r^!I4Xy{jJqJQhyb|znIQm~=r07}v)cTJZFUBRX>(MGpi8w}?84fI>z z0zyWAg=i_>$Zjc<<^2WNP@p!+o70p1go+bQf@x?{3n|hxxQ`^&NP$L}t&y#bt<*@g z0`3@BU3V1!C5N`hCKs>fg7udlYStL&o$Y^8NILWH9W&l-SQJqbc!uNmX`F)E-HkL* zl;EN#&6B|>0)28$&j06_M2(Wa5~XkwGAA4r-Gz`{$3{2sDLe65g|^#jrJ$AM_H%oL z>Rf0Lc8Z64i%Y@Ce#tTtJFRXRdrKHaZxPMs_dYBb^-yx9Y9W-3R$AR@Negc!HGY3n zr%8;xhC&)h4PV)giRozjZY)LPk=GYRjd?lX$Z5XS* zxlw8DH-g1qync71Q@;6A*AE6B^)r8FEDm|6m0sa%i1*Wn10wX*Tg+Z0uP6OJ-sJ>R zfuQ)0L)~2r)SXhRpkHmr!qx35ECoFuwQCYgn((WG+1l7nlX>QxoKee;^YnI0gQLv) z2Zry1S>VYWz7R%Q^i+k>-mNeWJ&fH}w*q};z-VvHjE~(;6`Z~q8a^1_AclYOl!-W? zjd=mu-6?hpMlGD5G|vxC$OZcB0)nA>uWuxmaP5x952JIXozRhKm^Vp($gGsxnHj)# ztDW`%WQ$YR8Mue9V<2SODv3Lk<;zqYvSI|X?4Ij%ow>&d@$KRwo8c)ZZ*`-rer}SP zvHh-7(?%;F`OqZgq|{DJAN%Zbvc>pv9L>NV1DnqVC+)FeSvK27&)$4nhD?jX8pXCz z)Z{W`Iuoc)3e+-Wx(t7rE<>iX1~Zo-(~^*uA=9a%mdlW71;ERYsk023E<>ivkm)jH zIxUoC$aEPpokvT{kZHx>=3<~OL#E4+X)cUq$aEPp#h1&F=`v*cBtoVIhd(7c^~A%d zV&i7rxHHt10Ji{Tp)h*NCjf(|$xWOFzLJB*U(IInB5776*%N<5-T|$U69#Vlz!;5T zcEU-GN^#0bM2q6*j3+)O&m2#GPMkjuLP@`0v_uS;WLy_p6boK>KsIlyXKIHfhG~0mNkhaT!3IHMF-3AeMx*3?NPw!&?RrD*#>w z5S?WJaT!2d1`vOj0mNycECYzk0OCAaS_Tj+hWZu*bs0ch1`u;$ECYx?SOD?qoor1A zyG3RH>~ybWaC542X`fJt^M?sS#y@_C!9s<;Uw^zfhmkMOXfIa_;)Qwg*um@DwnW#n0!vd{3~^5XNtx95_(Qg9O? z7ZYH3SrapeQjDmlFmfyS=b809@6U*V|ZtH zwElYNnqPnT;xcW#DJONPazwa1*&!sEHwg5S8GSX<-W;uG^UgkSMO}1DoXc;ELnA6= zWnt0R-o(E-O&z|0pL+PI)n-L?hk5ukywj@a43ER}4@$X5JGY~U?g~R*z?x#5&8NmV zRjKjWv74Sz;`xq1JINeJ{wk5z7`HorIXnKkCk=lF{0=Yn*4F;}#b=}b@BRA!Uj4y5 zAb))ROa1yEjlcdK{`%A3F2%DZ|5&eG{Q-6U3(Fey{(k-KmGbBM`rp?PG;nK;fH`V& zdc-BL!>&C`8pF_sV9$qTYp{m>tFivSff9G_aDAEIC-P~8&| za|_MI7ZG()=Z%QIDyH%;-cad|!U=+FykQO5rP;)P^(9rF`P{w=3pJG|syN$HOf-80 z8r4V43N+dB_chYJ>PM49j@NjVvv`BGEEj)!Xn(&wg;nanPs5wWJ9;@UJ&^)BS6vaq z^ivY+$&M9@_E?3tr`JHuSrT4Fslpz-(%e>yF;6J~R@QR7r6i{owUT{1S6sRj!HFbI zK}qc$Udg^oWmyPINwBYl#@9Q~os7{e@oVvB;#bX|@7#D!>Q-s_M>l`Z z0>Q{TxommGYI-3IoftsJCPUUapZtly(s&dHVpYA^t7u^{N9~U4*_`-+JNnhO0)EQf zCRem6t-Y}ztz9k-h95DB>b>FLgmmJ6=OG21j1o9t%e!@f9MEF#q3=WCPo+ML4gG%s z`hITE^-4WrV%`RhaDrLZ?3b7_pSXX0=4ihGz%Mw+H4U;uaY$mlfFTDiYa`J+IS5eu zAO~|HrU9~ECIGHK6AyHe-IEfPVd$^2|9JuC#v+Z49Ewico5gxeuXXt!q3TW0R-}Z* z`#7%^HCpb9%pxc=s$g|QvhfGd!%UBsQO3Makq+j6u`qLTy_^g~i?YA?)Wd)4JfmOS z$)}t;9M|}~$ukO!<_Bzrtw2`m$6jI+nw5Bj7l~b(-e6jY=%dpErdz|1Mud>}V3;O8 zsw3MsnZr|CJsJy)GEo8zvwY(Qg&C4hnF~j|k7k$Da=Z>zY?k@lcc1BV6h!f9GK4v2 z!DgHKB2|OW%sE?rY#bXsI?R8rb$>?tx@vLB6mLdG5BdM%kaIIf;y~vwjF-~6ZJXW*LOSuC5VPLvpZ$6e8%j+35f_9oX6 zy=1)wv!1jn5{#8%zSzLk<#(j|Nv%lrD?^HFcix-Wza`oFAb!R6(>{M*0gp}q^9t52 z2kvlajD7mfvq3>KUwUmyZ~HDV_tiJf($d@Z$@XoL93_sbPs*{=QTsMXSGrCbnuM=YWs@cFh4UZxXBx*MG^fusU!W6{DGedl4M z0JN8H zbe}#jGaX=?KQbdN*zY$zBc;g*%x2T1)LJ-+>{}z7Q3U*}rfmOcqyhgsaL4!0g+da7 zX_15hO)V*7d>?-i$im$w`xgnjnt3QaLPXti?-dB$GbmdO?B6jcVh#h{6SQr^!u^b-$ z5xWf*8nE8G($iP|LRen}=3$PgX^)H{>r>`Eu+cZ|6|&#LI%9F@2y>+M{-(z zo|zS66?tyZt39&2n`Tum%|G_f$MzTM?_ExD(*8*@dmM!+rr*)?yvp5R7EtF56KnW2$;lSZ&&xtBmLzIhSBQKtHeTP0 zp`m}7_cP^e_Ll*5u5Z9l8yVy4_!zIbb&gd(3OUf>rtkcqp=>}CB0d@1H}VmWf)LTc z7yPE`viUt5OA(Z5E5xf52!hC9%@qkH?beO01?}d3Fn;Eo*REyh?dh4VJy&MSgjSY= zHsc($Tfjl#0zbw|;W}7O0!v!BT-ojIZf$?|dfRo&q-MRl)9TiDD7EUl1~qz{-Q8}l z*XN?VOeB z7xb>Kj;6cCrzrV)TmO1T|9baw;fdbEi0bCll*&{Q56>+S zm1Ya({}kzGEccJI>kCG0Jo_&sQkj3`2H%tUZI8fRQ|owTPXH|U2~YXYSnunW5got4 z^AunF>lgiaZA(DbKEk{Wjr;WyD*TD8`=KbU=6jOZSfoRsiZ?*DAH-_9R%y|nw}h|d ztp308^?enydqHuur5u=p9BAid&FQ)Rl+mUWZDS>C`=&V=iS4RY#lWI@-2i{GjCg$} zy4`q);LY*-jNr|d(BgRb=mi~(abv*|w}^eDCWj8|Z}EWeFbTbXIEr`5%8I@kqvAc|lfypS4B!$XIgN z&()f!y((w6zKZ6#AFS~M5fZ4!5=T~tfn8mPM}ztm81Wd5O6o)ZQW%5+R&R_?jA~%C{k2Y?DC=Cyl^JV@x zZsIi}LMKw5umd~7ju3zB30eC9Qj7?hiG|<7Qtu8{0PBtLVhg1XN_&*@zKG1h8haSr zG+we>1W~H_hja|9Bj_7$F5x#qG(Pq)0RQ=l7dznl3tX?Dte}#kkujjYM3SbQV7xux zx<>0IVIqD{9cRV}VeEi`bs}ejNNNEXLIklLPWCMYwQ!R$hfIGiyaZj<;|*iKId3Qx zzBN?p(D5}8I&iaIG=%h-AriQGk*<3!D<8-bnJ{qUHCC4>D3WlxE(%`HY=et7J@+VG zI0wry3r&iINDy*H=`4wR?Tc2pq)pdN%1j0gZv%3@%n_u!Ru-^78Dq@55b^;#ryF=Y zW4IumyfWp$#Q1-L)iVVe8BxaeIehb7lX-VMa%R zXF&Md29)}&E1*$k@`>}sK{D+~-yo|fDe+LqG|jm2(TyFSl0C{fh2zotrii*hU!$kP zT55MfxxSb_rSUbde(7FcX=pw9Drsh^Kb89GxIxaFUqFAK{hTB0WSLKTaT|&*@jW4K zW$h2rlG0Vhj~Vp}Wu;n2Owc(qm6iT(peojtoJL8>xVQYLb8Y90cSAUW_eRlC8 z*VLCQulO~L{O382oL)=mczg!(~ zb~%5!F|4CAs6j3eoz(Gcc9hg@=r`fjSu5f^B-{+|v5a9nXZ)VERD-IF;Yokup|2)f z*5T;b$>X?i;#adU(~KZ14PC?X*=mnn4MF;N#!`(R_C7+M27n{JhGU*NV=T9LGmxR% zgDns(su^V?oa?uERRvOm#dm}gqldZAjEsLI1xDnPrV523gt2M6P0KZXMikf3=W7E8 zb}h-e3G{#~-GP{TC_BO1!PqaHe$h2|i2n}lR|-!hC-T-d$o|QG#AS6hUksancrgP91tDCQL4-_kr|-205mN=Wu_F za!f{z7S`6FcZlE`kv9>!j^Q&D6HPJDx=H(W1AS$$P|P4E8$=>5q5ve(5#ZbM!~WR( znq+xCfa`_$lw{I`X(%-r$8=zr_k1+UtdNJAmLYFHUeI7O6CX;Glb0f{KVH01#I+V- zM_gcXx^?@h?h0~@5ZRCjiAD_~gWZ28qw6ENy8$_a7r+Q6WT&dZstfwSJV78fWGe5qHd#z044<1y>TZ)i=Xe-3q?JE;7)t&B{bu>0TD}7YBhdgXgq;W2nLJ5 zFn#pvk9Z0JNE!$J2SdP_A=V^vMPUt!r=>8d6-(|)o?1LAw8f)>xX6DkDNssNPjx)9!cbgTOO z+jXej{M*6h3MfM>xPbsP%CEZ_AN1CZhBDspiZxwd9^X~lY(=fcW&UFEo}(s38Po1&H~mrZsthkCe#Zfkw8 zS&PgV46#OPr`@8(VWdS3NAFUuGMvsV!^w7vS8;1po0G)Cf2Qe}Pyb%4O+udIfK1(qw|{T@&dZp z2-P9UKclhDE7D1_BzTB#);J&S3YZAvNx%jPui?M{ACuNhQ4TMD9#;p}7)n$_005LJ OlQm5>2Hs2n0001UI>&eb delta 12111 zcmZ9SV{o7itf*_-?bfz!+ve8VZriQhx3+EDwzsynwr%r#=iGlclbKBNB>$tA4A7el z&^mKiq#8#;t+(^Zd3iAqkYnmbCs-47fWcy7j9JbsZ|VF|i)61|V&W&kFnE7=zOl+c zSaYB?;R%f?*8MLMFwH~}b1dEdC>}l|5H65XdW{&WViqBg6X=01s1rASe(p%Czp6T_ zx>xM(f^-;K|8^_{m8Xr=HO9Uq{>KSqoJM7!%Q9%*7A0Mbl5J$LfCPh0+Q&14lDcmJp-N#cHQhZ}Us;`4$?&d} z*R3~)_pzyt&AP@HN~a?@ke0SC43OcSrCP;oNy_mrO}}~9zw^OPzM>lbwoxW_uf6vuwxt(lrEQaG8RTBt^^vj@%AbfRUi-B`AQ(^RjTW8Dl~~7?z?t6V_f_16QHA*&pTve z^UN{ubmm6ku=PD-w|-R*A7W5~Iab2D{LdKXpyX7smIj$SwKU4|3BAGY;+}34z1`;P z$czt-goRMh;ZtR-uH6Ow@ow@0!`-iw)~yhLVNNRw2e=;;4r7NMLGHiiKW!f< zQ0Txt(q(ATYOH{sTAJMft}A#q%}WM8hqNA>hSA z07ihu)seH|MEZBTb@4+oVGSfUkVn#_4i)#&cqDt;&bjB`m|4d6s^FV;8t%|n?T|L$_dZm_l z!kw&1H-VT`CRdv{PbqxMSamQQNFGyP?7Asq-wi|ZlJ>yX^sP`W7L%F0&18<0_(aSI zSG02L43guF1OJ-HNJ1=N>gOZFRLkh33dLwD1AY_9BQlQ*o=R#doDz2U7MJ^Eq~Oxp z;)^>&&25AWDW0n82bo9%$&EyG1`A=Dkr+uLjS2lK^+4Q>o?9;cd`HJ&h?F z(Q^4cYJxaCZrx%PY!iR_PL-@KGBI!(0IWMBK37O5dS%1sa*eE5p!N8SV#}hGO*zv5LS!Ii{mUW9#hrsd?l? zdQ63M)y3CsC&VWkQup?P7wOLe*wdco(BDdlxMXA)r$=!-@nxo9v)%VzJ5eh8rpRvC ziOOWyIF>hEPyn&UF6)~tv z;TB)k!+!-%#ISShwGnE^o-)vtF1E*;ZR}+J{nuDhN}+zt#yn%;LZe4|RqG8(N5W-- zU$!QSTTgSg#w-?th4sV+Lt9&}H&Cchsbe|g#Xv>!@h&Z;JjR*^qiqab*ZI!XlgRqE zoW8-c0Whk_&B)U^?ZA8ps(SPZT2FCHWTMoWUUMdxZK9I-;gyg*8jE!uAPsmqFsGP$u>NP9(opKAEJ{3E8~C(*11pXdcW zs()D&<0R%<#DU^M#%?<27oKH2T+<}M4^;T!1k}9te=5J!MiV~I7jDw|uWewPrD@h~ zZ#JKO+AdVNy&F{8%_>&*h_oV_M%vlhJ+!u;6P7%oTa?uQ!j@zTayNDd$E#Z=u^5P@ zSBvy{hv}9$9N^3tTvLs%-}Y=ZhE4Ew1Z7 zGCQlYUmtX6X-OrLOa2~91ryk1rZlfNa-LrjtW~=yG#YMip4l(+9Su(}ElIY@xp5vZ z?0$xuLuV*n8DhB3udTB1W)5q1FWb*~0PWZsx>Qn zOj}w-2J|!|pVo$viV=j%H3xbMiQXswKy}recwm1ueX`ZB?azr)_fo;z``*ZFXXI9nQiId|e37Hm=VUi>!yXKnA+;E4id zIiK62yIG}ssc6Ghd7f>@hhBsSC+oZZ``Wp&$JXB7KHMHh%&63apsqX3q+?b8C`4TJ zqO5EE@^PJD?P|GtQz0&F(?Ivy7I1bw_uIFv+~iu{++4yis|Xpx6umS1X4Z*&UVBq@c;&Ey|>~PDT6>AA?uP8+5)25wFf$pH4K=5*W zc>BVH+;dpXNIwJgFM|34)yXgBUy@VmM-~Cq)ZOQYkUNrPKvh}uKc?Sj!D5g~n z=kZI1Xn%Ih>XmKl*-;GWlj{1fK*BRyzq!TDjgK%B}|?`K@-{yH_C$qRXLJ422}&JjxB56nkxWm}ymLBU zHvZlg2srm3iz8=gDIZM`B|SRU{P?BUX6IL%3G2X=$c~jX@KP1dNO2Wh+P&16{etS# z{50h$$P(WCaqe}e30%P*qkpM~hd$b*>67|1JY>}WGfyHIgYwKngBPN^9fXlrbY{6= zne~=qAu|1O>MZ>(!id0$yL>vHeIrpcZXE{k+b$RxKkeTt~?>{xmc+M^RHhs5ItAqQ3- zVxnNdS;r0W1~7bcpkaKOklRT(qK~4WyAxyiHw9LsoC~ps5Cfjf6n~_DmLoQ+X9C(9 zVx)!*#zTar{E1NL5*dn+KwR8Y5Vzj`W6-0=jY1_F7_SJEn+A6~@m!vF@7^Yd;_)kDP(f^CE#jpN!c-&c1!s!1Z^j5Lvs&zE^b~_Y~Biv{xiF+Vs z&X;VnxV3>{GJ5xq)w1{;lNBFB~@Xk>_JCMi-KFTj>6UVr2SP`cw( z09if8cHWqyC=un<(ansdLcf?;vP6eoZbT7qPL|Jmh^cZ0NJlAT)kh$TYD+th zD9|&eys)~ql00fq!4rD;Gwb7ChYnvIU^L(qIx_fS(Uof!x_Pnh{bmWaAWv2#4?5(E|@GwmZA3+1K)ba zs*tnd)Q2odhN*j*P@tMafkJ3^Tg(|h=t5Y-8ji1)9$lOBROIvBHL3&!%ppZ!7%yaJ zjcQcy!%9Km#9_Qk?tx0S*qYN`_?i6!WN34TP~vo|XdAkRj`bl3J$*0!_zvPsV#Vz~ z*;6e|iw%d4KD<|RP2D4_DCc^s^OiW^ilpep?aDm9fFglvR@Z3duO*FUMEkonFH<6+ z2)%>Vd&#cOj5?Op=W77IT81hRZXJ9<*{GmKi)x8r?&bde*E~&%Xoe622Evv7!||8n zILAOz3~;)VtQ|fs7`I;NNNMVj5yG2tMuT?*UP^a{&6h3%JI7@!2yTcnbf*Vl;CZ#l zVt3M~xYP8?JaPwiLw!{nMF{ULj&o;II&Wg*M6*vQI_%&VaL~RRzhezp+Z7pNd+4&i zg0hUYrDKFUtYR12U)(<+jxzz6Fot=|-rT4f!DLuT&YcHg5>7!)<>-V1vz$kOk$W*# zYXW+IYJqw8bV}sh#liy%e2sIOr*(KvAgdP92o{W5;|8;3%03${iCh=VI!M) z*&v=v=@^g`o~>bIZO2S5!_yLQzRt?G(H0#3p?y!$#>HQ21RQaI#azQyA)ADTD>Vwn z?U(g%!jLH-xALcvc(j+uIa@->*#%K4HpF7gd*Ib)7K;NRXaW|u{gFk@BZipOJ{93# zMKoNMgwjkUq^roYK?E{wBsww#^6drl^oJlvi+0e4|MsqBu*Zk^H;tx}!c z80u)r z2SNlV)dwt~v=3yW?eV1lvSHq&?h$3(<_2Uat@%aL>t?TU<=4V*G(`udfy%U77!7{) zE!WJF^SL9xj;A)Y){$0&X_2}X;+q76_bFEGw8_C-z=p`mkNq_OJ`xX0jNV{f^97C% z_9zftKeI-HqqaWa&T|i9>ytxXwt@dUFX<;$?zg{a@t|-<&ReDNTdVf%nK^skeYjAI z!g}@#bQMLHvT3Y=Yk!G40d4u*F!M@^9!3Hsh84(A$Bv>Jg3)~%Q&TCXy zFCo}JrD2!0Kpd+%mCiZGlK{vCyj3O7^ut+Tz&6*vdj7^>SdY(8n zi%52bAZp*u<}Qe5)?ww^*@&SkNAf5igh4chOE6o@oS|`a{Mv1>E^LYEg{NUyO&eG3 z2f%hNhrB}Owb~~swb%^zxG>z_25h=H9EdL);P>;c4!(EowMA19#A$gA;Jsi72#Tx_(jolm?&nBj9`jKK^o~m{BL<{2yS(Tb{EKz+ zx<`6Jm2%gPurUG>Ssb!S7Qfx=&JuTq0T`UZ+aE&Ipswg# zW6M&d=O^Q;f?c?{Ps)>@+6TB46Jg^lp5xSHx6(_g7p}A%O-#|6LccBYkKq2y0 zck%XShMQ5Y?@&0IDeJeB1@UjXz2D7m`fH1-O3^1j&viq`(qFi_TEIWRDu^ENVD;~U z=UG5CHmH2SkKlhiu4L~Hmb%YO0tSe%IV>S!tBWcuddfN|=o%JI5OA44P}`bzj-^Pe zjm(M8A7-^XhIowmoXG9I4#9GFhXlQTK`-Zo?{aq184;xKG2txP51yFDehi82m!TRO z9G&IXy=wDu%%$r7B1f>l%P7RdezvLyb&;t~PAPx2ux{Dk6L3ZfJ0&kl1OlyWupY>a z?0{&A3NC4;`@bRg%~A_L;pO>#qnAiJvmm%1Eyryos#{6r)hy_2j~sJw`w9v?<=D)u zL+GdCig6p*#Yov8m|7>af9{p)zZOb&Jvw8?B{?a2D(BBQO;rvgho1}Mi;BNi;hkB! zp#|kNj`t%h5X0&!mzIHN0YsN>*l%T$x*V@Q25OHx{Gl?K7AmQ`)?4%tW4knls$FO? z#@$%ar6phs&6s3F#`t&Nbag10Z60v9RMAIrHeK%7cO8tJT}9~`{&BDsT2_@kuHeu`aZAdFgi@&l0Iledg&)qIyXLS{FMcf&ui@&jYx zwLe$fh0`aGVF>E9!H>zGM0K2Krj;3y)@CK*BGGN4zDK^cZs;9S1sJL{jFIrhJ1`! z`io8htAhkYv6Mi#bCYplaP?F~Ay_0yQv1067GV|=otfZd6XV1X-*wCxgXHxFbS?pr z2dQ4ooN_2302da9LNZ_v_Q9!pAe!ZFT zrU`fCcBI*&2AFyvla&x2#fFqwgq^R}C^4JHW$o*%m1Na%lQ;J+h_00{Q8n>H<*6n|rt9h6)iV7dDd5yH zxf>h?q|T6;1L8k69c`J@j=5&-ec)kmKQRl6-N`zO%8pIg-=K zUbjj2R$~=$nH}7i?NSH0Uv6CU!YTogIqXVMg)k3eJUrjIrf3|pU$RL9GNW04)Sa%NP0#^)-kYw)^6Vew=9p)Dd#u(ia?77?T zbw-O~W62f4%AC5^E~OLEta(#En?q99ORc}X<#m(C=SitSuX0+n#k&=NBj{D+FT0Qqcwx(xr zEyapTbePlcOX9-}J&d17Zy8IT20|fNbGU<@6$oV?C#aDe2WZ!2Q7Ns<#REkPced z&A}$<%BS(?&BE%%$UP8eSdDVekMju9%B^&T0jK$o?>xT{HwpGhBRovVS$9vo{y;My zo>0_uva6_6iSZWsCrP8KouviHdbR5sbR2`Cf#nWiPmF(@btUNH*9S8TmV;G%HT4Xs82c{VCGEPn<%^CaXe@wUwYd~>b5Uw zEiY_3yzGH+MyT=A2J|;WJYD=%WmS9WlMHOT1k)?M(xRN&uiM&V(3{**QCtcp2x%Xsnkh@jHGFv-Ty zaL&KBi{*}!FgTJ`)AcX9;jLZ9V)&_3QQ=3m_kmbqQlcs!gU?0d#2D5-FyX)s4j}v% z{E^i(5@Npk`-gzny)7;)1Dp-Ux}-|tMBJ%-9xsjZf0os(10j7HZ&E)*UQSduM7}ga zmr<+)6NE{uWcvTuf8Kv-P0A@G3+AKFgbWP-(ZI|||NqMVL+#A}7soLCe`$#@=~(z* zNx;b>I&xt|bf(Mxw6Yf123S(?zzIz*2tp1e*MGCPED{#LkvSGwq!VwZgx~?)B&vwh zb_;IG9+P+!0h#6)VYc9ewJ@eb@RF`oirUTI zoqIdaxAEPLoM^f&$y&@GN8PUW>uRPa{j~C;a}zB&x`x2V9MlC4F*{wZf(DaGohg?_a^bVFAg)E=uB) z|1~~_;)@d5T%>OmY2&@_V#R!LR4_HSAsl9@7UrC9HBxLC>%06A{JDjRQP$jTK zQZ&1{Q@jI=$>t>V6#YF|c!t;fZmg1xgSA7M;f5S~dsj8|pOf!&y-xc)<$A@3M4SBZ z5MPJ7T-CtB-pFEnnM z`g0{sPs0ICuI=17zJufy&mjQ%eE4^ED26ku><-|^aJ>ZSC>+@x+JhV{l>Elb`S1;S z^4>18O!pWT?(u_r0Mbvd+#Z|@DmE8cZYbHeH3YkB>WL91i!5+TKxKeSoks! ze=;}?YSc3wr0q+de^$a(Nme~1zjyrW7&7fgBs-@gHLtBb);UY}(jgF3!6l*>kA`)< z-vwwcTD8-$M&?bH1^h!D8zvG)W)skr#Jv}k;7$7;8kih=bYw+f82{Q+L$1A#@^zrf zbv*l{zkg3TL(QB)REOCDrc+Ji6|P{Vxrh3b+|}AM(3+$mRuMVP4p9sbRdg%RIOC-( z=J&Q4l9KJC6+QE~I4t|*UGxtO3u!@fMttB>FvCD~;+9vvUgyYZ+oxnk1!bso4CN>b zGSl`fQXNr{?fCa=y~FQ^6XwpPPu$D%iXjTM{{}LFgYQVO=_&kh@a*2W+)l~yFmUo4 zEiycz?S>D?WYpBHqJPP-Mq z?QcHI(<$E!6y%imX){gtWoO@p);71Coc%i0daHzE5_g3lO)p~<;dw&%x;+0nwomgX zSFgx3lfGbza$GhMg?JvioC>EWkPKa^+G2u5R4jp z(kQ}6@>5VKids$*muePUgZ!pJ$C^h>`w=qayVx6XhmE*9^A3|a<}%ixHJ0i*wZ`R0 zF|Kd4TH(6E##%g2Q?4}GQRIT4J}jW`c%3s&DG|XdU6J_I&UpYL0j?@q0v<4Z$PSGM zoBf#+b0wG+^ApWAtL~9kS-q^7wGmUwDWqb&@W2Gk_s@9Ll7SLU`F?1@xEVuV{OBjW z!Io=70V#?MCXU4zb!iTkf22oFI>JbVT+$^_LvXC)EUPGmS#?QbJ}ApB?L* z&s*Q5v!CtPXjGF?@AgAf5+y*!oT-qgYO_n;U?2Tk67{Awqv5kK9_r(|k6>E}8%_qM zL;?+py}2mr)<>Ke-YxUOko@A;(WdnJKcyv=yPScDX6Q9a#YuPWG4j45@Z=18DI+d~ zGHCWmH*twow=^H42w5CkDN?ibZ+%B(c2V~sja-nD8-c#=A>wXl#4kXE{zrB=|JPWb z)!o-RS2_u#4&8)xJQ6uhpuZG!!rK~4%3B|!$6!+gTSN?S!CGRpzoU4|42Pozi>1~& zlxMGuqf$#H(uap>*DrCefgxZdz}S=M6mQ+@*Yj0~p7|SxI+P9Qx>V!O9)C874Y$_t zmNIJv__(=0&1c#OssLDS{*hp!lu14+o8VIFd)W&d^JIK3lfhQxFmVO6$35&cc9#4D z95&OAD6k3XSJ!8mIHRrXI+5MSS`tB2;YTk+o~4CkzTL=`?piX}7Zwxa|Bfz>?k`do zoZ41>p4YNUhOh9(KB#G-JOw2J|813((x3Yzx0|#^ec@wm6oJh$x)a*2R#$(*G3!?k z3(Y8vgLaYHr_n3B42^d7?-e1Ub;GjWQukIdgT#DRoH7eFPAod&yZO#vET|GuTq{1k z&^|hmy}x_4DuVAwR7&mzDQNdf41)-W=f6q2@Z=fL(JqnNX=o_apWn%3!^8LYB{hHf z505v1Q-I68QvqWa4j3hAzEU&yv~Gbq!r5%{RlCdNRC?S(Oz_Rx31zkhBzOHQ?mkQ* zAr@ORNsX(9P>bz7pklUWQMLP~T}MkinxE7M!l9Wx_kke|pbB9xW`DLvrTF1Q#i0#v zGAkyIo`2IzD3?^D)T$E0kOp#Skta3jakXGIWxn^nqytVrJ5!2VOD$WT^wSy8b#;)| zqMT;!K%s--KXB-R&y9Fs>8*Di&0AYLn^(_mml+Z>9bN2&R&2B!Z;yuiAI~Z)R(e}mA*~8hhOH68$(JXsSnqc|6&IB2 zvm93BLmyXpD?^aNH{(FEoEL91pn&K zc6RV)Tw&!F9Gu&Jo)dhYZ%!oBu^2lrT828fVnAD?+<@KM&i$Mh4| zeUbpKk!!X9E-^-KzE>d_E%3J2jX^S^f$n;4^2$!<#M zu_F*6&aWY;XGE(7o$}9PAa0Nh*Xs~c2h?{7Yc~-vGftmr^p?tq2>*%--Tzc)0Q48Sqq_Q~%Y zuR1j-{6)Ye3zsaY9vo^ZJPVPu9MT8|bhq{8U;SlC zxm;{yS@@)H%5x57-ZDgb=SZUCs=3OWSk7#qFM3(qpde3r;IxCaqVHF(0Lc1 zeuSQ#28~o?6t}pM{HmEr7uZeUG~l9P!)5P69DQV!io4R)>H9K^V!0L_g}%tL+qsR} z4RF63PXb5Zhfi5J8UF;7_{YDibKxNuntTATfZ78q`rvA|(7{WBkg4QP0?yW*wAB5WIlma1x15mBn#~O!%|$X-m*{B#~3kEz;!0+8I(_S4w6mz zChXyx$y?I!a@Sk2mrrs2<3VLndhwU~S>-+ykG(Ib&y!P3U81?*>5wgT$KZ2NTXM6I zw4AIKrjW%VT~hKd0v3_uNp;P)PX7vREk`^Giu13m!a_~@AM$+rg7_};e+J>QI|^}I z{TNk|oOsjd)6Pl-0I^ND4vi(W2g)%zvqGIJk5wf_c;CgLCYD|mdza?nkMY^VkWyDt z?L-$H@{kbuA9_QI8BKQxp>P-(d3pHnCg%L7h_*yai=nr?y3Li02wTvFBv>ETA7@lT zH~N-0aBQfCABz~hqe{*XX8}C&lEVUoDffvY!Z(l41;N#~z>rncM~VKY%+e*5;-`ArWcpDu$`zlLB;-%qFN)mmtj4t*2qy{_OExBswSQ zs*h`|sPlCO(4>1nF!6i^5gL>;7~fw2_Sb7b3A@j0SU}tAF~2KW_Xnbb9L0yDOW*3@ z!Ejy7bRJZ@u(Rq& zrc|-}1L1~K1M+MERqW1)6PA?%t{f1j`?zu(zANuAfCnB(%nM$O$5B-M#@>{0h#hi^ za8sE@QuLpi?L7@lX+*4TRK+O5BSALS1Pq*br3_k(2$bQHOHPL62V50>vD{ij{FP?% zbIMup8fR#ev-}GPduY?%KW`Gt8zf(RO@=i5$yuX%>%{L=@2IK&R=ruWGUj>xnlJuD zwZ)a117PC~Gy$)I{ZZua#A?_672Y9Al$(PxdM7+CC)sJt?P*)k^T>DyX?Qt*S;kp# zIdrx40=Gy4Y{a+34|qdnl;zongwH82mk}S5yG2<7(|)6bw}pYliA(v}PawaW-rFP` zzJkjn`x z_>Y|~U6yvxjk1WEiII}yafBhb=0?@T9$Y~kAp8U&ON+~{fU0CX0l$av*N*?(%taWL z>;!%5(2MMdCIw4F(S9DzMqu#m(PP4R1PS1~tWTYd+J_RSS1JGZ5}bbvAxMHl5BB$A z4yYB{qk$l{#(yC~0JRL!P8`Jy=Ah0=!6T4?4}6+PV0Sq~7m`^Ko_vgtb_@VhsT7Ss zb)z02m)#S;ple($4|azSE_~wwOD;~*SvH%=u_6CH1`r~KU8lq8^6x8_p{Q4aDYu-9y5G-LpWWLp z=eyq9L#NW^Ayn@`;jL`p1Hrjm7oPh!&y@)iX%`ZzDK<={5nCFXJEU~Sc$HUZk=2He zjCJ12S_r}+m6fAI8V73`o5h&t<~i_m+b+rb4YDH!4|Wl{75bd3L-=RAXdTs$K)(e8 zt10s!UU{}_BvxoV76*Q}T>JPR-bMtfb()_;)hf1%Xz<_ZC8mO(wVbdXG4NkWj;Zxt z7mBZrKW3%}E!>G68n;%XB6Us&rCD=+QX32n^2S!2rELaCkfljj+r>=VR7}91n2@Q5 zl7B}HbJj{zjV0`m^yut+H_;i9!bMSm{vhuP`ThbDx8zm+zhC)80R;}IC3%ql configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + }, { "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." - + }, { "title": "Step C. Validate connection", @@ -792,13 +792,13 @@ "instructionSteps": [ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + }, { "title": "Step B. Forward Common Event Format (CEF) logs to Syslog agent", "description": "Set your security solution to send Syslog messages in CEF format to the proxy machine. Make sure you to send the logs to port 514 TCP on the machine's IP address." - + }, { "title": "Step C. Validate connection", @@ -898,6 +898,10 @@ { "contentId": "ForcepointNgfw", "kind": "DataConnector" + }, + { + "contentId": "ForcepointNgfwAma", + "kind": "DataConnector" } ] } From 61a52b2fd34cc08df0c7e75aa4e127625633b889 Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Wed, 30 Aug 2023 17:25:35 +0530 Subject: [PATCH 3/5] Updated CreateUiDefinition --- Solutions/Forcepoint NGFW/Package/3.0.0.zip | Bin 19832 -> 19778 bytes .../Package/createUiDefinition.json | 7 ------- 2 files changed, 7 deletions(-) diff --git a/Solutions/Forcepoint NGFW/Package/3.0.0.zip b/Solutions/Forcepoint NGFW/Package/3.0.0.zip index 44d739c69ea5dd1480b338ac8976746b50c6f9f3..a822966ea32838e950ad1041bcc2b416d618bb17 100644 GIT binary patch delta 2140 zcmV-i2&4D-ngPO^0T@tA0|XQR000O82#X$9*lJcJ@CX0^+Z~Y@9e>SO>uwvl75-nK z??9+6ED6%cc3ZSCnk`g2aTl<&i^RM6VHp86LycH-hO;EciZ^RupQVr1C+T-Mca7xO z-K1^c7#{NQ@SN}5`SI7kVr=kR8?Hsd2PbT>b}q9gvstkcBs}G@NJQ!a{$p-L5bC7d zv$MnCC^(*GM%+oUnSY%c!JYW->oc*EsdQ4O!DX(T{5}c(VRibO!NlLS=4qsap}Q_+ zXtdQU7tB5H7Kf7fP8bVDMBKTo+|Ib+iEtnS#YbAgVyM%VjGF~4N&8Oz$W4UB6<1bF z>YXLGGPG@CEJnhHMrN+O`7bhwnKj{yMU9T(n;@2MoiB4M41aEPgb-olH7R~i-(pdw zLd^gcgq&UISleRneYF?ZyLd5R8yUGZF8I?Qvk&-O3mLCn{r%MSQ7Um;<mSi z6?Rs+0e{AZVc!TC2Lb~$+&}A~^&gz@nx9&U06?~am96Q@oVPdIB z7PrqhIz;y-NBww&TZe_W!Xw0RcNu!h6_wCIoA9RjcxXeWbm3|}xX^QQ$`;!j)ZWS{ z625KxyNt-WD<%`R5iAx+pRTBSK7Sv;r+FQOH547`9y&@5d?i+*YGwC`UK#Y<=sfGm z@7su%AEeJ}*mWjvGphb9|EL%@&2sG;?XEdR*plAR@nT*lzm5;O`%H8j|JtpCxk=`k zM2tD3Rri$E>PnIp1D~f?Qc=rK*{E?Iz{wr*0d%6AP2j#MF<>49X3=?uNH01a-bjp* ztQ!66*bg9Ps6-mO^{@lta1@Y+qsiguX3&ND2eh4Tmy@hDjU0pXmy_BB8a!WlCa2}d z^aA<$aC-RX>EY1<1m0!cTBKc8+&s~MrzlRC^v;aV&d`H*s1;udMdZ7^AyZgcYZVpK z;9HY01}OpWlUfEH3RhH+X-2U_r!T;hfd+yBZ<7QEB7dH~d_~llANLJ}0h_Pjllxv0 zCaidAp{C#WVt(K&8uBfvkg1#Zi8z-LPebYuS8G53ej(m zzqGCBl3g2Z&+T<}rH}-RhpdSAULWJRNsVSnD5|0n7e9s@kap z`GSGp0Pn-`3j_bWkpDbE?Q(ki;%ZtxgH7q>!GDMN^FsSsa2`D!$+wiwblN*m1JbTZ zd!AC+kgC4{(PQ4JfoO?Mt@-Q=#CnPsD9`D>>hIbzw;38`!X6pDHjVQ z)PGn|msGu*Lv1TUdb;-n^;>Q03|hpP61EkFCP|bFuH5>U`&aYP zv=YT1^?-neD9gJ;S2KoATaPh=Ys8Or!~byh0(!$=Fn>)j6LDp$6MlfIuHQ5_Zw+dG z*s65s3|fPZX4S{AL(+`IM6=_zYQp!J;sh6d{tdHR36Db#2#X$9*lJcJ@CX0^+Z~hm SOjQ9TlTJ+}2B=H`00020Js~y# delta 2221 zcmV;e2vYaLngRHl0T@tA0|XQR000O8?f>uwvl75-nK z??9+6ED6%cc3ZSCnl02gaTl<&i`ctCVHp86LycH-hEtMb#hV)Fv-HvWB>fKOu8|zO zo8(7>#PE=Zhv$6f&V2mkFBlvA+JlxR&Hn9@I*Kef#M@AVKLO{O2*9smZW_rf8r*>;)*LP zCiTveTN&CmF%~0XLnAX+-ux$-#LSxT#iB;X@J$d)x6YTj6@LadIzouB@tPDrrdtdDZ_AXuw*hWTfjSK$p`|JZg*Fwf?SAT!ANEhjN{6;%*G9I(< zmEcw|BUZvNrf!F0|dRqBBBNdR~^y?CiBRp~$pM-EWQ$-<-XEH!InD?m-fb8fmW9 z0%9lp9vZOg+f;8-CauleQt(^2q@CIF)=FyYsSDx}%Y<E>nD&QOLPU1r7i0nq@4zt8 z$S&HDc|)G@QYz2#9at>2z9k*4jKmHty=4Il*x=4cz*7`%T_hqqXdlg)T2V8<#!q{sw?AubAl z**vDC#?A#dX#rOOQ*-GjPqS+Z>INo7yn>|8`xF`;mpY_prIyoBtfoBSBZ8+fBl%eZ z{D0vk)#ZTal;C+;!80BQ1+>Tepgk8c5AO>R31jxPKvu=YT|(}0E>rw>SFb3=@6`C) zB0m+5s8>C4O0Q{<2r5k*tq{1@i?TxowpkKEwB&FDd!y|CkI#&qXRQU{ECR3c+_GreN)E?Ype3T=t@F4`=nw?OXR9bPpY+2EGz2QMIyrM6V2bW^|tQ zeoG|H~ z8l9b@2k%fTz7&eccY8youm`f%Dk`SIOOr1KDFGjoSq2>nH&l>mMzKSu&%u*`27&=E zlLH4Lf4+S6ny4{9?i&aLHebOf_q`-cSn<+AO~3EO{J>W<Q*E_np@97jqdoP!)G2J6uaNIjgt@`UOAWl| z2ps+Rv16pKli~l1EvFFu_V`QNk}lb`(au7>e-6DAl3?+W6}h|DlX@;N;Gp%`N)H83 zn~I6^wBo$Y_@TSd1-tpE+ucuh0KKldThsg7Xk^Yyif-k^42h}gHCm$k!@BkpP8 z2N?#s?zvN)w)^8wA?jxT-4Z@G@7I!j{VdYY_?0k2JEG~Fo+$idV9fnHMbQx!`J7O7 ze_mN<=m9_#t&We>=cjrs`?tkvrxN4~27Uv)563SI{PRNo^8~fa=^c}+Y5Al%r8MqC z{CT1MEI5yzj^rh!GoAJh)PS@L)ShQ?Hl)%u>hahYhV*Bb5qfIu3`bA;e9!R59`TNX zZ5f(pG{aY+Mo;yXrmg32{~Aqk^7Q{cf2c!hJ9OyJ!}ikF!cF`0dH(Q>V)_~Vfz6{k zY8;~a&Hl4{$nLh!lYVIr;l9VF#{|m70tq!1)FoB_2LiQi*~R&Gi)YQVX4|!%?ma>M z?%q0sc0Z Date: Wed, 30 Aug 2023 17:43:45 +0530 Subject: [PATCH 4/5] Update WorkbooksMetadata.json --- .../V2/WorkbookMetadata/WorkbooksMetadata.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json index 7aa0a41d803..be033dd83cb 100644 --- a/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json +++ b/Tools/Create-Azure-Sentinel-Solution/V2/WorkbookMetadata/WorkbooksMetadata.json @@ -33,7 +33,8 @@ ], "dataConnectorsDependencies": [ "ForcepointNgfw", - "ThreatIntelligence" + "ThreatIntelligence", + "ForcepointNgfwAma" ], "previewImagesFileNames": [ "ForcepointNGFWAdvancedWhite.png", From d1ad77959b8cefeeb34ac18d6725455e0db19b19 Mon Sep 17 00:00:00 2001 From: v-rusraut Date: Thu, 31 Aug 2023 17:09:30 +0530 Subject: [PATCH 5/5] update CreateUi and Release Notes --- .../Data/Solution_ForcepointNGFW.json | 2 +- Solutions/Forcepoint NGFW/Package/3.0.0.zip | Bin 19778 -> 19778 bytes .../Package/createUiDefinition.json | 2 +- Solutions/Forcepoint NGFW/ReleaseNotes.md | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json index 8176cbbeb84..c03b5be93d7 100644 --- a/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json +++ b/Solutions/Forcepoint NGFW/Data/Solution_ForcepointNGFW.json @@ -2,7 +2,7 @@ "Name": "Forcepoint NGFW", "Author": "Forcepoint", "Logo": "", - "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\r\n1. **Forcepoint NGFW via AMA** -This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Forcepoint NGFW via Legacy Agent** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends Installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31.2024,** and thus should only be installed where AMA is not supported.Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Description": "The [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\r\n1. **Forcepoint NGFW via AMA** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Forcepoint NGFW via Legacy Agent** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", "Data Connectors": [ "Solutions/Forcepoint NGFW/Data Connectors/FORCEPOINT_NGFW.json", "Solutions/Forcepoint NGFW/Data Connectors/template_FORCEPOINT_NGFWAMA.json" diff --git a/Solutions/Forcepoint NGFW/Package/3.0.0.zip b/Solutions/Forcepoint NGFW/Package/3.0.0.zip index a822966ea32838e950ad1041bcc2b416d618bb17..4de8333bdd95adfc003313ff9704c908d9c85e7e 100644 GIT binary patch delta 1601 zcmV-H2EO^ingPO^0T)n90|XQR000O8_J|)>Y1?;{@CX0^-mw=f1Ao)P5FRY#nN)<( z9r;0Jq$GY~VI5(y-_-CH!;pK}Jmu;h?qWSqHshgyA*&3LA{7*txGWH6^O&+4yAa%@ z1zrVC&843_&8{h`8=MsJ3X(eUQ*3x(>X@FDT24c;n(~B?2%pA|F2Rvs4 z&uInEcpMbi9`D2ULVv_Oye~xjuY#|qO7A7gll*NqCCZa z$W3swD9;o!o`--=AeS0mnFwp4w(z=kbU*HWBAw=T+Xvxy(?n9ti&1Hqu8Uc+(eVUm z)H%nm5bbp@VESpOSJJ!y)%_#(6YF!S%j)BY>!OJCGa5`ke^N-`u`+-$AavMvg|8V`rNxP%PES;`SLwljz>$ zC?St<>#*=vc!U@ZFGEkcqAEIQ6W%l*4{gYlE?lh#7urrv`C@y6I$Rk=!gr2;mk~L4 z#bm-Zg2e&})D?x#X9V~(ufwp0q9ffyN2!4?#!6J(?0+87D}$aJoo7AyeJAnqgYYmbC zT}jen;4}3~D(d{S*ODrsWFmOuYVo;8N>{g zNMpAic7H$|jsntfG&vmI47yPNfX>tHa+0;Csbg^d@~Z2Zm|fi3--!F+9>aEU;vyMM z4qDOh)ByS`&*Ze6nqDA5A5IVdJUu)*fWW(~TZ^>Iikl}I@D$|^_CYzxG|zJVSgi)Vv6kUYfpW;H#BjmoBFktf)d~)Ao!h{u%Eq~PZ`(Dh?d__yXB^5Gt^F$HnGU91SEg~!W zhekDek_ZM}93I-A-D3DOTTLPQ?eUkk6C4 ze_m)m3(ljbBl(unnNE8LYCzgGX@AdaDjQO@8ufVW3q$(1%LqL+c7~%TeZFV-V~==8 z!L|&|bDI0AP@@;#O4HUWs(-|!IC=W3a~)FKp+o;3wwJaRZrY#E^M_{?)6eJ+Y#!ZF z;}F$Py`SAfj{kQa!hK&x11RNUfrJ_h>XNFbbEs`ah12b|8oCoKAKjd_@f>W&=6&Lcj#)y&}r*2W^j%8v2OSu&R#%o z_zUK*31%X$Y<0p9P}TLD=H{(I%@13Z4xK@3(9x{=7C2Lb~$+&VLXT!P?#0H(6P^>}A~^&gz@nx9&U06?~am96Q@oVPdIB7PrqhIz;y- zNBww&TZe_W!Xw0RcNu!h6_wCIoA9RjcxXeWbm3|}xX^QQ$`;!j)ZWS{625KxyNt-W zD<%`R5iAx+pRTBSJ|DoRc^!l`6dmavI!XPnIp1D~f?Qc=rK*{E?Iz{wr*0d%6AP2j#MF<>49X3=?uNID(fNQ{xJ8vX0o4jyGuzv&Ma1@Y+qsiguX3&ND2eh4Tmy@hDjU0pXmsefS#NguA{zlvn_ZYT=6Bo&7 za?px~rv}hpc_ydj$n*mF`EYvp=jq|m0R-M<-CCqwR@^+%fTt)L# z3Pt3*y&+RrS!)#))8JcgAI909tGB!$!i^El2!9)?6jNk(UwZ1(EswCzbP0>9f~snJ zHuZrcqVKta$-My+o(&6!92Vg*Jm?0%!6>*R@(C;HM(o8`RFG*#u|uaXz|oX@u>5Gk zsI+1ujn1HPqmR@x5aZzBt7@RBy2NOnQ{?vpWEC!Rsz)P}w_u&AnZ?^oD ze199mNz~5~ZN!?C)Fvt&?WW2e7!9*eCJ)N0b+cl3d(&1i?hq{%kHnR9UYbWKVS1`t zy-K&8(05CAG+d|ZM0Zzu(~y(2m+s%Ed05Iee~a`<{MDLbp8joWHkX>R;v zzv>U3zI;X0m>>5IgaMnc;FJ4a5+JVAc zKQyY*dqgnk;_%S^>=whP*=h>WZ;!vUt>}_n8*R_+b#b$bf(9o!g^5`S=`RM`6{ynPNsRa3gf!_e{!|@9P|Gbd@JVEVpdi&yPT0VnK>E*$P z`13;hS#Tab9m%(p&UD&4Py^DgNq>8uQrVEI)u_i~Ul`KAT}J4su`?V!>GM6qAA7_* z3btivp3~e{g&IBYR+_e+Q2h%g#mUp3oa>O<4juaUu)VakaMS*Lo\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\r\n1. **Forcepoint NGFW via AMA** -This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Forcepoint NGFW via Legacy Agent** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends Installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31.2024,** and thus should only be installed where AMA is not supported.Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Forcepoint%20NGFW/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Forcepoint NGFW (Next Generation Firewall)](https://www.forcepoint.com/product/ngfw-next-generation-firewall) Solution for Microsoft Sentinel allows you to automatically export user defined Forcepoint NGFW logs into Microsoft Sentinel in real-time. This enriches visibility into user activities recorded by NGFW, enables further correlation with data from Azure workloads and other feeds, and improves monitoring capability with Workbooks inside Microsoft Sentinel.\n\nFor more details about this solution refer to [integration documentation](https://forcepoint.github.io/docs/ngfw_and_azure_sentinel/) \n\r\n1. **Forcepoint NGFW via AMA** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Forcepoint NGFW via Legacy Agent** - This data connector helps in ingesting Forcepoint NGFW logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Forcepoint NGFW via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Workbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Forcepoint NGFW/ReleaseNotes.md b/Solutions/Forcepoint NGFW/ReleaseNotes.md index 8ca2f13a34f..3e5d67f8189 100644 --- a/Solutions/Forcepoint NGFW/ReleaseNotes.md +++ b/Solutions/Forcepoint NGFW/ReleaseNotes.md @@ -1,5 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| -| 3.0.0 | 29-08-2023 | Addition of new Forcepoint NGFW AMA **Data Connector ** | | +| 3.0.0 | 29-08-2023 | Addition of new Forcepoint NGFW AMA **Data Connector** | |