From 511cfc79ec5c099b52d3d7f6d483bbf739ebe388 Mon Sep 17 00:00:00 2001 From: v-sabiraj <94349919+v-sabiraj@users.noreply.github.com> Date: Tue, 25 Aug 2026 16:28:58 +0530 Subject: [PATCH 1/5] Add Web Session summarization playbook Deploy an hourly managed-identity playbook that summarizes Web Session data into custom Log Analytics tables through a data collection endpoint and rule. --- .../azuredeploy.json | 780 ++++++++++++++++++ 1 file changed, 780 insertions(+) create mode 100644 Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json new file mode 100644 index 00000000000..d482bc373eb --- /dev/null +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json @@ -0,0 +1,780 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Summarize Web Session Data", + "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfo_CL, WebSession_Summarized_SrcIP_CL, WebSession_Summarized_DstIP_CL and WebSession_Summarized_ThreatInfo_CL.", + "prerequisites": [], + "postDeployment": [ + "Authorize the 'Azure Monitor Logs' API connection. Log ingestion uses the playbook's managed identity." + ], + "prerequisitesDeployTemplateFile": [], + "entities": [], + "tags": ["Networking"], + "support": { + "tier": "Microsoft" + }, + "author": { + "name": "Microsoft" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "SummarizeWebSessionData", + "type": "string" + }, + "logAnalyticsName": { + "type": "string", + "metadata": { + "description": "Enter value for logAnalyticsName" + } + }, + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Enter value for resourceGroupName" + } + }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Enter value for subscriptionId" + } + } + }, + "variables": { + "AzuremonitorlogsConnectionName": "[concat('Azuremonitorlogs-', parameters('PlaybookName'))]", + "suffix": "[uniqueString(resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName')))]", + "DCEName": "[concat('web-session-summarization-dce-', variables('suffix'))]", + "DCRName": "[concat('web-session-summarization-dcr-', variables('suffix'))]", + "workspaceResourceId": "[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]", + "destinationName": "[concat('webSessionSummarizationDestination', variables('suffix'))]", + "monitoringMetricsPublisherRoleId": "3913510d-42f4-4e42-8a64-420c390055eb", + "roleAssignmentName": "[guid(resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName')), resourceId('Microsoft.Logic/workflows', parameters('PlaybookName')), variables('monitoringMetricsPublisherRoleId'))]" + }, + "resources": [ + { + "type": "Microsoft.Insights/dataCollectionEndpoints", + "apiVersion": "2022-06-01", + "name": "[variables('DCEName')]", + "location": "[resourceGroup().location]", + "kind": "Linux", + "properties": { + "description": "Data collection endpoint for Web Session Essentials summarized logs", + "networkAcls": { "publicNetworkAccess": "Enabled" } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_DstIP_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_DstIP_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "DstIpAddr_s", "type": "string" }, { "name": "SrcIPIsPrivate_b", "type": "boolean" }, { "name": "DstPortNumber_d", "type": "real" }, { "name": "DestDomain_s", "type": "string" }, { "name": "DstHostname_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcInfo_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_SrcInfo_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "HttpUserAgent_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "UrlCategory_s", "type": "string" }, { "name": "NetworkApplicationProtocol_s", "type": "string" }, { "name": "HttpRequestMethod_s", "type": "string" }, { "name": "HttpContentType_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventVendor_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcIP_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_SrcIP_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "SrcUsername_s", "type": "string" }, { "name": "SrcIpAddr_s", "type": "string" }, { "name": "SrcHostname_s", "type": "string" }, { "name": "DstIPIsPrivate_b", "type": "boolean" }, { "name": "DestDomain_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_ThreatInfo_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_ThreatInfo_CL", "columns": [ { "name": "EventCount_d", "type": "real" }, { "name": "ThreatName_s", "type": "string" }, { "name": "ThreatCategory_s", "type": "string" }, { "name": "ThreatRiskLevel_d", "type": "real" }, { "name": "ThreatOriginalConfidence_d", "type": "real" }, { "name": "EventSeverity_s", "type": "string" }, { "name": "ThreatField_s", "type": "string" }, { "name": "SrcIpAddr_s", "type": "string" }, { "name": "SrcUsername_s", "type": "string" }, { "name": "DestDomain_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "DstIpAddr_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + }, + { + "type": "Microsoft.Insights/dataCollectionRules", + "apiVersion": "2022-06-01", + "name": "[variables('DCRName')]", + "location": "[resourceGroup().location]", + "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_DstIP_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcInfo_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcIP_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_ThreatInfo_CL')]" ], + "properties": { + "dataCollectionEndpointId": "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", + "streamDeclarations": { + "Custom-WebSession_Summarized_DstIP": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "DstIpAddr", "type": "string" }, { "name": "SrcIPIsPrivate", "type": "boolean" }, { "name": "DstPortNumber", "type": "real" }, { "name": "DestDomain", "type": "string" }, { "name": "DstHostname", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, + "Custom-WebSession_Summarized_SrcInfo": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "HttpUserAgent", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "UrlCategory", "type": "string" }, { "name": "NetworkApplicationProtocol", "type": "string" }, { "name": "HttpRequestMethod", "type": "string" }, { "name": "HttpContentType", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventVendor", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, + "Custom-WebSession_Summarized_SrcIP": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "SrcUsername", "type": "string" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcHostname", "type": "string" }, { "name": "DstIPIsPrivate", "type": "boolean" }, { "name": "DestDomain", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, + "Custom-WebSession_Summarized_ThreatInfo": { "columns": [ { "name": "EventCount", "type": "real" }, { "name": "ThreatName", "type": "string" }, { "name": "ThreatCategory", "type": "string" }, { "name": "ThreatRiskLevel", "type": "real" }, { "name": "ThreatOriginalConfidence", "type": "real" }, { "name": "EventSeverity", "type": "string" }, { "name": "ThreatField", "type": "string" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcUsername", "type": "string" }, { "name": "DestDomain", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "DstIpAddr", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] } + }, + "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "[variables('destinationName')]" } ] }, + "dataFlows": [ + { "streams": [ "Custom-WebSession_Summarized_DstIP" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), DstIpAddr_s=tostring(DstIpAddr), SrcIPIsPrivate_b=tobool(SrcIPIsPrivate), DstPortNumber_d=toreal(DstPortNumber), DestDomain_s=tostring(DestDomain), DstHostname_s=tostring(DstHostname), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_DstIP_CL" }, + { "streams": [ "Custom-WebSession_Summarized_SrcInfo" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), HttpUserAgent_s=tostring(HttpUserAgent), EventResultDetails_s=tostring(EventResultDetails), EventResult_s=tostring(EventResult), UrlCategory_s=tostring(UrlCategory), NetworkApplicationProtocol_s=tostring(NetworkApplicationProtocol), HttpRequestMethod_s=tostring(HttpRequestMethod), HttpContentType_s=tostring(HttpContentType), EventProduct_s=tostring(EventProduct), EventVendor_s=tostring(EventVendor), EventType_s=tostring(EventType), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_SrcInfo_CL" }, + { "streams": [ "Custom-WebSession_Summarized_SrcIP" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), SrcUsername_s=tostring(SrcUsername), SrcIpAddr_s=tostring(SrcIpAddr), SrcHostname_s=tostring(SrcHostname), DstIPIsPrivate_b=tobool(DstIPIsPrivate), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_SrcIP_CL" }, + { "streams": [ "Custom-WebSession_Summarized_ThreatInfo" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project EventCount_d=toreal(EventCount), ThreatName_s=tostring(ThreatName), ThreatCategory_s=tostring(ThreatCategory), ThreatRiskLevel_d=toreal(ThreatRiskLevel), ThreatOriginalConfidence_d=toreal(ThreatOriginalConfidence), EventSeverity_s=tostring(EventSeverity), ThreatField_s=tostring(ThreatField), SrcIpAddr_s=tostring(SrcIpAddr), SrcUsername_s=tostring(SrcUsername), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), DstIpAddr_s=tostring(DstIpAddr), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_ThreatInfo_CL" } + ] + } + }, + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "defaultValue": { + }, + "type": "Object" + }, + "logAnalyticsName": { + "defaultValue": "[parameters('logAnalyticsName')]", + "type": "string" + }, + "resourceGroupName": { + "defaultValue": "[parameters('resourceGroupName')]", + "type": "string" + }, + "subscriptionId": { + "defaultValue": "[parameters('subscriptionId')]", + "type": "string" + }, + "ingestionEndpoint": { + "defaultValue": "[concat(reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))).logsIngestion.endpoint, '/dataCollectionRules/', reference(resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))).immutableId, '/streams/')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "Condition_DstIP": { + "actions": { + "For_each_DstIP": { + "foreach": "@variables('multipleArraysDstIP')", + "actions": { + "Send_Data_DstIP": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "body": "@items('For_each_DstIP')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_DstIP', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable_-_multipleArraysDstIP": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable_-_multipleArraysDstIP": { + "runAfter": { + }, + "type": "SetVariable", + "inputs": { + "name": "multipleArraysDstIP", + "value": "@chunk(body('Run_query_and_list_results_DstIP')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthDstIP'),variables('ArraySizeDstIP'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArraysDstIP": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeDstIP')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_SourceInfo": { + "actions": { + "For_each_-_SubArray_-_SourceInfo": { + "foreach": "@variables('multipleArraysSourceInfo')", + "actions": { + "Send_Data_SourceInfo": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "body": "@items('For_each_-_SubArray_-_SourceInfo')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcInfo', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable": { + "runAfter": { + }, + "type": "SetVariable", + "inputs": { + "name": "multipleArraysSourceInfo", + "value": "@chunk(body('Run_query_and_list_results_SourceInfo')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthSourceInfo'),variables('ArraySizeSourceInfo'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArrays_-_SourceInfo": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeSourceInfo')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_SrcIP": { + "actions": { + "For_each": { + "foreach": "@variables('multipleArraysSrcIP')", + "actions": { + "Send_Data_SrcIP": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "body": "@items('For_each')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcIP', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable_multipleArraysIP": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable_multipleArraysIP": { + "runAfter": { + }, + "type": "SetVariable", + "inputs": { + "name": "multipleArraysSrcIP", + "value": "@chunk(body('Run_query_and_list_results_SrcIP')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthSrcIP'),variables('ArraySizeSrcIP'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArraysSrcIP": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeSrcIP')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_ThreatInfo": { + "actions": { + "For_each_ThreatInfo": { + "foreach": "@variables('multipleArraysThreatInfo')", + "actions": { + "Send_Data": { + "runAfter": { + }, + "type": "Http", + "inputs": { + "body": "@items('For_each_ThreatInfo')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_ThreatInfo', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable_-_multipleArraysThreatInfo": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable_-_multipleArraysThreatInfo": { + "runAfter": { + }, + "type": "SetVariable", + "inputs": { + "name": "multipleArraysThreatInfo", + "value": "@chunk(body('Run_query_and_list_results_ThreatInfo')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthThreatInfo'),variables('ArraySizeThreatInfo'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArraysThreatInfo": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeThreatInfo')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Initialize_variable_-_ArraySizeDstIP": { + "runAfter": { + "Run_query_and_list_results_DstIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeDstIP", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_DstIP')?['value'])" + } + ] + } + }, + "Initialize_variable_-_ArraySizeSrcIP": { + "runAfter": { + "Run_query_and_list_results_SrcIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeSrcIP", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_SrcIP')?['value'])" + } + ] + } + }, + "Initialize_variable_-_ArraySizeThreatInfo": { + "runAfter": { + "Run_query_and_list_results_ThreatInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeThreatInfo", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_ThreatInfo')?['value'])" + } + ] + } + }, + "Initialize_variable_-_ArraySize_-_SourceInfo": { + "runAfter": { + "Run_query_and_list_results_SourceInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeSourceInfo", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_SourceInfo')?['value'])" + } + ] + } + }, + "Initialize_variable_-_TotalCharacterLengthSrcIP": { + "runAfter": { + "Initialize_variable_-_ArraySizeSrcIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthSrcIP", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_SrcIP')?['value']))" + } + ] + } + }, + "Initialize_variable_-_TotalCharacterLengthThreatInfo": { + "runAfter": { + "Initialize_variable_-_ArraySizeThreatInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthThreatInfo", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_ThreatInfo')?['value']))" + } + ] + } + }, + "Initialize_variable_-_TotalCharacterLength_-_SourceInfo": { + "runAfter": { + "Initialize_variable_-_ArraySize_-_SourceInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthSourceInfo", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_SourceInfo')?['value']))" + } + ] + } + }, + "Initialize_variable_-_TotalCharaterLengthDstIP": { + "runAfter": { + "Initialize_variable_-_ArraySizeDstIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthDstIP", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_DstIP')?['value']))" + } + ] + } + }, + "Initialize_variable_-_multipleArraysDstIP": { + "runAfter": { + "Initialize_variable_-_TotalCharaterLengthDstIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysDstIP", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_multipleArraysSrcIP": { + "runAfter": { + "Initialize_variable_-_TotalCharacterLengthSrcIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysSrcIP", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_multipleArraysThreatInfo": { + "runAfter": { + "Initialize_variable_-_TotalCharacterLengthThreatInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysThreatInfo", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_multipleArrays_-_SourceInfo": { + "runAfter": { + "Initialize_variable_-_TotalCharacterLength_-_SourceInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysSourceInfo", + "type": "array" + } + ] + } + }, + "MaxRequestSizeAllowed": { + "runAfter": { + "nowTime": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "MaxByteSizeAllowed", + "type": "integer", + "value": 26214400 + } + ] + } + }, + "Run_query_and_list_results_DstIP": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_DstIP_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by DstIpAddr, SrcIPIsPrivate = ipv4_is_private(SrcIpAddr), DstPortNumber, DestDomain = tostring(parse_url(Url)[\"Host\"]), DstHostname, EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "Run_query_and_list_results_SourceInfo": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcInfo_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by HttpUserAgent, EventResultDetails, EventResult, UrlCategory, NetworkApplicationProtocol, HttpRequestMethod, HttpContentType, EventTime = bin(TimeGenerated, 1h), EventProduct, EventVendor, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "Run_query_and_list_results_SrcIP": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcIP_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by SrcUsername, SrcIpAddr, SrcHostname, DstIPIsPrivate = ipv4_is_private(DstIpAddr), DestDomain = tostring(parse_url(Url)[\"Host\"]), EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "Run_query_and_list_results_ThreatInfo": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_ThreatInfo_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| where (ThreatName != 'None' and isnotempty(ThreatName)) or (ThreatCategory != 'None' and isnotempty(ThreatCategory)) or ThreatRiskLevel \u003e 60 or toint(ThreatOriginalConfidence) \u003e 0 or EventSeverity in ('Medium','High') or isnotempty(ThreatField)\n| summarize EventCount=count() by ThreatName, ThreatCategory, ThreatRiskLevel, toint(ThreatOriginalConfidence), EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestDomain = tostring(parse_url(Url)[\"Host\"]), bin(TimeGenerated, 1h), EventResult, DstIpAddr\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "nowTime": { + "runAfter": { + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "nowTime", + "type": "string", + "value": "@{utcNow()}" + } + ] + } + } + }, + "outputs": { + } + }, + "parameters": { + "$connections": { + "value": { + "azuremonitorlogs": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]", + "connectionName": "[variables('AzuremonitorlogsConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuremonitorlogs')]" + } + } + } + } + }, + "name": "[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "SummarizeWebSessionData", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2017-07-01", + "dependsOn": [ + "[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", + "[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('AzuremonitorlogsConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('AzuremonitorlogsConnectionName')]", + "customParameterValues": { + }, + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/Azuremonitorlogs')]" + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[variables('roleAssignmentName')]", + "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", + "dependsOn": [ + "[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", + "[resourceId('Microsoft.Logic/workflows', parameters('PlaybookName'))]" + ], + "properties": { + "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringMetricsPublisherRoleId'))]", + "principalId": "[reference(resourceId('Microsoft.Logic/workflows', parameters('PlaybookName')), '2017-07-01', 'Full').identity.principalId]", + "principalType": "ServicePrincipal" + } + } + ] +} From 7c679ec0cbcbaf50c510bb534592e054a540983f Mon Sep 17 00:00:00 2001 From: v-sabiraj <94349919+v-sabiraj@users.noreply.github.com> Date: Wed, 26 Aug 2026 17:35:44 +0530 Subject: [PATCH 2/5] Use V1 summary tables in Web Session log ingestion playbook Renames the custom summarization tables and DCR streams to their V1 variants (WebSession_Summarized_SrcInfoV1_CL, SrcIPV1_CL, DstIPV1_CL, ThreatInfoV1_CL) to avoid conflicting with the existing tables created by the previous playbook version. Also: - Adds an explicit TimeGenerated column to each table schema and DCR transform. - Updates the playbook default name to SummarizeWebSessionData-logingestion and the title to clarify it uses the Log Ingestion API. - Updates the lookback KQL queries to read from the new V1 tables. --- .../azuredeploy.json | 56 +++++++++---------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json index d482bc373eb..af03e21332a 100644 --- a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json @@ -2,8 +2,8 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "title": "Summarize Web Session Data", - "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfo_CL, WebSession_Summarized_SrcIP_CL, WebSession_Summarized_DstIP_CL and WebSession_Summarized_ThreatInfo_CL.", + "title": "Summarize Web Session Data using Log Ingestion API", + "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfoV1_CL, WebSession_Summarized_SrcIPV1_CL, WebSession_Summarized_DstIPV1_CL and WebSession_Summarized_ThreatInfoV1_CL.", "prerequisites": [], "postDeployment": [ "Authorize the 'Azure Monitor Logs' API connection. Log ingestion uses the playbook's managed identity." @@ -20,7 +20,7 @@ }, "parameters": { "PlaybookName": { - "defaultValue": "SummarizeWebSessionData", + "defaultValue": "SummarizeWebSessionData-logingestion", "type": "string" }, "logAnalyticsName": { @@ -67,47 +67,47 @@ { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", - "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_DstIP_CL')]", - "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_DstIP_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "DstIpAddr_s", "type": "string" }, { "name": "SrcIPIsPrivate_b", "type": "boolean" }, { "name": "DstPortNumber_d", "type": "real" }, { "name": "DestDomain_s", "type": "string" }, { "name": "DstHostname_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_DstIPV1_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_DstIPV1_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "DstIpAddr_s", "type": "string" }, { "name": "SrcIPIsPrivate_b", "type": "boolean" }, { "name": "DstPortNumber_d", "type": "real" }, { "name": "DestDomain_s", "type": "string" }, { "name": "DstHostname_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime_t", "type": "datetime" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", - "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcInfo_CL')]", - "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_SrcInfo_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "HttpUserAgent_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "UrlCategory_s", "type": "string" }, { "name": "NetworkApplicationProtocol_s", "type": "string" }, { "name": "HttpRequestMethod_s", "type": "string" }, { "name": "HttpContentType_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventVendor_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcInfoV1_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_SrcInfoV1_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "HttpUserAgent_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "UrlCategory_s", "type": "string" }, { "name": "NetworkApplicationProtocol_s", "type": "string" }, { "name": "HttpRequestMethod_s", "type": "string" }, { "name": "HttpContentType_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventVendor_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime_t", "type": "datetime" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", - "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcIP_CL')]", - "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_SrcIP_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "SrcUsername_s", "type": "string" }, { "name": "SrcIpAddr_s", "type": "string" }, { "name": "SrcHostname_s", "type": "string" }, { "name": "DstIPIsPrivate_b", "type": "boolean" }, { "name": "DestDomain_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcIPV1_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_SrcIPV1_CL", "columns": [ { "name": "SrcBytes_d", "type": "real" }, { "name": "DstBytes_d", "type": "real" }, { "name": "EventCount_d", "type": "real" }, { "name": "SrcUsername_s", "type": "string" }, { "name": "SrcIpAddr_s", "type": "string" }, { "name": "SrcHostname_s", "type": "string" }, { "name": "DstIPIsPrivate_b", "type": "boolean" }, { "name": "DestDomain_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "EventResultDetails_s", "type": "string" }, { "name": "EventProduct_s", "type": "string" }, { "name": "EventType_s", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime_t", "type": "datetime" } ] } } }, { "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", - "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_ThreatInfo_CL')]", - "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_ThreatInfo_CL", "columns": [ { "name": "EventCount_d", "type": "real" }, { "name": "ThreatName_s", "type": "string" }, { "name": "ThreatCategory_s", "type": "string" }, { "name": "ThreatRiskLevel_d", "type": "real" }, { "name": "ThreatOriginalConfidence_d", "type": "real" }, { "name": "EventSeverity_s", "type": "string" }, { "name": "ThreatField_s", "type": "string" }, { "name": "SrcIpAddr_s", "type": "string" }, { "name": "SrcUsername_s", "type": "string" }, { "name": "DestDomain_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "DstIpAddr_s", "type": "string" }, { "name": "EventTime_t", "type": "datetime" } ] } } + "name": "[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_ThreatInfoV1_CL')]", + "properties": { "plan": "Analytics", "schema": { "name": "WebSession_Summarized_ThreatInfoV1_CL", "columns": [ { "name": "EventCount_d", "type": "real" }, { "name": "ThreatName_s", "type": "string" }, { "name": "ThreatCategory_s", "type": "string" }, { "name": "ThreatRiskLevel_d", "type": "real" }, { "name": "ThreatOriginalConfidence_d", "type": "real" }, { "name": "EventSeverity_s", "type": "string" }, { "name": "ThreatField_s", "type": "string" }, { "name": "SrcIpAddr_s", "type": "string" }, { "name": "SrcUsername_s", "type": "string" }, { "name": "DestDomain_s", "type": "string" }, { "name": "EventResult_s", "type": "string" }, { "name": "DstIpAddr_s", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime_t", "type": "datetime" } ] } } }, { "type": "Microsoft.Insights/dataCollectionRules", "apiVersion": "2022-06-01", "name": "[variables('DCRName')]", "location": "[resourceGroup().location]", - "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_DstIP_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcInfo_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcIP_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_ThreatInfo_CL')]" ], + "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_DstIPV1_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcInfoV1_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcIPV1_CL')]", "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_ThreatInfoV1_CL')]" ], "properties": { "dataCollectionEndpointId": "[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", "streamDeclarations": { - "Custom-WebSession_Summarized_DstIP": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "DstIpAddr", "type": "string" }, { "name": "SrcIPIsPrivate", "type": "boolean" }, { "name": "DstPortNumber", "type": "real" }, { "name": "DestDomain", "type": "string" }, { "name": "DstHostname", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, - "Custom-WebSession_Summarized_SrcInfo": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "HttpUserAgent", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "UrlCategory", "type": "string" }, { "name": "NetworkApplicationProtocol", "type": "string" }, { "name": "HttpRequestMethod", "type": "string" }, { "name": "HttpContentType", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventVendor", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, - "Custom-WebSession_Summarized_SrcIP": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "SrcUsername", "type": "string" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcHostname", "type": "string" }, { "name": "DstIPIsPrivate", "type": "boolean" }, { "name": "DestDomain", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, - "Custom-WebSession_Summarized_ThreatInfo": { "columns": [ { "name": "EventCount", "type": "real" }, { "name": "ThreatName", "type": "string" }, { "name": "ThreatCategory", "type": "string" }, { "name": "ThreatRiskLevel", "type": "real" }, { "name": "ThreatOriginalConfidence", "type": "real" }, { "name": "EventSeverity", "type": "string" }, { "name": "ThreatField", "type": "string" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcUsername", "type": "string" }, { "name": "DestDomain", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "DstIpAddr", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] } + "Custom-WebSession_Summarized_DstIPV1": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "DstIpAddr", "type": "string" }, { "name": "SrcIPIsPrivate", "type": "boolean" }, { "name": "DstPortNumber", "type": "real" }, { "name": "DestDomain", "type": "string" }, { "name": "DstHostname", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, + "Custom-WebSession_Summarized_SrcInfoV1": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "HttpUserAgent", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "UrlCategory", "type": "string" }, { "name": "NetworkApplicationProtocol", "type": "string" }, { "name": "HttpRequestMethod", "type": "string" }, { "name": "HttpContentType", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventVendor", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, + "Custom-WebSession_Summarized_SrcIPV1": { "columns": [ { "name": "SrcBytes", "type": "real" }, { "name": "DstBytes", "type": "real" }, { "name": "EventCount", "type": "real" }, { "name": "SrcUsername", "type": "string" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcHostname", "type": "string" }, { "name": "DstIPIsPrivate", "type": "boolean" }, { "name": "DestDomain", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "EventResultDetails", "type": "string" }, { "name": "EventProduct", "type": "string" }, { "name": "EventType", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] }, + "Custom-WebSession_Summarized_ThreatInfoV1": { "columns": [ { "name": "EventCount", "type": "real" }, { "name": "ThreatName", "type": "string" }, { "name": "ThreatCategory", "type": "string" }, { "name": "ThreatRiskLevel", "type": "real" }, { "name": "ThreatOriginalConfidence", "type": "real" }, { "name": "EventSeverity", "type": "string" }, { "name": "ThreatField", "type": "string" }, { "name": "SrcIpAddr", "type": "string" }, { "name": "SrcUsername", "type": "string" }, { "name": "DestDomain", "type": "string" }, { "name": "EventResult", "type": "string" }, { "name": "DstIpAddr", "type": "string" }, { "name": "TimeGenerated", "type": "datetime" }, { "name": "EventTime", "type": "datetime" } ] } }, "destinations": { "logAnalytics": [ { "workspaceResourceId": "[variables('workspaceResourceId')]", "name": "[variables('destinationName')]" } ] }, "dataFlows": [ - { "streams": [ "Custom-WebSession_Summarized_DstIP" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), DstIpAddr_s=tostring(DstIpAddr), SrcIPIsPrivate_b=tobool(SrcIPIsPrivate), DstPortNumber_d=toreal(DstPortNumber), DestDomain_s=tostring(DestDomain), DstHostname_s=tostring(DstHostname), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_DstIP_CL" }, - { "streams": [ "Custom-WebSession_Summarized_SrcInfo" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), HttpUserAgent_s=tostring(HttpUserAgent), EventResultDetails_s=tostring(EventResultDetails), EventResult_s=tostring(EventResult), UrlCategory_s=tostring(UrlCategory), NetworkApplicationProtocol_s=tostring(NetworkApplicationProtocol), HttpRequestMethod_s=tostring(HttpRequestMethod), HttpContentType_s=tostring(HttpContentType), EventProduct_s=tostring(EventProduct), EventVendor_s=tostring(EventVendor), EventType_s=tostring(EventType), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_SrcInfo_CL" }, - { "streams": [ "Custom-WebSession_Summarized_SrcIP" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), SrcUsername_s=tostring(SrcUsername), SrcIpAddr_s=tostring(SrcIpAddr), SrcHostname_s=tostring(SrcHostname), DstIPIsPrivate_b=tobool(DstIPIsPrivate), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_SrcIP_CL" }, - { "streams": [ "Custom-WebSession_Summarized_ThreatInfo" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project EventCount_d=toreal(EventCount), ThreatName_s=tostring(ThreatName), ThreatCategory_s=tostring(ThreatCategory), ThreatRiskLevel_d=toreal(ThreatRiskLevel), ThreatOriginalConfidence_d=toreal(ThreatOriginalConfidence), EventSeverity_s=tostring(EventSeverity), ThreatField_s=tostring(ThreatField), SrcIpAddr_s=tostring(SrcIpAddr), SrcUsername_s=tostring(SrcUsername), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), DstIpAddr_s=tostring(DstIpAddr), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_ThreatInfo_CL" } + { "streams": [ "Custom-WebSession_Summarized_DstIPV1" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), DstIpAddr_s=tostring(DstIpAddr), SrcIPIsPrivate_b=tobool(SrcIPIsPrivate), DstPortNumber_d=toreal(DstPortNumber), DestDomain_s=tostring(DestDomain), DstHostname_s=tostring(DstHostname), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_DstIPV1_CL" }, + { "streams": [ "Custom-WebSession_Summarized_SrcInfoV1" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), HttpUserAgent_s=tostring(HttpUserAgent), EventResultDetails_s=tostring(EventResultDetails), EventResult_s=tostring(EventResult), UrlCategory_s=tostring(UrlCategory), NetworkApplicationProtocol_s=tostring(NetworkApplicationProtocol), HttpRequestMethod_s=tostring(HttpRequestMethod), HttpContentType_s=tostring(HttpContentType), EventProduct_s=tostring(EventProduct), EventVendor_s=tostring(EventVendor), EventType_s=tostring(EventType), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_SrcInfoV1_CL" }, + { "streams": [ "Custom-WebSession_Summarized_SrcIPV1" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), SrcUsername_s=tostring(SrcUsername), SrcIpAddr_s=tostring(SrcIpAddr), SrcHostname_s=tostring(SrcHostname), DstIPIsPrivate_b=tobool(DstIPIsPrivate), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_SrcIPV1_CL" }, + { "streams": [ "Custom-WebSession_Summarized_ThreatInfoV1" ], "destinations": [ "[variables('destinationName')]" ], "transformKql": "source | project EventCount_d=toreal(EventCount), ThreatName_s=tostring(ThreatName), ThreatCategory_s=tostring(ThreatCategory), ThreatRiskLevel_d=toreal(ThreatRiskLevel), ThreatOriginalConfidence_d=toreal(ThreatOriginalConfidence), EventSeverity_s=tostring(EventSeverity), ThreatField_s=tostring(ThreatField), SrcIpAddr_s=tostring(SrcIpAddr), SrcUsername_s=tostring(SrcUsername), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), DstIpAddr_s=tostring(DstIpAddr), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", "outputStream": "Custom-WebSession_Summarized_ThreatInfoV1_CL" } ] } }, @@ -174,7 +174,7 @@ "audience": "https://monitor.azure.com/" }, "method": "POST", - "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_DstIP', '?api-version=2023-01-01')" + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_DstIPV1', '?api-version=2023-01-01')" } } }, @@ -231,7 +231,7 @@ "audience": "https://monitor.azure.com/" }, "method": "POST", - "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcInfo', '?api-version=2023-01-01')" + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcInfoV1', '?api-version=2023-01-01')" } } }, @@ -288,7 +288,7 @@ "audience": "https://monitor.azure.com/" }, "method": "POST", - "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcIP', '?api-version=2023-01-01')" + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcIPV1', '?api-version=2023-01-01')" } } }, @@ -345,7 +345,7 @@ "audience": "https://monitor.azure.com/" }, "method": "POST", - "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_ThreatInfo', '?api-version=2023-01-01')" + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_ThreatInfoV1', '?api-version=2023-01-01')" } } }, @@ -608,7 +608,7 @@ }, "type": "ApiConnection", "inputs": { - "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_DstIP_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by DstIpAddr, SrcIPIsPrivate = ipv4_is_private(SrcIpAddr), DstPortNumber, DestDomain = tostring(parse_url(Url)[\"Host\"]), DstHostname, EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_DstIPV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by DstIpAddr, SrcIPIsPrivate = ipv4_is_private(SrcIpAddr), DstPortNumber, DestDomain = tostring(parse_url(Url)[\"Host\"]), DstHostname, EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", "host": { "connection": { "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" @@ -633,7 +633,7 @@ }, "type": "ApiConnection", "inputs": { - "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcInfo_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by HttpUserAgent, EventResultDetails, EventResult, UrlCategory, NetworkApplicationProtocol, HttpRequestMethod, HttpContentType, EventTime = bin(TimeGenerated, 1h), EventProduct, EventVendor, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcInfoV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by HttpUserAgent, EventResultDetails, EventResult, UrlCategory, NetworkApplicationProtocol, HttpRequestMethod, HttpContentType, EventTime = bin(TimeGenerated, 1h), EventProduct, EventVendor, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", "host": { "connection": { "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" @@ -658,7 +658,7 @@ }, "type": "ApiConnection", "inputs": { - "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcIP_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by SrcUsername, SrcIpAddr, SrcHostname, DstIPIsPrivate = ipv4_is_private(DstIpAddr), DestDomain = tostring(parse_url(Url)[\"Host\"]), EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcIPV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by SrcUsername, SrcIpAddr, SrcHostname, DstIPIsPrivate = ipv4_is_private(DstIpAddr), DestDomain = tostring(parse_url(Url)[\"Host\"]), EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", "host": { "connection": { "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" @@ -683,7 +683,7 @@ }, "type": "ApiConnection", "inputs": { - "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_ThreatInfo_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| where (ThreatName != 'None' and isnotempty(ThreatName)) or (ThreatCategory != 'None' and isnotempty(ThreatCategory)) or ThreatRiskLevel \u003e 60 or toint(ThreatOriginalConfidence) \u003e 0 or EventSeverity in ('Medium','High') or isnotempty(ThreatField)\n| summarize EventCount=count() by ThreatName, ThreatCategory, ThreatRiskLevel, toint(ThreatOriginalConfidence), EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestDomain = tostring(parse_url(Url)[\"Host\"]), bin(TimeGenerated, 1h), EventResult, DstIpAddr\n| extend EventTime = TimeGenerated", + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_ThreatInfoV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated \u003c bin(nowTime,1h)\n| where (ThreatName != 'None' and isnotempty(ThreatName)) or (ThreatCategory != 'None' and isnotempty(ThreatCategory)) or ThreatRiskLevel \u003e 60 or toint(ThreatOriginalConfidence) \u003e 0 or EventSeverity in ('Medium','High') or isnotempty(ThreatField)\n| summarize EventCount=count() by ThreatName, ThreatCategory, ThreatRiskLevel, toint(ThreatOriginalConfidence), EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestDomain = tostring(parse_url(Url)[\"Host\"]), bin(TimeGenerated, 1h), EventResult, DstIpAddr\n| extend EventTime = TimeGenerated", "host": { "connection": { "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" From 0d088aecc7d2ad4bedc233b60b93ffee99bf35ab Mon Sep 17 00:00:00 2001 From: v-sabiraj <94349919+v-sabiraj@users.noreply.github.com> Date: Thu, 27 Aug 2026 18:07:23 +0530 Subject: [PATCH 3/5] Add log ingestion playbook README docs Documented the new `SummarizeWebSessionData_logingestion` playbook with summary, deployment steps, required parameters, and post-deployment API authorization guidance for Logs Ingestion API-based ingestion. Also corrected the Azure Gov deploy badge URL in the existing `SummarizeWebSessionData` README. --- .../SummarizeWebSessionData/readme.md | 2 +- .../readme.md | 39 +++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/readme.md diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/readme.md b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/readme.md index a63fa3da4dd..afaebdc7c94 100644 --- a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/readme.md +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/readme.md @@ -12,7 +12,7 @@ This logic app helps to ingest summarized web session data into custom tables. P ### Deployment instructions 1. Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard. [![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/deploywebsessionDataSummarizationPlaybookPublic) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/deploywebsessionDataSummarizationPlaybookGov) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://aka.ms/deploywebsessionDataSummarizationPlaybookGov) 2. Fill in the required parameter: * Playbook Name: Enter the playbook name here (Ex: SummarizeWebSessionData) diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/readme.md b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/readme.md new file mode 100644 index 00000000000..1870eebe06f --- /dev/null +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/readme.md @@ -0,0 +1,39 @@ +# Web Session Essentials Summarization Capability + +This Logic App ingests summarized Web Session data into custom Log Analytics tables by using the Logs Ingestion API. Enabling this playbook incurs additional cost. + +## Summary + +The playbook improves Web Session Essentials solution performance by creating four tables containing analytics based on the ASIM Web Session schema: + +- `WebSession_Summarized_SrcInfoV1_CL` +- `WebSession_Summarized_SrcIPV1_CL` +- `WebSession_Summarized_DstIPV1_CL` +- `WebSession_Summarized_ThreatInfoV1_CL` + +The V1 table names avoid conflicts with existing classic tables. The playbook uses a data collection endpoint (DCE), data collection rule (DCR), and its managed identity to ingest summarized data. + +## Deployment Instructions + +1. Deploy the playbook by selecting the applicable button: + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2F7c679ec0cbcbaf50c510bb534592e054a540983f%2FSolutions%2FWeb%2520Session%2520Essentials%2FPlaybooks%2FSummarizeWebSessionData_logingestion%2Fazuredeploy.json) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovernbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2F7c679ec0cbcbaf50c510bb534592e054a540983f%2FSolutions%2FWeb%2520Session%2520Essentials%2FPlaybooks%2FSummarizeWebSessionData_logingestion%2Fazuredeploy.json) + +2. Deploy the playbook to a resource group in the same Azure region as the Log Analytics workspace. +3. Provide the required parameters: + - **Playbook Name**: The default is `SummarizeWebSessionData-logingestion`. + - **Log Analytics Name**: The Log Analytics workspace that contains the Web Session data. + - **Resource Group Name** and **Subscription ID**: The workspace resource group and subscription. + +The deployment creates the DCE, DCR, V1 custom tables, and grants the playbook managed identity the Monitoring Metrics Publisher role on the DCR. + +## Post-Deployment Instructions + +Authorize the Azure Monitor Logs API connection if prompted: + +1. Open the Azure Monitor Logs API connection. +2. Select **Edit API connection**. +3. Select **Authorize**, sign in, and then save the connection. + +The Logs Ingestion API uses the playbook's managed identity. No Azure Log Analytics Data Collector connection or workspace key is required. \ No newline at end of file From ae9fc32d54e9bd0a202d9a69996c774c09de1a99 Mon Sep 17 00:00:00 2001 From: v-sabiraj <94349919+v-sabiraj@users.noreply.github.com> Date: Wed, 2 Sep 2026 15:44:35 +0530 Subject: [PATCH 4/5] Updated package --- .../Data/Solution_Web Session Essentials.json | 7 +- .../Web Session Essentials/Package/3.0.4.zip | Bin 0 -> 54882 bytes .../Package/createUiDefinition.json | 2 +- .../Package/mainTemplate.json | 2241 +++++++++++++---- .../SummarizeWebSessionData/azuredeploy.json | 6 +- .../azuredeploy.json | 4 +- .../Web Session Essentials/ReleaseNotes.md | 1 + 7 files changed, 1817 insertions(+), 444 deletions(-) create mode 100644 Solutions/Web Session Essentials/Package/3.0.4.zip diff --git a/Solutions/Web Session Essentials/Data/Solution_Web Session Essentials.json b/Solutions/Web Session Essentials/Data/Solution_Web Session Essentials.json index 3c6b4e04fff..18b361bf035 100644 --- a/Solutions/Web Session Essentials/Data/Solution_Web Session Essentials.json +++ b/Solutions/Web Session Essentials/Data/Solution_Web Session Essentials.json @@ -2,7 +2,7 @@ "Name": "Web Session Essentials", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "Web Session Essentials is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Palo Alto PAN-OS \n 2. SquidProxy \n 3. Vectra AI Stream \n 4. Zscaler Internet Access \n 5. IIS logs (via LA agent) \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **SummarizeWebSessionData** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.", + "Description": "Web Session Essentials is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Palo Alto PAN-OS \n 2. SquidProxy \n 3. Vectra AI Stream \n 4. Zscaler Internet Access \n 5. IIS logs (via LA agent) \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **SummarizeWebSessionData** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n **NOTE: This solution includes the playbook SummarizeWebSessionData, which uses the legacy HTTP data collector API to ingest data. Since that API is about to be deprecated, we recommend using the SummarizeWebSessionData_logingestion playbook instead.**", "Workbooks": [ "Workbooks/WebSessionEssentials.json" ], @@ -35,7 +35,8 @@ "Hunting Queries/ThreatInfoFoundInWebRequests.yaml" ], "Playbooks": [ - "Playbooks/SummarizeWebSessionData/azuredeploy.json" + "Playbooks/SummarizeWebSessionData/azuredeploy.json", + "Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json" ], "dependentDomainSolutionIds": [ "azuresentinel.azure-sentinel-solution-paloaltopanos", @@ -44,7 +45,7 @@ "zscaler1579058425289.zscaler_internet_access_mss" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Web Session Essentials\\", - "Version": "3.0.3", + "Version": "3.0.4", "TemplateSpec": true, "Metadata": "SolutionMetadata.json" } \ No newline at end of file diff --git a/Solutions/Web Session Essentials/Package/3.0.4.zip b/Solutions/Web Session Essentials/Package/3.0.4.zip new file mode 100644 index 0000000000000000000000000000000000000000..268e791eede8b7949cca5c8c2e4aaae9948d8758 GIT binary patch literal 54882 zcmV)xK$E{vO9KQH000080I7T;U3c8+n&lP%0B&gj02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?OpwH8#j{wf2;BiUEJG~s3Iv@w&U1!*)7F#64uJLR#M`svt220ra8n4 z155x6DJGYydzO2&dy=beV7^GojuVN}rtXg<;(TC$Mt}ag(fRqaKLPaq%_TF;MeiB( zX5JU>+5UdGGRlP(8Rn?{Nc>b<93>`?_uT%$=)vf4SXi7(T|JOMo(qdTma}v_eTCCY}$JUQ=uFV>N^wRWYT(@FQ(`cD+?dL{2wyUz}W=8 z+^MKz#bT66KPxAtLz@`wi9$phUP<`(@Eo<58r6O-oJYHVVlv~xy&tN3BR9`>U?EdK z`*P>WZQfDy1sj&!B zJ1>-?D|Fu(Rnl6X0gd&)|NTF3#zgGggtuoH#->lX_q)|n!!oa5o41J70?*@MZvPEV z{&IM5j*hnPFNX&&oTC?na{KW+{Fzan_GwZ;v$~j}MaabxCJ1jYwOMG8&Xw)ih)Xfb z-98VdQB|{d{B(G@4+UB;q~`S#iKK&SW&ckb?;-vlxJIut25gzw{;J zXK0&GfwAG^&XhJm(8lIM$)7N-Sn}=B`S|79t{qKG>FG|N$-B3AYLTbqq(^u*+}mSb z7>8X56Sa`j&cq2T={%;*d)F>PLEyR_wfkE<8x3ZbFe#?0#1%VWT<_g<#TWEJDs9c zOJd(zL&60nGi{W~BswS^rlbw%`HRjjdvS@xo+%cnQ`E^4=xRqx_|{MZW-n**io_0^ zcj;3odGDiCN)2yMg9>i#E-UXY!@II5jP?5pGokjQ)*jMT#nwcqp+}p${XRG^eAsAG zdtlL(iuqThDVq_YK61B*& z@M3R|wmyEmP+~bT=CWbOh4ix($rTQyhlNxMoXoVG%0y_dmLPL_Eqt#)J0&sHNi8gI zjJ>462XLf?T6&p)EfqTWclfp>1(d;$C0dD&cz$p1)$5BF&!EdsQQx@mjcT^nENuXb znM`IxgYW|FezJsbFD_0iZKYIDAxEcUB3Ia0zBz((NwfDe;rTY{S<)Ev+=SWEVj?`I z16W`~cPL$D>8_dA4@B^qgX&d~wnveU!lv%+RrGQsS`P-Ww^!5cjOfOfAJg@UeE$gK zqZ?1@`e_`RuN=~-Z%@b?1RWL@(};9sLf7;p3shwz`tV<{K1ywAKm2kn38_i?!D)&< zjw>f^C#U890Q4*d&3+oVlHIGf?I)n^yuGgE(Y>s_#r^ur?XO<k!lnLwhNtJrugAa_>8G?7=0}r$O^OI9$7OvNR@O|^+mo~|iNyJ8S<>&=*@ahfn zc4e9(dy(JDlvt)3gn2kaPoh1wCJ*vrG7ypH9Mq)f%&t8p@{pyI6NQy$d(G6V4gJQN zvRIqHAj|OLN;+cd-ZSvFY!6iZ8ULsTZhYsOHQG+J7CFtTm!Us7dQ&f@JuAN~_>pE? zYPKF7+5D)G&yDuhsP0?Fs0&G}=&`PvN<|R>8S;jCf)+tqQ*eb4&LRzfi2x2s6JgpJ zJ25)g92)&?#_@>VRj4yR+wBl>w?Cp4_6G<3_njfgp+V<2G0DtO1k(HF#YLAhdxh{b z{$gTuBK&S!ICuLanGSYZ((r2q=x?Hs!x%w*d3bPmFg*BTc<^AS|Gu|rcLyKZ#l^4O zz~?5n-jA@8}E%|+8;o5Z6p8n`vcgO9&;XtJ>K2OMLR#g3p9V%d-krkGXQ#w-x|Qq zyWZekk7u&^?k_w2ewVW&Z%d2mx{hd5tWinrha#iBue68rSbS7@Y*gi4Mq0n^%E?K5 zqPty%#qWiZ!JDJ^pEFcY+TcQ6V>fz*alZTBvC(a%+*$oZi4-rSX98R^Lkv#vnps`7 z9&2P6dc5*$X6;%ryud5}6$L(PuNc-XYaAVhqidV_EJbz=ujW)|Sp5W@x{9I{e8^uda;yw&T_|h9Ig&O8YOKI;ny*bLHCg17eKb+Wf%-kayXQ3ih_JA8~KR^$<3XY+D* z8excjf&+^bWXl{^gi<74&ZS>+o z=o}vdk0N&iaF~>q2e-*gdQ3b+3_>kk_$wt_M-jfzo{^czcLR_q&14$pCH0)bwTz&F zYGy_Qt=^#}r)I!E2#O(?g5C+FiQoT5cwC4jK>!XtgJZJc3drP~agq@9FDYaWv!oCl zC*ZA^PAN#&DQh@a1?DuB_$bAvovD&ya-}O|B2DRlgs>WDRTr%Z(1r`GIHYs${jYP` z>Of+%?W|(ko3Wi6KlVFq=jIuHs_m?2b{}kK7l;#WSOz@ig%Sjcf6Ndj9G5Wjp%xR> zkUs)Ew`UL=YX0F3Vv3}`hEe+r1F-zJHy5Kk`9Y>%o*GLiX1&rMLSCnx!@79`T9N-I z4d^ki6TUk;aa9~bEEn=GgzE=wc8SY{v8f{jmXJ50QwO_@v$t$g|HkZXz0^Ckx22aV zLc(Mt+|qf>oAnzD(^4~m>!30M07OuR&0U!>#>w%g&>*}Q$tB6R18*7T_a=DHr52^1 z8A32q5Fuj_-DuQvX^kdQ64HTJg))*Yj(~ZoG+I^!WE^FJzu(+^5<4E=JUezs!Pv34 zLc1v;Juw83IXcE)L1>c;wcG|f9^N54O2>fxGIAw4n3Piaq15pAf1K1*2#Sj{2P!jG z`dQ9w)N-)sK@#c}!g>QmIZ-mH+&VXcv5y0~cJ_giZZd$r0lpM45e}8q2!-&J^cn!e zBbE7TW<_#T5-dvD1xwjjmYvRAY|N(UpoUgvRV5loyrfPgWd*|fctyxb0L4hsFfYjY z8?X3i$t)6qxJNojY?(-*MwCuNa7jo8hk=9DPBF8HG^g-szSf>`qzFcO(EXYsjI)g3 zh;v40*FGR1LX8bsLpGPUd&hw(eNpm%dJoD|cD8cDU$l)V94>M9S#5e1QDF4Iz|OZM(NQ@jGohu+D_&wnK@Pd5?81UeRidSLAh>QN zW%W=K^Y~SpYspiP3IVS?Y9d}tQP8Ut5fikJY1ki1$C9*oE3=IB@?wS>1SF(TOHMvl zUlaBBLRcIIoe7GT70DWEK%JP9>JTsmLmAd8#Bcc&LEQx5*W`AX>B`8gCy78dmlXVy za-;D=Y!W^`K87MBA2&HeyK%sCet2A~Bvx`%5&|9K(IR;M(c1Czy3Em%C?_H>gv^MH zrs4Kh$v`2Nbjb}uqMiVd$`r|*bW@coj{rnt7=n_BY4Ju4H@R>DPUHo9TRsR_Q7T~> zI0$*0_BQW^OE2mx{mOi~nJHCD3NZv1RRxVuGSd~{fZz&D$m~`nJS<`K-PKLpuF86J z^G;td_CZHcVO^+;*-Du4=x#L+BLHn|%^Nn=%u}_VVd0K38i*E&V1^>Cq@RYv#AG^z z5v~d1*allUH8G7TvuWIe7WFG`M;pCvD@y+*W*5^pU!S%b&QX>CP0)+rM!aZ1%>(y;T$34|?h`serB^K;UdF&GN2 z-*p7FGNXtHYyBv7Mvg)VWNIoanM;b?n7UIcV&5`i^JH5L7sdAeG2D}XQHEO~=)VfX zeQ|>fH?G3_)qreu`O-D`M*t0LGH%(u{Ni47TkX_nvcFhd2gWp;|P8|$lPaw7dk zI*;I-;;RYH#9VR~fuf%pzbkd=2=pOiKe1-P`_%+vRfTgX*)Mfs^qdwDf<0@CJ1=CLtdp=@6reRw9OB1om_Uq^2a)zm7Jy!OBnXjFpd9SKD?_m*HGa8>6N= zIJ5*a2cnflL{sw_;NwOrTC=KZz&7Jl@dR0+=m)KivgTh2ho3)UXqr+u?Fo+Hh>m*%R6RoARFxGl z@O6&pczMFDd}z}B5cw{e(rFV@>QL$xXC3i~DC}k$tcR$}Z(1K*5WK#US6e9*;Og># zN}L^C09C7#+j9E)>lot@=?uF2iRGsGcy;e<`?Z?ipN$d$>=hu$g}wv{icoMy*I=W^qM+#zK+D8EXy z7e%3>sE6?+g-T7Pq~5UTpx0KO1Z(O^?3^F~V|X;Mf3iq@zQ&clO8kcwqh`W%FgPe;W_8YW1EI>EA16^0>TsX7K7%dWO; zsBR&t*v+7sPC3L(*nC=sNM}3Te;@LURXtaSGL=ysxCa9mO@tr7 zXg+a+kxML~PexHYCnBa5z16(nyeJzudU@ME+AZWV<8g&nTI)_U{@rCU z8^&5N*jNYEgziw3L7ezvj`|$u$V?_3?0hS;*$%lhI~PpAGwCi*sL4qC;_CpFDn186 z-7;_|wic1DF6Z+zq2cMl_78u|LWhD_SGV~D$VwN3-t{LjKJ?_Lp2z6U?EW3fn60$N z_}F0#GMu4r%F3I3II<+GPtI|3x@zOe4EX&=Ggb)uM?Iermw5|^D_R6x-XyN|A}{=s zeK-hCT+q&#-lp>HEao2Q-*AYo4SII+#Z;%=uKD^vN~!~9HGVMn7&4{fmONzdIp|w1szn)qRV`OmceObC)|jnA#1v2 z9z489ey^B>j%6(hJvw+;rPP_p0wV85p?4A8Wh};*mauz{n232Ia4$o1wt{M7yAP1U^oK}w`@*(#O#^GtXOyp8S- z`1lqejPdDF1@m?)iZKl}#oOWDhxdqkKSGi1@A@so?0*+Z!im)7RSWyr(q2EhPu4PQ zI+TuFMl)>_W@8oqQA}C8*iA3i&bQv%p>d50XV<4FJhcmBAGLGju0V~|IV#WRe6j(T z6>BY|b7Z)=`C?2ltsc1AJ{R6(`21CkYgfmp>eCJzKve2?!|q8{WYw6J0Px>xl-;4h zeK?$0BbS6T6x=G4dtGv#s3{ny2@#2!970_fG+9C-3Q^Yyf~Zag#M314gyCJV*-cjJ zp4RACLxkEd8^XEFB^@i_^EBZg-In<1?uv1r3zd}A1%WMFBS_~q`6^K0yrxE)qAz#!^&*dz$4(^%O&ib~_nXgtaZPgluzS zh*&R0FQIP+z+_hA8Pf5?X&08KU(sp zv$*@PeY^t`@ z*CcCBH{SlO?YcI8?02^7+C0NgO%K&GyDyocYFSNxuDa``q(k7`k%t5EI#K^J0d}>Okho3Cr;Rfr-a{Y0OPoEE>1!A@OZFxq)_L4LAJZ+l^Ufi?r@HRxSPZ zI*x5pQ7cV)L*JPWwVGDY!&XD|-rK3P&hP%l{>MV6)V27x_COxskEKwqdV`x7SD&w^ zOAU=X&62s{akYj{v*UKF_ukv;$8P75rY$u+v*Bx1mu;r$FQ5JCm(Tw6e^5&U1QY-O z00;o7d?H=z#2j6Jz5oCv*#`g-0001OVQFquWo>Y5VRU6KYIARH?7jJu+c=gW{QE}i z|A5xahLkg6rtZTvs%@9A%4pk_<4kwOewHH#Bq0fHid6H+qg?L4{fh^HBzQ@r?o`sd z)0HAY91jl%!%oq<3Bu`oNLxx zymKyEjpk5kbd*N(LMIEudW3d2WWF%4OV0n{SmwV~>TCebGF@W2eEfdCRo;TqC ziT88jVja6MgYWPFp$hignPo%M4^*=)$C|iEL5{arShoAux&I6%#5-Zb%wY-+e06OZ zo=Ytgxne?SV%g|-qM~c!z%0-k$04RmvEfwU`yYHN3vA;#af$6nlQAp}LucV5gevai zg1|_QYg2RTPXbm$&G*Edy0gj))C?c%WP&}z{W~^1_T3koIF@H?Y7V-e5u2d!tX;#|Fo^-%>k!vlEM1CfS>KupbiLjdrk_jnyXboL z;mUbV{Ivs)`twdKOri#N*rr%Dh)fK~98-g>YAG?g4cdJPdZ|^}!|GXZ#4EQx%E8>S zL6K}P5!3d0sGpAi4P8Q^{igK2y{c5}o=N}d z5q@fF(!_65XD-h@rA2((()x%lp3UY{0NMnkLxlfrL2O3sun{aWATjD@DnSTG4! zwxxSoFmVAe7k?uWNXW=n?=}E*)q3?_t+GE5hu}4bpy(s>bM~o^YrKP1KSjeENJp4&mh04{~(&%j1X1%ef*F$B}#cKHx$4X zP;Ixg#-KOsDJ|0OE1iD3p$vMHfimptLv5fo2OVuF^(1$+{NyDt{-r@|7ryfW07y~I zGrk0p*c1+OF0maympNA#d&##ZK46t09A99JB}k%hYZVH& z@}n?o+8y?~dYkl>0nr;ur{C9C%NJmcp_;nsmrINvG? zpm6K(D4c6eYoKs@6$-Z#tWG8hv!-f)LI#soU+FiR4W-lQs0t=pSLu;%tJBp8?hdk1 zxVV!c6hPtb z;ZZo(n$|$!-YOLC&GayP^ z@Af*4W~b2`3^Gx;zc~u$89zS?_YZ`^`BqT?h5Ls`;aqE41BC~xPyOcDFg0=*>>2+sQ=X!R9EOXZ-vqJU9>v=UYVq6doKNg>$WG z4UNQb6$%gYqcCgQ!~JG&(4Q!chBi?;9lfm#+Y?P0Xe!pUzS`|IyO}6F+=e)}di?w- zJUo~B*rP{6#=IFx2B*D{LOHyTHvTFbMjHQ0&fY9n0{D;;Y~+PL3u zwXi}O!=cjY;-NCc6IJQ;ngcSJG`gL}5=7pDoi5J=3Lx^K40ZXIQ3R2Xz*3iMQR`6T zm8Lq@f+2EiH6pXN+Hj~%dfkSib=#`a(K?zk?Dd;UU+;Gtjpne4o7rk&-o<8!oM!?B z5cyE%x_rwhg2+c;ugkS436WcQ5qYJ-jM&vEn?D9;Y03sjCXqRspMG*N2taiB;wGKsIX|`i6^76>6t=8)`2Ay7C zY4`dArPG}dMQyYPirO7EG}6->jft9#$Xl@7<(WVML_U=1F5fbWAo3B|?s6?^9Ugh5 z@s72~i^$x3r?-gS)cT5!TRoVouBaV?6}2~MsVdPlg8SKsybb$ZjtLY% zA|HbVFVCV@BJ#`wcj@VWd&GWBbI6q6XL>yYxa5XWhs@rPblZ()SHbNDm>LHY1rIyA zqEC8FJZv@lq$OMMO-QaT6@xNH?)@8Zsr7U>pE1+R%rJ)|p_X)9v=bU$miU z>X5WrP26j%t(@R(9|*j8mXH&?omJrNUyl4AmA<2JPOUJJ4H$VZWCXyn_RQH_sAs zf_JzIyuX0RR&2i!)-z+(P zt(C{GReT-keJnkTt@N|l+S*xcv}duk`Ya|^=?@rR-X1b91p_5BFs0#Aco9pOz+o0ii}WM< zGLj`F_AcdM`TruI$T(=pR36cZtvnv7?4|VWy5}S4;2Sj=5p-tQCVEPP#5r#&je*jT z6wV>8q-L?n!q1x-LDlqhG1VZu4HC4-K{mmL;?g-w?!8rCJ zSGM&)iNn6(pb_K0!!EhUj}F3)LtIBJBRI`ddIw)2hjCVq$eM^*5*^(W6}dK^OsK~C zoe^WfcFs!_{x5S(zoqw|0;`TwHlW+|Zx5rR5!Z~Li(68IaY zWlF_eNESqFiVgY)(S7;x`?w;A*|_pz45`HkbaT->Z;UJTafP~M?u;uhzI-3E^E$4) zXx7I*ff-j`d>>bU0!N!jnHN}~vf4~f&g<(y_b%bU&+F|lg+@BD6fQaPUw2g3Sa>dzLV_SpEZ3-#wZx+iExr!(Ub z*@P!M)Wg20%Z65o>k=Ch_t}U%EQn1BK!lozn0M5+OqL>%!y7t7Z?3LUjoh)P3t|Jw zwoLtuuPG2G&(W1ZutSh(F%pd3*u?K4oglKwKRs&moPohoTnpKr3G^BxU}1C*_Fct* zWUhrgml~Ai8I;aq)j=9wV3isa2%tc*0JZeUPOzzJ*hCY{V@Qi8mSI@;02Z-vd~;p^ z-9aHdu?l%=ES;v^?pU8tL05zJMO9`H|(VOqg8&?$Bc(zB-14ikm<4ok3$kW zjFVWIM*r=f#+6U`FI_SZXmxlW2!c&@_Cd2T88(PMRMciiQ#z{NRtCN1K$(zXOK%PJ zMx)zh9poA%nEGpeY_2^u;8SidO_$gvHdssPzM#%0jw&!C*Y-$#T=^&Hby-h58zD4D zqkkbO;g}VQ6f{Mo7?17o*!&ZLB#N5;uZ3-a_8K|T#4dFMlGT?G8Jzz?ybxHagv2BfRBw4SPTCXESK@(&xm32Ak-ZVUI; z*im^aF*&ZSA@eY8nYG=R881f@)W95B#OAVLU{CVD~32Fgbd~`UX4*K0mN9`(I43=1J z(o|GD87h5s&}&Tk?Y^cC*1(Y)Iwzm7Ipv$nPIB-Zg)ap1bkffgLm#-rS<+blLW_W= zEdUdLKFoOD9Avy`_p-j|bTZy_+O3Q?;f5u8>$kFI(CQAe`s+11Szk3CHaGWGoCRZ<^$JtNe-)wS8tjlq$23Px!O&MrLB%~&9ZEGH!=9HU8z8)LPug6t) zcJ!88 zX>^*6ZiDDbPgfyi0~2M~({!cTXkeA7dcQN=3dsp|;ajIW5jFeMAU;vcKuLj03M5gW zCr?xQTCY#=u%V~}O;tJ_(oobsX(+9Z-dDR_(&`Nw>sTpl?Q-!_*X@{o@tVyUMLC*Q z3T5F|VFcz{gCNUBbI)+;!XPN^wdUcIKaBTCYkx{fYnftReR%uj18ppj7qYKM?szdaa| zb*xR-w)U&#xM{TGdC&lV^-E7n0HUWs1N`Z(paFifQRI`HG$4UBJD>rpPx~pH@-&eF zpc@rkNUyIphrO=SQCl6Q(^Yk4NE&^m*BK03xY;CnS6jzr&T+HOe}3NK^QZUEhHdz4 z8;M53rg}|X!YceSB@K@%TVUHEx1MdV55ItO8Qa_Oxbk($;S@bR1$y(EIPPm!vv(=E z31K6Dkc-&(z$m$m{m~)VBnJ6$g}K%^?jvX|UyLgYY8cM;l{6Af3cZGte#p&4tcOhR z-c$2igwBQ2cCpH5?PB#hc&gIr6bKQlotocbZpvDlbepY7S80>>MCmjqZAI;Mx=ORv zob*+_hr8WA-vA=tTrO7sP94fz#~*{fZ?HWjZghdc%l84`rHCTF0#B8`WOcH`mkXQR z@QX3!!(fpxK=d-{>HR@hB?Cpr{f^SnK)2rSPn2%Ir+4-C1ULGPT`WwFj!HyEr7w5E zKUuk?;iNI__WB*At>YdP%jzi@lcCZZv>Iwl?WmZLZ7=D@S|G>;63j0$dDmJ*UM`tD z=}bE9X1A~CJut5}^_DW240VOHhq&EP8(LG_`sDvk$vxugetrq0u7SPh!5QhR_!>F7 z><}RZ4PvLZwd~aTAztrn%Uc9TcM87(QbKep8BUTRVC@z02@$FgHL~z1@K=^;5{(&k zM&eps%8DF<4dHjS?~BZagYzy16+Xw~u{$2SOBJg;cqtc81NVT>Ag;~V@Tt_Q|4~KM z{1>Wy52o_t3>e99YRUI;SisbyJ^9**urL2fTAS7V`O6La3jmPPW<`Gze=YipKs2S1 z-=V*cp$na6d8S)CgCK_hK=sHDNv?Aeuee1%@o_~; zuO5ZjNbaYetsAT76`4zXKLozZqQiP!{K;F(4+Iu{Ag)a{b}x)8pV@VR!u!JE5kr=( z6Z@k#M&9J5<5K#35?Qcu8|Jv4OmUDt~Kp~@gsZ~146SH^!hJ%p) zC2kQV=|2t9za5vBq8EYWw2^)hbfk;ml|dmNJM@YWIE%Q zcfe`f0hcTbX<2?6$0pq(c5>vuG#Ni*L{269+b{(O zzLH7G-;*f+jpbqkp!{;ma^0Rh@&DCz7r}Z9Y3>X7{1m{|0%(|xV39?wAeDIuWm>fT zp-E+AohjV%DQw>;w#YmLBV+%ItBg4nNKlNvtTSdC{l>N}+hNv4G=i?5vUg(qBiDk| zb?nnm1j;bHCN8Fia|U_D?+Gzct=njz^K;Z44ofw{@!r6p&lTHDhOQ&mg53Hw;f2NA zu##I{M=CXIktBe1iC#@@OiekLVZ^oZiSeRY=zd!a;rHX#SWnrkQQF)^Ly@3Hf{b|K z)2{HxZ7gwQX~^H<@pHU+Eqq$w81l`AN6QbSeCvf1@pnBo{HiOGvB~1Oo{eJ@jCz z2X0FB&`urlmC&Xh*JIU_Vro6*QuYrw|Miy<5_!h|x!fdJdp#8AHCqE}MiH5MI4`SXj1uW4(FMSVjpsf%VaFU)UyCn_=7CE(aEg7h8`H z3(@6iFk>tu2VTsg@N>hBcCE#RFw+PWMO+(ddxgauFQSkzEK#M4<(PNhTjn%4&r-|8 z65##I$U$cXjCsNqG9{+&v-`c^KU-Q`z4M-5in5<5!M(AuoiwiV834XGoq#8F(@ zSVPhX3fV>3%M>$b%ClQ1=HHWL^h{}$W&w@0OBYL`ZL$r#iM}$dy@__KB4&<`s+1Am zJD~>K(0?zd55B&)pbWJZRobQ`ML>(qOF%zsSxSZUzrH9nwW%KE!UA60&&*eVcOR@4 zcvP13kaKqNo^Nbo>WNN=n{^7cnTWIbguiY{bc&pVCoVwc5ePV4@Xw!9Yw250Mld!*yzGiLR?aKk~WGZM@2YPW(JwAb6gG`t17v7MzrQK7g@S? z9_U1-@$DHWGcTtuaqG)wAb589QBk@eJXFNpniLT74wrBxiF^o!Ec_NO{zg!7o=Amyi+P*}s1b;$WsHkkDJMsndV$ zxJz{U1<8(2Pa>W+fygI4u0xx=BA@i#wkcQs1R{B}hvZEivJ(=r+`A?M{{jkgUr{a) zEnP9r@aRYsXq z0FTF9`K*cE>mx||=9G2CXFj_o>xZ`U3C0M0}_yl($44~cP))bSx>o@|WFHTX^t zyumTKLhvxTXL}i@SoyFD;CUu45@}cPYLqCi-zRbX?!;`jovU|Sm+rQ%+w!6pnT9 zyn!Iqh0nZEQDYk4eU*e7iBlD&u{pYI2U_>m$y zq9$_qu_`69=O&RA#*P!aPhy_#<$Y4#C*^&z`F&C<_@1YNuPAaHt0UI-lHV@(-9O6v zCgDaBefP_wOEPnM?l!W%km+r!mba}M-gcUV32^)q(FnaGx*Y2q>|CCp8EaK(O>dQ&AF3)E%b@}%bZHT{;`PuBJAhav!Bq#1$wFL zh|SEJh#4c8v4gOK7Q{x6mS-bk-cj2!=KzHi=QLCxsX$D1zgAKK(6NeyXCH_=vp}Bs z7jPlt%GGbzH{oKhKC>TZL7;k~bk=9vkQkZZDvUl0Oz@GX0d)zV27E;H*_CCxA6Z;< z^m$4T5ds?HW`r0;^taR?P{)20FxJk(pl)p$pM8bh8Q=Cgs$Nvjz9`Mm+Aaowet)O# zO!u(C9YM+|9STB)jDd{lT)p;+9%ee#%CD1jQKfY ziDsGln+G@{u~ntcs*bAXu|;s)a9mr%ZmoJ=t%seSaRf;_k!NrSctaGfnL5mpW<2sc z%$F-XW@fm!T82`oCQd&JC%Mmz=;_1-bE4pXj znOBzMP}Lx4jt#0&%X5%!dGH|I8rT5jEuPfvndcJo^92qHTvWVc%hV~K>ffnDRcf&O zjQmO!z>_?KuG|w zu)GnOcjrgTC8}k8duLnTBDg`P@GIC3qSMe*4oboLe8%RNvuDzOdVn`3Vc8|nXn)F} zO)4S%dUJE-L@veg*d34E6zMQ@7mLe=VJ4ofYi`Q&hU<#8{yv66os^6xr0bC#%23C| z&18qGMzjvP-a1KThNLSwY?k>F)en#A=_-&SUHmE1ut^UD7V$#m>^2xzKC?>#g|~#m zMGJNbfAr>PgqlJ_19wVL^xMBnpy#Fc$+6xkySx_SdBv|d)XGa_ySh=GIxaPR{j~t{ ziW+vud~f7Lqw;<@eJmbDH#~;aGErY~2y$Kn;yc7m^6?v>CEWl3YY?@{DBIjMde@r$wig7jZrC5e7lBKrQ?;CeV|x?kFfpT>zv zH*%d4(Ju|a&lrbOiTySVyU@oHM!zS~{2R-~MiAG3+U$Nbb43x4hn4u39zs$eiev>A zX5&|6Q7edKUJ_|etYadQktL>Z$EUD!qu3(zkcy10FRl*eXFowF`hreyIuQ3PtOtG} z^-!l=4;07sP=^qDt8kC$IL+~QkY@$?%Lq02xKhYUFe~h6vYTyZS&oqBm3ncb0&5&I zk|okI;uanm*2m$sVzi1ry^ltK%$q4s-p`%q zIykicMBt~qW;BZY%<^O}cmhhN`x84d(X5NNdalD0Nr16N?u1oICRd%^l*9?L@B=~z zo=$Bt^?8F_#i`k-4vZf-_FIrv6>gp9m?9C|1Zy*FyBX3`vLLe$&efHteb?M)QM?*P zn%a0Vi%Fm1M!VKxLzrpAbcww-)b7MB@XZ<`_cga zl~)*8j{T)9@O)%}%!9KRQ6T%+?phMyS&W{y901GRl^no#_W6hb4307Iu{3+{u}Tc- z#h2hskjh0QEf0B4VV3|lv7T%$5^u$tGuD!6!%IedmyCES;W#!nd}l0p5%#-GB7CqU z!u~d8mwo#gwTDBtLC`c)`APO+B!YtrQE(HN02;^dhmVxfrSfMAQk%UiosE^!g z74)qaLf?Uo<={F=*wAOCk%Ui1(#Q3JB^Ne7Cx_5nmIrIE+RN1kY_swYxp@!}JUTu2Eh|1&(U? zc-NJn%6!7xE|YUjqBJtt*t2@hGCC*Dn`B}Bt)7AVxB6iji+YBhW~FMTJX}xUaBXT) z^`|A3Y=WO>b(B3LxvW#hkzcCR3F|TW!%_3yFKC3g3GP;f^#)U^H|o`Qzkt9j4-8+7 z677S!O~E%Q6;q-&P;>@dsb-Uffi-d~ZX>x(9qu6X?iUv32miw=$fQheS!Z&)j1J=* z-Wtj%wyhwqhE=Mdv?VpsyI-ESYRaJIG8VBDV-X7g^4M6%(q>m`n^MWXbdy~Zp#D(A z@75u1_8L0BGJkdq#?V^HnOIlENtiV@Q;mTD#(Xnd#;GMu&oCQ z8yuM`D`|)nR+9LNw_xY}nrNO)-AD8eyW}1}KBanzq9`~T0r5K8)Mt{>fphBXdOehW zYtl6&K$%M&Ds}+m1~fvNg$?3pL>4ZX5R{QlI>~A{Bw4;PoYN9*tf&v2>1zQ!a{-Tc zRoK}yE&w0MzLBVCUDOveuMcVwzft&?t;9~Y4Yy&LcPsqMa1Gg+QDdwAN?Y|+dR|92 z&6{I8M>ySTBF{lsPUJ_Mj328PCazU+!LFXoD043IxBsxHiM~-&A5qgJHmW81=j}i( zq3}o{bYsK*r!CepqsN(7MNiNs zz%jD0;y{x((C=e8@D2pD7xLBFkUth>}D@>@s1B1ay`UDf%@>*xyGkiJqM z@tH7hzH0bYphn=VA|nejETyq|2W(XS=hE@e2vu#%a;yHB@QoPlEDsb|`gRElDY9?0 zI{l5cKn~OGSrg>Wz(Ie3JckuNKR(Gb5Co<+)uWPUAo=<7L0nS2)Dse7mx(IzhB8`7T4z;Q;24NAhtD8Q)xiuEG{XTf@so=3WNZ9*hm zAP);{>X48nXwC)D;N6Y2cu($_CWGk$(gO^;F&*U!l-!q6GDAWwsp< zQsNk93s8B6EG9l>O967%Tb2PN(56XEJ}=Dy7|uiR&Zz=c%n~HG$;A-ESh8YXXyn&3 z`J507&GshFWH!>7SI*^e-jMNnVk{oc(EUGI%mM&=5(CBA&k&8)9JF2~BV3$|w`eEJTRkJ-5_ zRN~$fVxn57(Lm?ts52aH+pVEw<+tFccwk2;{^0wRJZC8daq;W0| zu_3r;J(l+*;ucCqd5?^865UEh`S2>H(y!xbFw7~6)Xe?fwbHnlvbaoR|ccfEZJ4^JY8s_A{N2+hmnkXA2dlkMeIt{?P)lAC@MV8F5R7aQU=u9p<16xYg z`rta~lC>^b>yov8LjD&^PH@Rum#lTkT0eQ#T2?`ptaa(>u_EL!9b5LyTC*Ijql3p9 z#`3I*I-AujUiWvRg2y}D;n*SZV6xahIdwviIiVi>x%}gLJZW2f-CQ`4UZK&)mpqa2 zvWD<4gI(}p@E6#yVtitd2TpXi=h{Ng-F-St?keYYjm$qYf^uzA zAx-A2F8?~v(PnZ+WW_Aoq)#eKnPLZrf0@QUn-uIevU3RuTB?ZG*HXm$!zI-3XoQ3U zJ~G1oV>%-fJQECyWyUA&)4~9JyOjm*`7o?xlEaVa#4|R`=2`l;JRe8!{0LM^49U#Q z+hYStiQ$>0{3|7fQerr1iNPn8rNmH545h?yloG>Ma{rgo!t<0CvXSRl-F8kRm0>(j zb5OT(M-Drsj(_I`M|Y6wuuPj$MDOo!g6M{Nb08|Kpyt>k0+VGZzjNL>2hNmC^FA-yppbj%<$lCBc51hWm4=r(-{-a%T%z1|0Cg&V>erWF5pGm+$`w#MR(Q*e{;iPrz-h7h0^qTy#48Wt~ znb+oRle>6e?)G@=pB8Z#N%t37`pFXa^W`7L-O-meUe{NBd9OL_)w|;W#J{aNm}K_3 z0S}(u=Y|&NRmT228p|TOw_?7gPpYnKu3D{mMSzSiQ)GgSmI)zY<65-2Ys_ZL6{-E^ zRmZPOKO;^w%Sq@`51U<)uoZ{T^bBJU)`C-`g1a>#-sL{mqfZKEEg9HEX<(lSOgp%L9@DU%%yL$fcTOh*BmRs7Hc*tlQu1uyjuM!!i#eO-FHek{@3P)| z@|28uvN1B(kcsQN4w3xz=H@D>_C04qmI+p#UZu_aVU6o;`18KBW0_FOOZ$0V+R-cz z<)vL-+DCS2mpKle(S`l=auOVqgw3=}rVHAl@IsIt2G@aQl6B>4sk`HruBC~NV!!uy zNf+Iboypb9w{3?~b#Z*zhDzx#WBD>8X`$Di&Uf3$ME@5qyNkE0ana?Kh< z8Cu&3v29{MjbwkP=4`u3_)s3#1HQLK^O@w$b&$`P%;zBYu!-Z>PVLF@sY>SL@ z7$4FZ!Y}`1xd6=DYvc zT(>r=w3w0fH>j91OsRo3IaB-W>wcFPC|$ZYX^P|+dKB5dG_~@^+qm9^U3}P04ad@m zIb){wE;lEp$P)!7C!R_IcI&|P`O|wO#sX-Zg6r0Em0OE!WqCWN+|EKNT;9&*?VNTy zOXyMF&bzvu%gcG`<$My=rppUD-*%Rl^k!yTuw}lSvSfF@cTeyLe0!>&&2Of4Z&o+4 z9|k=>d1*OmnvJY)6#2EMyr?T2yK*Byy4g7|M)>WQ`*^P}tgphOEhIb1qiHXS%G>by z4#vzWydO%lADd?k(!v6sSd47`mY}0@=#gqKG>MaUkKtATvB@6@3xHK_aO zPgo$%M}HzNR^>+Q^Z5eX)DbQM)Oqty4;wcYdwGZ1GT}pO@!uYk6~>hx^3vYfmbX9( zf+b2VLXU)IYne;JN6RIuWqo7a1da()_!S@{(P`*UNnJAc@nmzK2l8NeI=NtrI3 zgpniZM^aZM+GkWIT~Z1(vr15jhB?tNT{$KcjKPuDxso@XXaxHQcg7 zSnMj4s9Jp2HYdwzq$Ce%mJI3%0^O1b^c+8YqRzMXzVl9LF+AZLUm$lK>6Dt-2KxLYz?$v zNm!vvefU0DK3@SC-JauC*ks|^ZL(lxDNP(3YK>xBw&XTgg_{W{&tMGj%)E7o8^w=0 z>Mpq*R+pLd|3xX;3_Ga$E1k}&%S%T3|BAFt8R-MjsW;C%R-x7@qrJE8^A452Y05a! zt03oy>wL6?%%%Lxal7*#QP^edUhj%~onPDO_Lh3w`dyFc{n)QK1Ht%`l+{RHIKeEi zqscxuohMybkQ$;V_$%t+!90dU7E}Ht?ykZ%FX67z1cwZROx&g4aypUxIKzX+oqQU$e`ix&IAm}DT6`NuqiDmw2hJq?ShKe_S=huOrW=B&#Xlntu#j=( zd*jFV<`3ahl5+r{QCZ!0Ht)WX)wggc&O5?iijUCF+xKfS!Tx@y43O2o$6YWpMqv&| zrZ-oK{g$B&#}&_{t~gzmj6=+eiS?ipjn1*bx}9^G;;oG}X#1K@sS6*p!gtqnYSIbS zu;~V`+dr7ARl*G_Bn;yU_FRj(dPxpS?EE7IHKJ}wYdQ@r67g95yElMH1Q;5`~J3 zL7`7>xb%_i9v?tYG^Q=3fv8@wIyJZE1qPh(&Ku#5Pu_@o(V?g^a7>pFY&`;6_{ zii`1au^p=&*GfL)`1lMdAKn&d)A2A7L2kOZd(<*!;`lg*Vuz|^54Oi1?BHOm%R6js zDw{9~nxAXvxiAX8ilDVu<{t26Ei05mYpmrn=*22gYM}7YDKA7E+GRI_$!(PS8pgCWT+v?p)Sl7XtLN?ud=xW;t1oq1{gB z7XSFp};E7b#Ax$t*)Qr5Zh0|(%E0Lo#m ze;6Ne6nwr6K<8Pj47Th{UqkOrtrt9APn8!q-6N4ir+pua z*N(fzL*d8TI<7bq!CyI@MUbOv10~BXNPlyS(D?lDVFD7JeP+b%D*7K&|$b2}|2Y}GcW@;`Fhb(x>fwgFiUZn61Ti{6w=c%M(a zgaOf6xy{x5&gJvtccLK53ze;)kCr*Nd?zL^T2=qr9o`TA0Y5>i4^|*d3i{#uQCSKO22($ zy3~cb!Xw0)t$#R{S@WMp7B#<9$io6Bzg^Kg69K}UsIiaF;cZI5Y@!ENNs=zADWhFp z@n$mX7#~LHnIj_!rbof|_;J~y_>6*4d`&acF(79KI85g&z8@qgm@xXdLb(*#g*KS}OqW;t#e`vb6A&Hq3v zmKAqBCP*5@SE|XE+fG=ZaLmngYyQ%o5Fb>8vuQR8ur{1$vP_-w(f>{zs!{`LMX*m6 z{`vr5z9LU<#6F)duuUDo1ySeCKRs;RSX>hrq{HW#?+6Pq<0}fLE_^h2_!;EDhk6ON zHNPSAg@Iji3B?b_6-c8`O=2kFHO0lvYs>Jsrm;S*{JW#g$Q-jTX0E$%UR+#EsXO!3 zbIqDxeDHyO@p7>+zzu|2rgABut^h-+TGlt`LNzS)VvZe`*cZG@wk7cL9OR;L<;U0_ zo0a6XydkB&U>4TXPl$ zb!#!uLyJqj$-1qcot>qDzOu04zyhtPyhuV2p^6?-F<8N0zx!SPjXaJ*?0w^~ZNrA+ zPwppVSX1jQH3-Yw{_+pcCb!pOZ_k~(=}$=Ndvr4+sQNomk?0VGJywxFCK4OuAe&%A z0SbnEDubx$S_p{f9Z);q0TvcWHxwHpS0$r|kCta6le_GnqnjCZ!tSX9bD~p|=xAaE z&5%p*+^HkSC#BfdX4EAb6tBT1HXa@RmyV#~iD$SNf=^uw%`KCf$Gu;pBFXn zK$4kamjpAjOki1&Lu@#4b@t=RwjO|r!#5l>V*Gd5CHMHzLD+GK>xgCekVjK`2VaTs z+(%?h#4L%9?um+A8&4)wWBtyEv2ggUArgA>rqqc|6)qRYa~4#imggX#M}9}=KOs0P za2q(U$%2>=ZcB+Xx_)$AGC%)Kg`4xsSKjQEWtv0-m$l_>#c{fv<0)}`JW6RNDAcHV z-Z*dkgxDoHO2?!CL_Z-{5adt9z%IQbSJ<7U;xnU=KOx6cdCxF0P9;XcVf}F~ACoi! zx4z=q{tjoBQYcPw7_H>Z?Uj! zH~(zVE6ZM3{FYlaGtv29L-tLx<{2Nkl-PNeZBX+YwDTDjF~)gxjFi={y6)wlU&9|V z)G7v~Km$1t| zPVjRF{bU_FY16-kE6d`H;~eoTYd*)OerbOG^#1mx05~=Ps5jgQr`La<3y1yay)~^$zz&85vCE5&qfM= zQQ)-Q%8vtz9AAFsX>To;Ap`zNn-SeJh@R4B-DAAAI0#ak=ThH43M37O@#je6$HD=9 z>%=oz@jfPhxif<7(1eHP_z^kY6l^=loiX_XVb{glH)4Z8=Gu=Sdbk#vVrnAKo`}3&WyJZo%lzGeBjh8ia{hR3qo9Ol<6;drd&fRMU8xBcp!t`M<9WcHb zmi0}=+BYb-I{%5gb3$^(M?r|3OA}(UMxYWTHU-}`QUhvio7e#PtL8U+fw)HXj4MsQ z{58}v+4%mPYnnWV*aDXsIbm`<|6j$I=6&7LHJ&dF@_$;5*Vx4uZwb+z3u#uL-k)pE z-MI3Vj|arC#%9siG{vmn#0uP)@}jbx9^Di zJLp0U>bRfqeQgYq#BK76apeqMT%cD>lZQ-lkAlyb;EQ#gs|vWXQVO}R@e-%lIE$*Q zL*>6ekgT;1dI!7em$83sILuQm=DZoaGc)W=euEG$)?B3~(NiJAO|r>X^-OSzUKyGv z--6GBh7D}jvWHzg^<)mQppdoSrjDA8MuRQ#;sX6Y%R?Fv2VF;V%O>He6X&0+jj@AF z0%QTRTEmP#fir7y(&H?M2E{_94TXJ1_t@99eK8KE8HqZ8Gt+stq^fPNXg*9b}B11nq;b|ho0WC`iIb4VB6L#o#@~* z37BCUw>o=Li%v&w7WjrNTSc&od|Q*1rRvg)YXBw8a5Rrs*^9J$W9qyWeu%Z=jUcOh z9=I?FN=uR;6@rF$$x1Me5T%od3#Xv{4jNbf3S=rc)?D)%8M^w{Y8^GszBIm`MJDAh z?eo>gYi}~458D{0DaL^sy=NIJe0DD0vOCw**gbM})BTX$^orQj(wDY#gux3MLHXqL zM&1G{1~cP^ClnH_)8?2d1v6yko@NzM0{4K!{In`~t_77pRds z5oVHu9$(&JYQR)d`vZ_to9M42TFp4K=rfmZ;B>#VZTy&}L36nYFv;DD_m?IGE!ay& zVlvb(;%L4!b&&XND``fNr5t(i!0ebg{!OzvOf>=VckOoOyGFm6cOJk~xQ`$3Vgcs9 zthuBr!-B6t6AjyNd6hmRgentAIk{?-B_pv;gjQc@#zc5W){yKAUT58BF9Yh80-Ox3 zSVI3LwXL5nqymC{a7car^nRb9`fM8ozyz%i4WO4AyYlx5q_>`7Fc1_vdj3_K4YB&> zQ!6;FkGq~vzb`Yrwfv?GC>YXcM^IXAs4K7^X zdre$SjqKrM{uIWF{7%0GB?gqM7Q&zDAB0SFFarOzqz+ z3L`MegVLz_{rhLzfbW>fh?*KyJ_Vb%O*Ct2(m$B0C)Cggt;{-hr)TSC5-6`hpPB7z zvRV;*sW-RjgOXv}kLlW*h3xRT7E#bXzp0j3Qu;==qKNT+Z7sd%wlwNT;ZYj(OQZh5 zjr!{ombkG$ldkN~5VF!kApdGZ`~ND>fzA8e0=+#IPlMJ9PlHzJX|NSf15h)*d6-bc z z{`TMR5#|R&SoHwgu`#u5>dxlOY$&;9LqoX2KpX?dX49Dvn>AXnZ0^1@xO0v!UD2U~ zz*!v3iC{g{$sJ{ja}b1lAdFP(5QCZoEwBp)_&UOdVcj!-h8dA&1%4Bru7mh%YBs?R zkKKvP#U?t;#xwb)8=F-f-Os2tW9}5fv`P5)L?RjBSpil?SVYXTTbl_Wu(%-yX||_P zY@ClxaPn|8u(1U%q<01*~VbBO!VAfgAZ?|{t!T^QSUd$&~PWe?8n?D@pN(-|&D08(dRheIT|nOo9zl zNocbMc-o%H)(KkyDh~k59o0Q-q>UOvR{%ptRUROAc?BK^)flEf%6|MozywpI++*8j zu?rK=c41p2|Njin_H;%u;-(WjQl7&O0G$(uFVP45jyz_V2+Y z0&pJ4G#Inld=^g3X(ux@9vl#w`dPwnBxdxF`&YcYn_dz7nrLW*gjF70pmwj(086?W zH^tXcbC%+zVOyT5*YMr67WC)O#P>$=8#AOK58zS*4m#Nh0;C}ByaC+HgSU|Yk<@hv zraLgan{KTorp=~aPo2cVrY5Kt-C8rdFV^U`AqW4a__jPiQ}ATCi}?*fD-NU)sQ}7z-sEjm@klOS;pCyW}P3VuSviL-acgEoWa~0 z4QZ`^qJLNv++z}Zeg-Z#{y1mJFTyAAZz;03^kkxk$k*Y9NIo#vw)P90(U>=ks30f= zyLdm#lAcDI!atztt11AceiY3az-F0PQHVT#lWT7-mwybtWHlD$Mb(#{=5PpsfWgs0 zqd2HI(v0{Ch<+aXX_=yN$}!<#*!=Z>)Y)NRDEJ>M58&4ES0(N}m>Fu_MiZT%a}TpU zqjS4N=MtT_gUp-J&8yy68$jFsdA+x&%q~)HSw<^xL*qfsB_7y9;gh?07C3L=CeFs zSPr=jn%APx6ki82Ssf|OI;uiH6Y5sa63PFk%&CwqH*NYlt)*V?SAy;Dv`fV z%FkhZ33iD%yeT|Sa1k-Y1VuM!##r`hR2}|N1 z#{nrb%<`+VRe+Q}OuUwP$7oPclnsvnCl8uNu`jxopR+Zbw)&d@an z=@ZDyxhjsGv0Y5r!6fsPv1jr9%G#^!eM;M-to>QVz2)HCI6uk%j&pF*UN4P?6hfZV z+$Vd1B=^|``%EG*@&kSdVk0^CA{xeNzSJ;Idy_;r3u>ZqlF<4+3-cn-Ww-~R`e(@e z#2Upf42e89gS%q+-ITx$`I=dEKcyfL`<#ERK4v2BZgD2cMXhtPWSmLhMr;#O_T;G? zyg1-wpoT{)fADMbb*|XgX6N)Td?S{v;~8JwCDAty*h z8T93&N(x2fE-%T)=^uJ6MYm=6Ulbl?_+J_RcZA`8c?rv=;eR{u>Ru!KFKe|y7p>yqe?|M;0=+$z z@W1wo@V|B${{_6EdmV*x}BD}WlO~bh(uCpbC-}Q-g4W z8h}ek#qcSVcmXO)bY#OpJO@qmB}mLHyC56RL>OX!49jyteDz1e!FasR3-1(C-!KOS zmj8yB%-+xXw@eLU;&>ujDZMd|gyV5(CP>WIB-S$v;R68Kb4bw2e8BV|2Pz-@@-hSn6j5xEu&D-}ntlZxDZ#AJ&A@)K4T^7Ko@hE) zP5>@8cTv&Ec;v{(&{T>547P-m0rZ*}^bWxBQRqf$uU>yV+e2>ZAgE5`i7_EwT@H|w zGgre^76N=(>gur7UXoX*%#NkJ-DV!^#Nt;cvW|YT%S_ghiDl-pmgkbpW-YzV@~D$e zTWUt@1dODV*3oy7oYv7-iKN!i*BM!@W3bM#f`ngJXo{BS8Kky`N$LF9j`T+p}X zGOlR4c`hE~#RAY5@M>I{6P@D3o3DOPzY|r22rdobkn&f{iK<1n8A+|PT_SlJ=;*%t zd8;EynN#yqN76M%$AApxaJ7sptR}#WQPXiH?sXWusz&g_#+qCE>$ox=U&!B%FKS;J z%JA!do{h&B0MaH)5DoAXuuJja(76vDv=fHs%*@qGl2ym18S(8I3C|ue2j=^q(w;+w zPv;hZ^IxM>3JVASb9(abC`L!KcSl`SgyUhJY`!>xRHJ-pbwULY+!IL0wcefD451_b3=2CC(-vg+Zm?j2OL&n?j6Q}GV!tnd!%l-@yG@ecYM==VSPiTHuR zemMnu$Mbd#iesPnP)53wbq(rdUJ3E#pPp-w4XDjLU?4#^7o#D~GjsX~9D!sZ9$_Zm zA`GVn%?Q?g_Z;Xhl;v4XDsjq~5N;EeO^3<+3!CUiAYpG_7i6wY2ad9c(%MSMJ)Qeg{Fui^Qho>cVgAdyYu{1Adbfe5gx+5|&Mq$gF3lTEi10Ye7L5 zo#LJ#Mf=V>)uIIV;}fAo4&o z&n0KVsZr!jxucp(=V*?#88rzcVSzg7*n|iT=Gv%ZbIKE*s6@k_LlEV%Fv~Tne? ze35kA5QF8J=aP&d^7Jy?H}YlfNKQFBiAQDvk7V+W)&2@u-W#upX6Zz~^=tz+#5P#f zMx6vhiHcrQvuLu4$YP>tD&n;tB0d{wDJs%ab>#5cDCoB#t>(m%RQ!o78(bp&3Zgtm z2(Jos2(JyOIaSu(*hd13OOt|f^d%!7S;h^&z{9tdUjiYMWLAn|-$rVf7=^aOYk*)f>Cd|7G? z9^Ml0o1llW39uqM`bHk_S=mqvO4S5HGlbDN-gL^n1(p!bLcWYJXN3+aBE%PupcL>l$a+!O$KcA3a*gUp3{BFJEVwHKB-s@Pjigfo z3-3ufC6ulN`*0Yl%S@-Qvy#Mf=MVd3z)*iHJdOuCcARklSbnwFu?ym%VUlsPUQU^ zHat*bU{Hrp*GZI&Sz#J(&dwyus%ufxtub8@*OUp}&lysQdk=7_bs7zHevUfBVVZsQ z#&WU2NPMgyK&qKFJ2*aSXl0%paZ{^r!2I;y83nd+W>IZ68j)TiOSvX)*gW~V-fW~A zan<-d>!>@Anp9&YDSVj5LGp9Bdrvv=zK(**5hH0qx$U~mU-Q{@GuoBW_{VG6UAuh2 zDMsTTdkFRMq_;0as7nK8X}~;y0rL}Qeu0w``9rcOdyJQ1l1%K;_5+~#lCMc<`iwJl zSzp7f0xpG%UH*@HaZ~PoZKjYsS4dYNl(2H37`Xs#kfW;KzsDdCHp4JYp~VgN!g;X4pr0D!#UW<-QLM=z1%={l2u>?x}x$^;~kqePoJB20KL#4^E!#J(M(d74&z9+&qqmkVWHh$;!1Eo!d9zt*fJi}3u?DHYY8@>i;-4kf4`BlE zxk1fu>x+Nqh0V?2)CfgWRbq!5kWdZeF*IjXQYa11`!G1ib%2+8Z~q48-i8L}ltpZ8 za4x1G+>OCGr-D{=TN<3B@F)$=rNQ|K4bFK9%cchB{VC4ZFiB?tA?Tu4+$3GJ&n=MQ zQ!z>RSD2*xrAd0LCTU(Kxim?yL_~q+GX9;cNxGkTF~pajNd%ssNm@jzAAw0aHj~mM zy?c|ix6om)<5p?x0ROUci*%P;q`T``q;uGhw`#9`Di-Mzh(In))TrXxbUGzA=XNb- zBYej)IoLNdoNlcbpU8^yMyj5JQ3oax-C=6Lefnff)R*%G*4(48OLvBY(k@-vr6Xqi zfoU_TPbAI^(P1Hb=99~okgR3z znL4qJN6@wMbZaV^QC7R2f_ytQ!S0JqSF)-4Q#g6!afT3I8jmydIDtM%n12stJdSJY zF7^KYjmP~BjmIgA*w}bnOqI7A<8e+^s_3>f9!KF(8jnlk@evx2^AeWb7>{?M;$Fje zoCSoSi+*wAanU}vK!#7ncsy8PJRX$B z!FZ5)8N`?W>@6!jg`cf?7E*ny}uQCzcX#WuR)&#C~KLQSMkPDd2RTlSl;JU(=9d6qQ-Nuj9R;45~W_z8sr{wFiXa*TcBYPI;oj3L8VXvQb5npqGI9ec8W+pP2G zxMa?3vs^YKICk)2ggs7GX89hgDJ)7lG3azdn0#XN=1g>FhKPD}& zHo=Z%hW1t>36HXNQ_hCehYp^c$!Tyb?gAI+SDT~SBgwY+fJx8JDgzFDrj3R-#i=YJ3!X^$eH3EVzmQsDOS+iq|kse?Cj?A9mIc}M^ zF!U{XaBrD{V1)EX6VItu`!cSayALje8ICLG4~Fv~{?sik{L6nRDl?BO=L>z}|7A|a zU;kKye~~FvEoNrcmpYhK9j1EWvk}Fpa#~o?Didp3#a=Liib#qN#GP4S82=ZljVo8b zUElCoUVXlSD$i0eUtuM+4Pgrn&6>gQz_uAY2@IUVej1oagWp${?S5pMkMLRStE}3< zLHRH!-2wPEiUorPKNr|`2-H$zWrM$rD_7W^!5-8R$n#&6CKQnlI)?tB9D(j(BgDZG zytc9C*8W&c1L5ztI)QWJ&6<-x9jpy_WO0P$k; zPn|~{RnMg<^Br|uo2fd^tM#x$s9*9gR7*p0R==A!luj8GmA4$%c;rex(5%TgdBEby z=_nT>V>+aEhL}$|OLv)&`_!YIUy}(j9rET5Gd3t)r+o!XlHojdm~FTHfd$ zTh4AEF#EI*7qkth(!YaSi9dgOzfYJwy#mc;CipTF{8Mr`C>?B`oqxtUrL03nnP~u| zpW9CbpH=~Tzb+QcTEDP(9cxfxRKI^uy^q7P)`2#JRgz+yJc6d7Easde=1dQABh!?K zMCihiU5zA3H+9Kj-L;VVxWJ;Swb0mEDE#rBlAEPb1W6aa*@`8)8h$jDEg;%C9WfK38R zjtqXAI^P~+z-N#vT`czDViDJDU+TmCyI2f2bg@WT#KtZb#nj%rak0p0b`af`E*4RE zlr9#fi^UPTSmY%vo5rc{)Z(*-V@1}wgD!@}9V?3VxdqC5DvlM+#tP4hW}|ei*ph1n zJBYCTAeOu_y}7`L=j~LHz(Db31o2MRt%9vS{T@gF;Iw1ZxdA*3P!BII4Ldx|3cIOD zcyI!79HexDm`?#%Pjvz=8C?7oJwE!W@dPID(DkXXaE4BWL0CMu+k==&P1I?0cup5y zwR$awi_FQFMYmUFIEM!!ZJ|y^l3Pfp(P1teX^GI&^Pqz+CukBgD_U)cRf$yefekl2LZqByQl4-7W_u}9F8b~KC^QB zDgix3Cs6(VUEU)waWknA?A&sK{7_YZs+~rs3T4x$Qw9*8hFCgH2t*x6O|7`y`AGj|9ci3PVHL`Z0bV1mM3qnE<3>wh=J0Ub1 z8+sw6u47|Agra)l-FPD8*42xSOJ9U2JW5}L(ihl4 zJ!b)c#atQI0#lD0%}3@oe@arzu=TXcHx)vErIPZGLRY_2#Nxj$nsp3 zX#gOJznHa%nh;JMET@905p4MS4{1P%R|rNFMrqHb2K|G>ldCe&C(ksgIsNqV2Dz4H zfEo7cxA(t&y!`y3Q2q;Gr=4iJACCDl7^?AMuU6 z>x5I|J`Qwo*SQr9Zhf@jsCR3VDS;sMzm6;8@u>C%D}TIH{=bGY9FH%?p^s&Ov7 z;W-_Mn;10+;hfxZjE2esgK!?q$t|Q)fS38u8+??QoC|0L)?3;NH4J`Vchpg#%vM$jige;N$B!Jrom4uio_Fz5$^K`=ND z1}DMbSul7W3~+Eb4Gzb_kCgk>>;VmlY0DK1&|12jar z^(W*a$Vrg`D@Rj@0>C2jM}dBz%Mk^;M$HQX@;|=1GQRa%N8edeko$YU`0qEzbfau8X$*~E!#cPa$-yi+dc$>FC`tSa_byM7 zB3>o1R9V_s?GkWN3+zqi%&Y({T&Sn-Q-DOOpm@d}Cf=CFjEnFGA)Zc9yv1sD5>;ZNkgZ(t9*5uIWQi*-wkh+(NkJ;J8hC}gU-gbxnTA2Le8 zN*FI}uz}`avRJUPTVT>b*uTvsP%RkW1Y4Hvp_vU|!f-T$W_<3W z7BO^-Qe%zfO_xd#EVLG)5a)C~YMLTAY6?W|4M7XW?Zg`Hp|gwhf{hUxo9G(?$=gF^ z0OCL$zkt!iB-j!Y*a1}`=V>jyd1(O7xH&ZPflvv3o!`Ww?*t{vi^hy}5-n7=n{qPI~70<4>i)zbCy;x7*t; zpt#?=6QFnvI<}chZQrwANxi*ueC56~szP3u=N0?kOo7Vmr%Df2L5ZJOdN8noMFK|m z=_UkA14Kh0Xjp_z`1{}>52qF=NamPsi0%z9JZi#a^>5$gHpQy1F)N(qw#o=DVfG1# zCywC|Dk5aQ%Ts>I?C%VtOQe~^{bsT__rzW-9eY9H6<$(qZRjiyhCzfcq?0Z)#)KwV zhUWBpacUP%JV;J)nIL#+#L9wr7?@KgcFh9Uxv}doiY~ycJA=X|Q3?>B-vJc1w<#1> zH;&Druxp|i?g3oRi}0|A6&`jgc-W8FA?8Y4{Wb58LWxkrpj>;SP@+2M(x1$uJ0t*Ooq7Or zO_V8@h~6>56B`hvfNO;i) zO!}1oHY?GL55sq87^s8ciP3!||B~0pKc&-_fjBLwMHl`enjnVb5#WONpJ@u&y4 zyOl-C;ItoLMFLk5cVLApSYRq(8JVVi17bFJY=1Tnr+Deux2vLrW+fnZiO~F|Gx__< zBW_g1OZ_t{Ar{B1>C1v81M8{0WwGZ|;yA>Kl5my4+I=X4wF_|%km^9@#87cMsd9JF z2*fRaibN?ndm;ROfRHD*pqFRF=tSd?97QitmtFstJcS1;s2aUy%37tEYj0l9jLDTf zZK%WG)$P#BAvz49RorovZuPl+_=Wweg|eIUpva&4gIas<--!pYX8{RIB$@jgtkhl$ zK>{{?;k#0B*0LbkOjKP~TDauT3VcraIr4(1QsRYgro|Zbl>ToUf=}urRm7tVb#lTF z4j_pGf&2y>;}+9zLK`qV6!VB*QD?Ll z_mM1Yz?}(jFWZV8;J2z#7Wj6gP6WUep~xR}@DD8kL(Q-l(96XcOK8`oc9fL_MGjs?%YQn>Uaf6>x0A3~HeTW=4)f zuuIU}_jMo~tU80RXP^q-Uew(9$7xYx8pN3FT1Qt(U!>AmiU(T0 zmai(=dtC}UmC;OvPMzDD(@uq(+CFaTek(!tx`+E#?Q!pcH)0)E2&Do>#WdW`xwY5z zFe5!*CCb|X-SPyWE1~}kH9pxMHW@YUu>S2^MA!H4^(M1=1#l&jo~X)Qc$UKGt7YF< zDbJL+jn2=6NrxFr`v$#(!3Nh`*hvAiW4-{bSSw^R+tqi8Bd&g@3*})Y`Ag(|3)^`% zg733i?()h!q!8BNU0f*bJ|STFQ_J-npC6oCVCp77Gk41>r{<6oDqf#LZh@KGP}bgK zE;QtTe^DMkD!|Nx0A`ZG3vk=-05Eg7DPTr7j?DoxYX&#&2{2POz$7}Z05frZRDhWZ zFtd+?|s_2%i!HOPU4ehqv*YlQttN@TG;*_bUXa!Xwgp&@GUMk0fOJN5tk zb2aoFpNKq8@SkV{|3xDoU4{a~B5c;w9=$q`TE=SU!4O6eB^FFlI*%B24R8X>YaA+> zZ`2eI3K>g>S{`fM%kGOc8g-S<(tKOsTWAV_`Ril`4%c6BHVsjOwR?$r37%rp4A&?K zN}7#Y@*A+iJdo}N`-1xd#?lJE_yUb>+iZUBwYcbiNwd|n-3d0a(;!Q?36yoa%18tB zUp55{P-@PbU~uO#l{I2Ky0&7M_M{ugRn~KiOAu zfJ)LY2%3g$PBo7vGn$G^0<#teYD7H%EP?4p?&_4OI{l?*qh7bwf7TkD9K&4x%NMmK z-Q-8Z^gl3rLoSH%Hipqw@{6+%tKEQY?(1a%Z&{fR*U6e(+U zk6cY-rK<19g~GX^?odfvR}YNb&Gr{CEwZ7!YwN%?s5c4BO=P!HbARf=ysusF!gjp( z44IgM1IL)5g9t|$v`k&hrYH6Y{e^+#V)j-hyi}KVbxWm+C17)V+|1`(jMr6?uo%#- zUyO9Cl7u~6lCU$2-c#M*-g9kck0V)G%y1QIM0ucpDP{q~OYsL!5jYA_peR-X0LIvuC5kbO_9QFs#3Meh zYzr_50I*$+RTc_g2{EE@ zIg(mm`90_bHu;@er7|)M6>zDV?<7hL)xUiUcOA&m_VA^KIb1fLU=CXPJpPxA8Fnhv z=!2j}lkt0qT<-uidbBBOR5y;zQKM_d_wNZcS{7p=I<8Qoaeh>&(F!%XkEqeo%4M5r z*0umAxeIXgs1V|LbO+$*+P!W?=RO(WXuk+J+OL44+X0U9h4sn4h)nxmv9p-^=38nK z@W%Y;sn_}$>rEBGr;8))XKw{b20T$5DF=_b@qI|#bi!8kwOp%LRmh;R- zou%7rq0Shp?{%)nZmZ)?97McHM_^AG#FL%x!z-9PTh*K|L^yvN_KjuQ*dT_0dNR^{ z$V3Wnem*s>u{9wElEQ!>@(xF2Sc~s$gP45pY<_9T^@YFU&cZ!79oxRge&QKH{N>VS zMTsq*=FJsnB$2U2WL;k@O(=-W);_$vPMzNvC!wa7;#QDj21Y(aq2Iwm=KP}W*A?iz zSW+_;4GK6g$HFE6u^LgU7sAaV;>DkTxe7IygKs)B>dpNz*fe70F#UB3nvDPd_9YD7 zBIdyYyB={4E?L&PzaDlWns@M)5W_vtP)CSxu#LH2RJ?5^2tcSvsLK=qrL4B>_vi+>IMU!W5WNm=OaghaF$3;mF** z*{K&Vur~(@Y$5RPvV4SD9lyEthG8l3dV^I8zxiLy|5;~g2van)5_N!;%y-Fdd1|(- z3D^q&T6(UMkhG29d@1fJlkoPRuiry$Q#O-Xxifh_$*feCu}p-}AG^yCX0U`OO14V= zC(BI9+C~#6I^`(AEH$963=V6BUVac%-QZoR^l@43DpcJ*pz8E-&p2IW8fhf zCX-gLhX|FH($3jcAszPt>G*@z8QnIZE)yUqcDn+M@x7;Q3{xWl)T^z4z2e10F?Zy% z1}Oy_qRSjOCaRelUkfii1Koj_p7p|ShAnM3o@No=-Zt1x0oBDoZ{e`9*4bXw4t=QF zp~+w(gwb{YYKsMC?*eMmjbn3A+nT|~djhqU4fu+VD^OdU9~G#r0=4ZUsI9be*%Z{a zt?>3;&}{ue+*$t)XtuR`-HNh(GHA9z5t?mKq1m>AW`klx*aPItTgZ`hX8l3N0^#r55Br;B16Wb6JU1D+^~?S>sfXCk%;nGD$>6R>4)e7_Wl6yU;E{Z~4h*Wuz< zoi8W|hn|ybVyX{6ICMrWY`%hehX%wW>O8**bTMNv2dGnqEu_EEpRsv*taC&a^x6Za z6oiPpz=Y-I{tKh`S!JdKJ7wsd4T{C1)d#PzM`pGYZxu2-_B74y*w1gltC}C@Upsk8 z6c-LXHc<>VK`YcEd@iy+L3uhGvZQ5E-b}QPaSU?vT-87VdFiptkbA09-#S6}`%L+D-t7jn<5qa|-SA2F*Al_@ z{8)Qr{zu=)Snb=2gKsf}9Og|4wTS_@+s1??NlE3B5$Aa5-GIKL;eP*KuQI4SNU%BS z^8;_!4uZ{tO@qz4acmxJUehOdPr>H0ep%6R6>N_4qY5@x!RCDoHkVc|n+BUV_Ltu! z$~-8H2M_KLWnR12t!UZD8D*aPa7lLdPjGIEG1i+M^=T@|T*a8T5@Tl9e4+{fzeX&F zd`qnDwChNKVLB??P4h?yf zsW2i7?-!H^imrTT)}l~ugGced^eu2DHAU7n;B}&sVcVk6B>XpCDUr!oP%;*eWT8kU z3K_rt`)^m4U@$}sS?lh;Bs}&lQv{X=N2C(fjk0j}mQ?MBmlm(Vj~d#KZc+uW18_!QOI_ zZ{hhwcq}*ccPbY3D&g*w2H}~}sIOt?)my00kR7Ryqr-ah0sN)$GefV~Te<@_tm$rD ztMhzkt11rb_*(CLUJ>0^p4K=&Do<1WMSE8991>)onikMrg{@~KL1yp{X>+GyyRBC=p*xW_NqEO-pO6L$SJ7zV3J@b)H-&b+_;oYg|&Dx zZsNlNH}PTRCf<&l_?8uwxd!0Hm>LGLmO6ZKiS^A3g%tu@rV> zG1nrvC8kpDBY%YPP!8pT19Sl{3rO-fW!I1(7l-Yjh3&9}-TctIzP&;9PvmvlPOEPt$$CQ&JQ zEkI*D!)5r5cuGt8?fBK2r2iUe9N0yEYvzYm+_2!4PB~xm+}N7?M+&hoBZfcj^p2|Y zH5%T%IA04KquX=RJ`xwJ%<+%M7QiS>MUVBnM~J|5xZH<2F)2h9ItUa3`xQDNp6^(I zew-8T8|BU5Hz?<~gyMT1s6L*F2fVq^N_ui&mY0zCnHz-+Qt5kh@DNQxP{#xmnyf0o zKBTnaT{DS+56XkctZMS+L zeO$iW9Ns=^U+$g9^<;gyM+LrIwZ!C|T}Cy7EQw{fAFTM9toAufeEKo6Y|0xs5%=mX zlmQulf*?88r(Bj?t0gR@E&6iLF2rg2%mS>@5A3&1N}PBxS?;;=+d8Y!(f<2w#T}AR zzQN1D-4Y_@F-w#DQ1IWe;tV}FP^kJyX5qX*d@n(M68Kz5OAwq_apcmCxb4p`yfq|?e|`C>@wXR^zrA?(Dme9noAcn^W$?xi zZqI{vG&u8v)p_u46}VI#3J4*d>bv69*Q&V!`4X?07+{CEC^E4;7 zJkgiR1A}lL%*pLYlxN~YZ}3qb_k!cY;P@yw?gz(%;P^N=J_(MW1;@{WV;mfhgX2kX zYy`(7IGzS4-Qc7boE!!xN5M%yI2i;d$HB=-aPllTc^;hLpx+Dnhe7`+==X#EAm|?l z{ga^oEa*QE`Z(y1gZ?Dw8$q80{b?}h27_KOI1C0y!Jr=u2EpJs7@P!yXTjikFu=j# zG&mdwM@F;N{C3>x^}jzBdiiwmIrzOldh6H=wl264hK9w6c~OBZyS5njwga|y0X5_Z zxH{Ql%v*l|*0yY~!6bvaqoqTyu}2!AC%VaM;emyjDxi9H@p~w5tRqDqxoBpy)ao{( z7JP|#3Ys~Q_>6)g-}=wMWwpbh?7F|hAXhGiA|(NSJBil!zfFaW(!)ehTTNkB6=QP>LN7@ zxa@ESvH;pNDCPzM#My|kdLrwHVT<7 zMg8Ca{UHk*FbFvdtg>v6wnd`Bv=F&n3Vtq-?K8?2*KP5%fH(+}#H#mc)>!Vkyn%Y3#6X_C&b-hm8@5TTMt<8S`YSp_!yzc5BFaUny`pAUwc%9_ zV#x;w=)HY|`0mc*TI%dzWZDp_f}&?F80Q3A5Ph22@FfhVG-$?W4{QhO$tH7b874uN zZMA><^!8ax;Sy`VcdwuQQqFCJl-j69nWS;Wd_Y+1s1<4co80O2v~O`%J% zdx)W1RT=}SXu2dZuvA)zdUY4M9yLuUCF0UC6dDH>-4L{3oK7sn9y+^-FSi(x;pE;B z4Y9boOjrs-UFS)I!zCVEtV&rcam`xR=-|bE zb+&3tZ;L#3Jjb0e8|s|g%bmHWaWhWBHu4=9yMQ~qxt&te<4(`kD|@lPmT_tsuWZY6 zY;$LThi<>u`qb;5^g7)x`&YMDK_4F9g|(y1P{`54Lm!TI27Sn5!^Y5uoX#H#`cTr_ zF1oFt4{?4}(1!~8u!qoxvU=sN(1&frbRHMrA%~-n8t`!EaXneUL%#sQ$lJ_nk5AmoQDpPSP zGp$x(Qm|MYByu>$`h%3;;J`+Ws~TevIM}Y3auEKlL@Xwr18v>-Oh%ZLh3tmJDwzxwP`7WLjzzi$Ofm*41oE>!Pd3f@bIIal6_#QQ3IYjT(pU6x-KO9YC)|ua=SEb>hXr) zuFys8FT$q&$a}QmZW%bI2F3dZe%pRBHGKY_k+Hra3aXneb<)FZEsTQ`V z9G7=@Twd5Pr4*ZgCwO85#5Z(Yp3?>Oi1FHnn^%9w?vI^-D=CoT#bni~%9rV^MuYwL zWrpI8JO@L{7ls`-AdCIPUMy@&$>;5&YwA)a=_X$j$|Y%oEsvs_LECYFf^TyQoZ}u) z0O@}U9~nNw4ByP@WX>?b>_EjFC*yFiV*+_@Y^M`t)Dj-m6W(9=geNG6j;0hYdQ8#S zv2TDUH`oQ{FnB$(y*Y70CX9Jnb=6A0m&}NOwStJi zJDw_!LAL*$OupL8Lk*egfVBX5v@O2b!fJ`LIvzXVr+y)X1`i)Z^*ulcRVGHHsqaA+ zxRgYz^P+aaRSgqt7`;iMw!u_tO1b(axc&wp_kiXEq4m8ELh2BIJKbn>Eo96AiW~b` zr8OPr$YMZx{LJU9^p9SmUboBEAkT6p7K_W+z?9&4#n<|h*h`Z{I|X}~Sg)PTNEE+B zdTB3Mua3*5&v*G1lJKjZ%|C!J*jKA?J8}t|5BZVUWGO1g_1z_%K;a6w69u&?yg6A3 zPyCo5%sk}GKaUpJ1yzB0YBi}6F{m?>%&13U=}XFldbkYx=UPWE$GT-gE!2?WkqDH* z+_IV+w#CrbvDlV6@hr&Il8aRch={G_#l9k%*ky&0NvxSSZ=}B4L_ZHTN}9<`?4#)A zFt+!Vi$A8m$7SOG_FYdD8G)IwEoBxX!I;r&C{SYCT<)gWbP3#gp&tCeMdB@shTz50 zBrPFjQAHC)%#gh#a4U^HGwm6*kUMdpkg+{QJrwRFc)2viT{r%LGg0J3Lm$8Cq}n8P zE>U9JQS6d~1N862Ll8!l1cfHrD(eG60Mn-#A$P-+XlhG1#f7yAOvsiRU@4eJp>@T^ z5)#`+v_m>PdO2Zp7gm4)1p^|V&=JgB>BOZUp2cph zER*=o94(rNLiBPNT4%+p0x=GLBn$hRBzF?VImM>J9+{^&OSF{|yL?2mhN|%Ws2LeuP$58IFL0be$l`kN}w(9aSnYd~cHg!O^#;5cn zb_k!KJT=BNjmUt_VFIqdXv8?$Y)S1}IN$mDFPevFr-6Zqy~bK4=BJaPGQ*KI;dW*0 zCzVhzc@7THxov;tH^V?5{6EORE4IVAgurn_)ktvUfIEIRS3fA&6*15Qo$;vX}ncZTd%chuZ!Wg#78QdMjW2PFftV}ht zUR}5lp;DQ{kvSZzBbPAkv(`~4_>lm%RDtUmQInV;##)_=>Bw1@i3H3UR_0ySg#389 zTX6e-+l(JG`F>Ae{~s%-Nw(l|WJ!Qe8Z>y?PXP>{;3eiKcyKUc^wqL&!jyDq$!~7% z1ktfa*VMubYJ-#Ng4!cQcMLKkK!b-zcMNuh?#N@q#^{cm&L0ZhQ8J1kx~_Mi^okQAOm^Q!LhunBn9vwxe!uCS;UETwV3{Uexc$P1Kq0-Efma=L>bm}d1@(ke{cs>!cS_VuE1Cb4x|YqZ+N{*T zG&ok3U!tgc@)xOK;-SDR3pk|Q?_j>vqAXuDqXn$xdmPoe7aQiu(h@ z0kMBx*pA1c8_e0x29$lz4kqss{#Q0dW8&RF)D1om<|Y6}g`Z)`3Lql845b%RUB+E$ z;LN(F-b!)WD=d7em8Zvk>Cd$xp;e3f5WtWg$}wSu#XxgF5JEaV8FJ(rn>?Db)nawkZAIpt z#pc9kwg=2?bP5U=SmQF(=1u03CU`OzmOY%T#v+C$UW(RSY7v5|LoI~SVZROG&j_j4 z0VD=mI>d!SZqO4(b2)5AZqZ#yZ6;zd>b#0FIP zwoe|pZ~GzK*r6L4{M6EqO)Nt^id@@r@#Q$S**g+5KOx}Qb|LGN5jjk~8(aFn;Zh89 zs`9hi1$W&<@MtLbk>gZ9;urkbuZjmrbPgULi{amSC+}?6d&|6jmX|vefd5ZL!wm-{ z?mZA^LM)G~Gxdwl_yBGI{=DRkpbPjWcX&qCrr7-`>7;~DNC#!;-I8O?3=*(^*;50r z8W1lCe}L-=V!D%U#N%f3o`MIW$ISbF!=bn=!!F27d~x$Cy8XFUEh~L2Aaee{cD-~M zKy_G$9U$yZT5;DhJc+u6KiQk|{-x@(C%0bw-668bZ89#>YqnU^=%b=pG>o2#M-FBB z%(@g3I)nmR1ZHpqBHXBR(XI226WmD#P~_|=-yg;airQ$t{ZgYZigPT&Eebge;?GcE zUoRs{Bzi&q z2!3zwULGP-4-$1W7D1;aQm-q5f5zAc65jFn&LLKJO{UhY0w6G+KiyKBlCx9i|E@J=_1Fk`Qw4))?C!N5xKrpzq{%#K8gj58G#nrm$f^@ehY*wV@ta zggJSr%k$S^7a}6OLx-QM_IAKPBNRTsmpx9Vd|4M;I% zu)m&lO)_)qtvbacID^q^_W0Uf;Tika&5XeND?GRDdaLf5zO$^i>I-5}$adjb#Btj* z+n$-E-l|XWgp6(bD|pEq3!8K5DNiTZ!=^o}x9av+Sn@#EZy(R=tvYkma+l zDoD!MvVFWtqYM|Wwnc^$S84m0tE&GorzSxQ2dt)1 z^F~rf-VC6`?VvLcZn@9}q!Ps7XNHjGHN?Va;*v!Cgpm}V>prjCx?6GU0;CIjXV%nyYx|aQX8l3N zLZST7j@_jEi5FF|6T3|1*nPhLj$Khp&|}h$s5OPk7c30|wHSUagp5C=k5{=RKyD$m zH{W7nPT8y40WY}z-nIx-hDp_kFI6I*`zOgYfg^1T@nsL(k^g=r1|@#B6fzLsA|)csSebybiGV!P41;?SA`s4!t=h^aJbeu_Rol5d_&wRI{ZE^UvUmsAGNRe&f|I_zG9GUK!_zh!oAp9 zy|V+VW{@SZ4EKW-KjzdvvttyH{V}p#%9}9}m+CE)VO};{sGehA%H_xPR>BtAqEGlz zdLSYn(`)QubRjtZq+GvJoW##@Dbl!j<7QS(@6b;EPz84HaE~kHY zY=60{QKX4jcNnfe4!^*5$p;@pf`Xy}sDH*sQwx`hM)*%*b(;1J%Si`-lfC6Dm?&WK6jw8P2*}*cSC{2X3Gjep+d}_Qxh+=k3FI*9R)w!5@{^^1o~D6nNq;*GX1LcY_Ds<=tTP5p3#YF+Z?yM$6(t4Pp77R6Oo~_ZE|cJX5z=s zq$O>dXnc{J=QL9`Gk!qPdeE~l&Lu6EOmpgUYy~8{(uS7H8CZp6m$Fq#(w*w-J_#?j zPD)Z8?`Rt&>mKXJQS%%+o8`;zN0EJIl0P+0sb&b(M0UFg5Bl4_lRaK=BZy3MwHK(D z)hug{z*h;z9K>rs?j?D0J{9UVpHp0-f@+ZjQLjN%Si z^C_gzn#^J7zbISa!Z$s-G|4HH!gg6#buDmYUHVwdOJW%#I3<=NGB!b{OBz|j`4qAD zsI~OH5=61aW7}ZT_RBYR8?jN3bF<$3Ui?LbYT~L-xsM`LJGW=;Phx!0F?tjptquP9 z(W~wxW&y0H94$EY~mUy%v z-rQzJR$=tWT zHbAE}>K}b;#Ly=rY#AfCTRq~H;asWO{`R@fUafy=8T4B9@xQ~ja7p=+{z*QA&`IT&Bfv4bZban6Y~^X8&s)&0)~0v(Cpn$2detmMf5_dD$J<(7oJ;7I=@8?K5{ zE8@#ttf^Z-4T-Z+-cT?Lt>qF~B#bi%voW3(Yk*&J=DJveb~jNQ+hwp^+-K8uk0X&u zC(=J#Q+u0sU3+xtj~Q>_pQS!g-qMTuyBBk>Jh}T|^JQ>)cUBi|b zQ?~f_&$d%EjdxG1y4_lDl@G77-5$b+7hm;H+jk&15`>^O9fi0(Sba!T5L__75tNe01h|k8< z%G0&-a)-TV_MSr9){Q<@=WXBeQ+wB%e`FGgSyTIqN@&HK-S(cu+eZhgnWs zi;x*R6VQ-#AtQ>FXDP)QyMwb4G(l?L#H_kb7{z=IT*m`waV-#JU&TB#FtH6uFKG=`f?go#*^_kd;x3Y0-obWxOcK9c zJ7yiDsgnIW$o@l`HDwn-hIR9pR>9USoi#11YAxJlA9z69r}So^H-YwlEyQnCJ-`yE zoR1}K{miRx`y=&fcjUeb{F)arH>H>hREbit zD5U{q_jbHFJU;C8``zxY#jXT0XJZM>67Aipwvuq}a=|qT--fbqV!@#y@@xZp1gg9> zu4=!0Q=o>TO}+X3ss`2JScN(4dLPMzl51jw9k>&0Vh1&@EclLZu?hh0)c^C()zEW% z!k@!`qKWt~KgAY`wMA+HGpIeriZ1~PBd?ikDGF09@a-s8q6`Y)iNTJrVKnM<+jr`% zUTaLP2DDZ>ZT03*=}vaqY-NoCEgfoks3F*OcVY~@s<+yl7}n>g%ZNxZLe$=C;~Tu< zUmtZ9N~3=!d6uFha z^3P@qy>>nI7x|~GRhOt>2bI%6cB1lgXBTJgg+s3)nfwsZ<#m5V-O-Xife-Pv{7VXYvOvZZOAgu<(qqVme_I0$al=fZ;sjgd{u*5Xizzky&sjgW5j)A3M%%; zYvN&Qy5gBAcF{uoPq^FAVvLHHI~42^LKMm;8pfHNo073ilDV~#%dL@APR)nBUK+VP z&~n~r%cqNr(!{adMV~HTX%4M2GX^W|WY*OgWL-3)SEYx_67UvcVZc~BVVs3be+X`@1X2w35 z8I>cWa%9}ak)hU#kIKBWe@2c5<|)f_afI%W<{f+*Yq~Ki%VM1^B5#{uYP|AdR9=ko zB2)TaTxDK7nK(%--%aJnc*>3p-mt-E9DKa!FGEy+Z(F2}uw@|XS~ir;^;SxoW)s3)coqZ%l!&^#BV759Tk)1SDtfXkLE%EQj(UPFORYY_v zPOj{L5tB5*BGYVbt18!LBdx8_ZmU8+mC;m%e(uX16QPd2J%zi@ayVt-Kv^ZCGcP-Q z^S#M?`=-(S{$NNn-DAx|-4vIoMOv~FX~=?{43xPA)Cwd)4T`60=f>+4t1Lc5xGByUplox?uuw{ez`*XGnPh}FI%mPajOej!iQPF7d(+SO&=3?VRbz3E0Cl{?o7gl6L4oZ(S#mBENGH|EOq$l}y>>CDpL zN;MthB~`|F*zG-UcL(imPcsn)SrW@|KUjL3V|P2xy(zWirxF%OlAYg5teXT$wGuNT zs;}4bmh(3E*R8GGuawm-to^Q|ed*Xs;&_>mxSB!TrHNPfWkUd;Gfg|WsVJWuMYGmE z)T{Bd27Wa1vflRlSR`a!qhb@8IC?ml_^<@;54A09o>?xP%{})ZWW1}GGYjHjSQ#ax z=J2rH?ZN*o9db>{O`h}!Q%f}=!q3;6t-4}HT|y;x>a9XL>n&-hNvoq>Z!wQ|!(E!x zQ&Sr+MT;||$GT;?ioe`NQkK{umM3=PtS{(AV!{Db>32u+WdX6u=|hUS9J032bu=A1 z62)v~euM9SnbIpsxU@|_`#wlG$A6G95+)ORo1qK!5vGCZGz00q$`A2f?vbU2Tmx}{Y z7kO|`)?6W*4HTO#bVJab&gSL{Ib>ol7I1+h{1Ww8j~I=K=Me|_E^!dKUBV3mYeFDe zLab}**w%tro?rxYhu&OVq6UF*feXVyE}7Vt(S*xHSaQL(I*5VA5Vc&OD;%7lxCI2< zP}4+Xf()`W?G-VQZyCgira+#cT%ZQtKJ`6&!TB;au|beMMbWa6$EOZD^Uwra(DeiY zEHmFB2Ad>tu0~S_re#jhJN5ucm4;y7g0BgMjDGdU9rS5V-Dn~h)e}|=8%=HBk+aOk zAD=uv@h=Kt;H?4#SF7l%8jP((l(qxW$)A3D|KZb{7r-RnB`#xwNoIJmLcf0cbiv0F z8p7!G;tYAVm{`^r8nn>OoKEH-czA649yH-IDOP9;xi-u(btCB`1~l_s!n(;=f+N$O zg;Er89ps2$qw~{Gsr3!lY+f@F0#VhSENiE1LjY~Ttvd9Mn|0_M94d@`;)nQU6d(w_ z3f*mt8Hy?0Noc{iQi~i9X@Ud{8~on|U4UKl+Y(~`B31yF)^WT0yxl$g)Em4wI(gB1 z-sv9o{xiiGhnNJrhVr z${*?`TU+AES3D#C$T3Z18^u=DS{UN@#JJ?!;R!+as^&Z(-zzj})OUoTcsZGq1y<-i z>U87Nvx!M5-~C69MVUMom2iW}ZUrDOhq7eD6oGVuch@k1%nFa!@fR~(bhXdy3Mh~rc^(^j zpIJVa>MfLU>;u<#&bd#{JzrP}S6pmWDU%!N)664Y(m>1*_I7Mz3XK$I7At07QeX%+}8@ibHHsVXeU3?`7hVD z{zqI#%SHNosZ|meslu3Ms7Zv@NbffWnPT7cewPv5GMvr{C5QlWzBiIVEUlz7yW_F5(HC;Nj)Sca3j3Q0My2FSE&UP_|1O@9HS>vOL;U|(SA>VZv zk2WUTf-@^Sw3fEIYOX(>(p%oCZ_$7G1T)$hhrtozRY*s@lec0FM;C#W|p5&g)kn*X!FU-?t_fmx_`soJce{fD8K)08wn=!T5;neQ3^Si**(M?DK!u2t9oRI!nY1W`=%SI(q@a(Yx7LsEbr3a&YO#M;!b|x`uY@z-+wxSx%j%ZwOp}O@Yzu(aE z&M;Nu-rvN|Ait|Q2$zY?WQgb+%UA-0*ew}~Sto!eH1NYj>dvX<-`*)$7vI`nD~>9# zxrty9+voMshX~PaFwdKB%)*vzK{%g zh4h}d!4g+)fehVa&DD(`-KG)&Z#jRvFv0!*U$U4Ywdn3S5m?4l8o#m zbi1S~mHuwm#3+gPb}qa7VsY_Af;%T;*K<-Cem}b5x9`rhh{nq3d+J7?l9FWC?zDaI z>FtB>D4v^dx30y#@agS|1-^&Jl6^7lDx0curtQwAiY`j*xnY$c^!}`?eXuN|3~M_* zZN+lC?Vge_tK6<9CY{G_$5CaOK5zGP#1i*a*6@Cu3@Q_J-=Ghb18dt3tUP4vy+8&( z-almUuK9wBAe2d@@0&a21}fz;ECgn^Q2kDjx!n;~7e=TvTzAKJ=M zVrsiz&mrb+FG$%RPe2@hw+{}aJ@VP?l@YqPR{DO~GL`x86x<|g80!8#CHu2yMmVzF zFQ+(~Y+vXJF=hKPRcU0|uIY;5%l2i~7|Lw-#O#+9xIfl$WpwR-sJHS+D4Z-=(?rP} znGN?)(J^x017*{qegoGxNKigDrPzJBxq(ix;_JGm8SWbnO2k6AwzDixg%<&xS3(A)ho^ z@$$rv@`)^SF77nQpQC5|Z3&JYhV|6LhfQ9IUAjF;7YWChs_p>so9}t z%cD@d8hzLkOC_W>3m-SLR(H+zy`}G6veg1|Q)W%T4Vv!tB`(k!WQch{E&9zHPM0>+0IIoPPLa;~R3tclDtJ0+36s*`>$JGSx2q z$%GI?kHM|Eve|3u@=Wh~@5q!wtvh!AP4637v*44iS_7{>p_GCWMZ3d-6cHJ^QcyW1 zp?XkmPFD}Gumn^zKDFR@W;4ab_hAegY0Ybl|?KdQHkav zFH~i@BPqEhZkipsSorLcBd-r545ou^OwAg>YtNyxS-xud2z3G3_;Y8{Db)<2+SGwV zv^7~VRIBahha@P}6T8M>PxaQ1N7M*ZB7+V1<6e>{=To6>^Et&u+d%D=Z5eE%;$FGj zc`fXXwR&qiBZ4RM;tpB!DcF>gISl<5wM>(3on=&1UE9ZzhM_y8rMnwMTDoLtm4=~n z7(yhZTe=$rB!r<6h6V)$VTMjA5u}@U^uE{otmj?tIUmlt&ffdK_W5{z*S`LjTY$G? ziosAXcZQGAgh=dcQDSrFlXSt?tce=L)H#etKQ>AGvJISfA*>Fs;)hy#!+%olB}Xh& z4uOFp?o%VVFY66PgHm*4febE~`~i;~ah|Ed9|3u@6ncb?YXY%umLJEUM1XNdlPSwh zR?lkrqP?^fR-PGOalC;;@n0BPG@mO4@eB+u%&Jk|zC|%SzjME;nkl^^uqFMdUi5xm z4ncPzl<&jQbSBY_*LGpw<6KEGtyWg-E`V>GNPI6)YC1;&0a=WkZ(N}jRtUvnX!M zZ}KBmj`QN^PEu_1fsL}D?rdu;9hvo9Qs*CEl!tiBsA;jip9DLLon)vb+=lePx~*K* zhjD+M>NKuZb2Kw|FAj9KTS%F+kmF%AnR>S=QQ&OgJ*JJbAD~&y$Zg|$F}0*MGw4gr zLwSMlUJ3)+Y+4*E#)>vW9e0~mGww5gQ{0>Ek#4#4RQ5mwQN~g`q`3vcdfrBGfyx zPv}sa-+w^mPb8?U@U^s^FgiB}Lw<2yU#$nMMt59_ge{3f6061zasteIR>Iy7Nzc;y z-$I9+7e=~1H15W@vRpWQrXLx^s4`Bi@F z`pe}v<+f6+N&2!CGVMQ8A>*FVk7=UVd$08fU;l>9u1sxvH2KlFce+(B8H8i?PX2nwnnuP9Y4_s9d6Q=@lM$$ z?>|OdTGU_xQQx05l-3r2U%7^q${i#u8i!h)T>r3Z%x`MviU=X3G%f42_TSdSUX?8n zKS^kPkG_nybNpL`V1B&VDc6Nf32vFIrdW7ECB<53jH2BrL`gNZ8C_8 zb>*f6zHTmVCU`A;`C>Urqa5uw_u1^BxIECn>tYs}i{Vku8#cxodA@HYH&?=DuOiDW z2o?lMx_#24?_iCS{LvM<2(f?3-JMVtshIMk2?bu z$IiV`*HgMiTz)L(7u92(zN?8dnvBhk7MC5g$zOi^^=W|wJli9ne!qxb$Wv?iknp7? z=;DnLg6ihAb)~2|7k5dc&}_5N>#btX7Jo;yN}qz`J!wZ=@v`T_oM)7iy4L)K%QAY! zoG+r)t6B|BXv@x1N9QYR;@>rhwUBRCl_(2rF`;ml>wU7!_)~$ewPM zoT1Tiz7d`Ewl!=Skjhb7R_P@JZ;e#SP;V)hpB}W1e)bodN>NJg9L@TjmPg%Lq_0eR zXB)M5=n^|a+=8cMF?K%udbf7wd5)Hi^fBvhI7fhBP1lH}wjttQ4w;0((UH#<5Djbs z{?=6DovG|$!91fp`=>Gxp{g%(B$WMISI>qMpIn-g2Gm&XQ0?vTA!Vk;?G>TgKX9^{V=y&l&`IU8V1&?5#z(2#!iirYQ zU~?{rVlCcO)9^BGnN_2d_-R%j!W8SVy0q>#8#abAWl{6bzu!VB*(~E-Zk*XVO7z2` zaVHvcn?8V5kJ&_5B!5l^)7s;JU9|DTfCn0t{tm<^q$WICKZ!YQ*O=IZ3Y(57O)Lhu zbuz%h{bIvs<+N8r?)ZC1uWJv(7d|t>%$kr^PuWHZ9}B4_kt7AJA%FGvg7m(SiG?MF zj)iH>aE0`Kp+&;HwUcaiV4;CjE<((-7*Nv{S7pK>1Nrv3LU_F+ubSOyNAjixs z)ryl_&-lhd)#a53B&=P7^kWN@8iilj&$3N{gMnIEcsjV;c*N1Ay-hRsdU?@zr=as~ zjdf1=#~F-A?(iPDtu9nx=3gdc%0Be<# zjo%GR8PujGn(9yMlbxlkMgmo5vb$LF71@79$ct4;vwu~kjj6J4#OX99ZSS|U5&1Fa zV-*|1YnUiTqc(p#EB+;*iAB6E;rI&m+Q!jN@AmSU+{Y!@@m)Q-JT4NFMxs*hX&E;# zQ})9ct5`EcHY;5D|H9GbZ?lF^3FNKZTJ~bj0&qmXRY7rgYoMh;Jln-cGiaa{Qy0et0!ZK^_rKcS%SB)q8$M_HAPI)LRNj^ zj%QL@177hks)4XFF{B++u&&2^KEXJj=5*9IUCb(9IW78Yh)MXE?Q4D^%VUnPJ~D!Z z(plr?@b*g;_WOA0OzORY-xlQ*)mda2PV{Hvm&Djr#TXTgn;kRROel5*BT{=vR>vdx zIa{F*KYHtPCaK|sgvs}0b0-Jw@v>OgN^!!V{Ub>?`U-SS8G43Qks~&M67PfxY5FAt zSTkmF#&?qBMah1z%8Wuqxj6I=@t7EpsD5AcK-U2A4?yh-9=PX*Gk7?K?O{c?DH6^ zVJP0Zk^$pHJ)bU`TfudH*J>bj4xDi~zt{m|1Pz3h2X=VNyAyz_7n^lR6sDDO1S+gT zn-*f2e>EY*(oRouq*^mPK8K-7GcrVV@yGE(Kjid-la@tkXbAKXi(T9zy`_>w##S);7e)^>oxRR zn2idb>|cJ^&1;IlJ<$7}ef`}`0CKv$HCA9T(NK%fn2h5OmLm!&0+jO+O9!${*v*GH z!M=D1U=N~KN84s$BS(SVosGek-M0_-6A!U+jfhy$r}EY!e#74WVW~y%{X7+b6xKK2N!exGXrr5NMLot)>Y61m3V-@dk~e7l1{4UqVMvA=^tYc7S*gpju|RUPG$L zTafK3F9{2ceyko~k`5C6 zB1Rpz082hy@;(c9{yA80e?=M7GxuEwjgk*7A*mfSi3~f%Dwy5 zNvQgOPR7G=mB$(!%DuIAXtOR!m6uzm;)g-eH>{qNv#qqEx8$cjf z<$-g2Hd|QmbMt!HcuGgMkeHFgcReIP zjKwjHni1UI>CCUkX_jW1?iLUx`$5*Jjw7RIS%x@1Pkm@&Ys>ntN$d~NQpfATjAC_S zGNL${+i(!1-=r1GSTu>{@;xuhT$nHpHUN|twPCu}1Yg}^X{gHFVBDMvj%91vZ{ydW z&Nr2VD+dCoU|CKeD^lC_OiJ>#trR-GY4+lA>RS$-%G=da3nKcR%FXC>ezldY3KE1x zqz}1^rk$FDe;r^BReEnw6yOUx;ZkDRNz<<1%Hmd{JfeBHOp!3qC3O#^;3j`vH3{bK zlumejbXD>I;79hW3O-Zt`kK@#ywcX#7jz1%5a++_6_(oc8laL_EQ%{?`I}XlDguN% z{*!iL`pyMVgcC@&fLn<0&#kd6^r<4nhv;vpeX%B;Cld!;LpIyR$hScfZf2Q0aBe<$_uloz*9E5$$Qc^J8>{S-hinljsQeez04 zJAK|BVB#8K+?=sp@8Q|}MKVJS3NOajZR3NHJHSaTE{Y^c5l_JOX)@d*H*rkSYGOPd z{Tz3D;bz_P(*t;IU(xaRQ+NrwcijPmokqnaAZr~sc>8>uLLyynhuQO^y^psdzMEW4 z0bV-PM})mlWWb7FgC4($FyACOEZ6un{}Pq()-?a(O!k-H+?!>X<)#V$pckgAl7lQ7BbmODlQ~#bC0+7 z*8@i_EycMwcL}|!-gH~q69GH14}+*+K@pZ+2a_Cxt;c%c(M+hsZajH<~G)xW=s~|u2__Qe=^G;KK#~vcMvz-+d+&xuTu#a^Y z$d9?SZ)e87^kqENH8SYiQex{i z5BW)X?A;g@xCXB;E@u)74|OK!PhWhXK3S8CyW;Q~-`^1q>d6*lIDlo|WLaCPzTdt1 z9@o}GXiaaE0H)(DKQtEp(KY#M2syT0U-c*22%AZ)WdS$~fc*}#-c`SN% z=QMZ=LWVNPFjwSH*x9Qtd}F7YKr0XE>`vg94}~ubXY_ng=wFBB#O=7J65Fo$MkjJm z6dly}%yUW@LZY>3bMm|T(+_^(Xz{)AO-Gq;^LtxIO@?jYq$PE`!lJH2<=5%Qe7{*( zvb?$p_B*Nxk&p;H?_{A*sC>#CFQCXAPvPp6JtN;^gML*$<00#z_*?Y+$){WFI%NjA z#CPvl(?qFH4EhqMHuxJHL?#wW0Z%+Zd6>NU5edes%n#J~j%MN)GqiaPYF@~G1VdLG z&Mk){X#y(`Hz7CoD-R0~gt{7!P{~lpP*6~?QK|x&E&LXDv$rTvP+T2RP$-da|NFA` zw0-4mYvib8Yv<_d=\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Web%20Session%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nWeb Session Essentials is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Palo Alto PAN-OS \n 2. SquidProxy \n 3. Vectra AI Stream \n 4. Zscaler Internet Access \n 5. IIS logs (via LA agent) \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **SummarizeWebSessionData** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n\n**Workbooks:** 1, **Analytic Rules:** 15, **Hunting Queries:** 9, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Web%20Session%20Essentials/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nWeb Session Essentials is a [domain solution](https://learn.microsoft.com/azure/sentinel/sentinel-solutions-catalog#domain-solutions) and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the [ASIM](https://aka.ms/AboutASIM).\n\n**Prerequisite :-**\n\n Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.\n 1. Palo Alto PAN-OS \n 2. SquidProxy \n 3. Vectra AI Stream \n 4. Zscaler Internet Access \n 5. IIS logs (via LA agent) \n\n**Underlying Microsoft Technologies used:** \n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs: \n 1. Product solutions as described above \n 2. Logic app for data summarization\n\n**Recommendation :-**\n\nIt is highly recommended to use the **SummarizeWebSessionData** logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\n **NOTE: This solution includes the playbook SummarizeWebSessionData, which uses the legacy HTTP data collector API to ingest data. Since that API is about to be deprecated, we recommend using the SummarizeWebSessionData_logingestion playbook instead.**\n\n**Workbooks:** 1, **Analytic Rules:** 15, **Hunting Queries:** 9, **Playbooks:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Web Session Essentials/Package/mainTemplate.json b/Solutions/Web Session Essentials/Package/mainTemplate.json index 8cb84e79b1a..ce3cb043503 100644 --- a/Solutions/Web Session Essentials/Package/mainTemplate.json +++ b/Solutions/Web Session Essentials/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Web Session Essentials", - "_solutionVersion": "3.0.3", + "_solutionVersion": "3.0.4", "solutionId": "azuresentinel.azure-sentinel-solution-websession-domain", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -51,7 +51,7 @@ "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", - "TemplateEmptyArray": "[json('[]')]", + "TemplateEmptyArray": "[json('[]')]", "analyticRuleObject1": { "analyticRuleVersion1": "1.0.1", "_analyticRulecontentId1": "32c08696-2e37-4730-86f8-97d9c8b184c9", @@ -211,6 +211,14 @@ "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]", "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", "blanks": "[replace('b', 'b', '')]", + "SummarizeWebSessionData_logingestion": "SummarizeWebSessionData_logingestion", + "_SummarizeWebSessionData_logingestion": "[variables('SummarizeWebSessionData_logingestion')]", + "playbookVersion2": "1.0", + "playbookContentId2": "SummarizeWebSessionData_logingestion", + "_playbookContentId2": "[variables('playbookContentId2')]", + "playbookId2": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId2'))]", + "playbookTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId2'))))]", + "_playbookcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId2'),'-', variables('playbookVersion2'))))]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -223,7 +231,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "WebSessionEssentials Workbook with template version 3.0.3", + "description": "WebSessionEssentials Workbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -298,7 +306,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CommandInURL_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "CommandInURL_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -336,58 +344,58 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "DstIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DstIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "SrcUsername", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SrcUsername" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", - "Decoded_url": "Decoded_url", "EventEndTime": "EventEndTime", - "EventCount": "EventCount" + "Decoded_url": "Decoded_url", + "EventCount": "EventCount", + "EventStartTime": "EventStartTime" }, "alertDetailsOverride": { "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been identified as making request for URL '{{Url}}' that includes a recognizable malicious command" @@ -445,7 +453,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DataExfiltrationTimeSeriesAnomaly_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DataExfiltrationTimeSeriesAnomaly_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -471,7 +479,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "Exfiltration" ], @@ -480,31 +488,31 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "DestinationIPList": "DestinationIPList", - "anomalies": "anomalies", + "DestinationPortList": "DestinationPortList", "SourceIPList": "SourceIPList", - "ReceivedBytesinMB": "ReceivedBytesinMB", + "anomalies": "anomalies", "SentBytesinMB": "SentBytesinMB", - "DestinationPortList": "DestinationPortList", - "score": "score", - "EventCount": "EventCount" + "EventCount": "EventCount", + "ReceivedBytesinMB": "ReceivedBytesinMB", + "DestinationIPList": "DestinationIPList", + "score": "score" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "IP address '{{SourceIP}}' is engaged in data transfers to a public network that exceeds usual levels", - "alertDescriptionFormat": "Please conduct a thorough investigation of each IPAddresses listed in SourceIPList: '{{SourceIPList}}' to identify any suspicious activities that may require further investigation. 'SourceIPList' include the top 10 client IP addresses that transmitted the highest amount of data during the anomalous hour" + "alertDescriptionFormat": "Please conduct a thorough investigation of each IPAddresses listed in SourceIPList: '{{SourceIPList}}' to identify any suspicious activities that may require further investigation. 'SourceIPList' include the top 10 client IP addresses that transmitted the highest amount of data during the anomalous hour", + "alertDisplayNameFormat": "IP address '{{SourceIP}}' is engaged in data transfers to a public network that exceeds usual levels" } } }, @@ -559,7 +567,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DiscordCDNRiskyFileDownload_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DiscordCDNRiskyFileDownload_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -585,7 +593,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "CommandAndControl" ], @@ -597,44 +605,44 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { @@ -645,8 +653,8 @@ "EventStartTime": "EventStartTime" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with the IP address '{{SrcIpAddr}}' has been detected downloading potentially risky files from the Discord CDN", - "alertDescriptionFormat": " Client requested for URL '{{Url}}' that contains a files hosted on a recognized Discord Content Delivery Network (CDN) which are considered to be potentially risky. It is essential to investigate further to determine the nature of the files being requested and the intent of the users involved" + "alertDescriptionFormat": " Client requested for URL '{{Url}}' that contains a files hosted on a recognized Discord Content Delivery Network (CDN) which are considered to be potentially risky. It is essential to investigate further to determine the nature of the files being requested and the intent of the users involved", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with the IP address '{{SrcIpAddr}}' has been detected downloading potentially risky files from the Discord CDN" } } }, @@ -701,7 +709,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KnownMaliciousUserAgents_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "KnownMaliciousUserAgents_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -727,7 +735,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess", "CommandAndControl" @@ -739,68 +747,68 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "DstIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DstIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", - "EventCount": "EventCount", "EventEndTime": "EventEndTime", "UserAgentCategory": "UserAgentCategory", - "HttpUserAgent": "HttpUserAgent" + "HttpUserAgent": "HttpUserAgent", + "EventStartTime": "EventStartTime", + "EventCount": "EventCount" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed using User Agent categorized as '{{UserAgentCategory}}'", - "alertDescriptionFormat": "User accessed this URL '{{Url}}' using User Agent '{{HttpUserAgent}}'. Perform a thorough analysis of the requests associated with this user agent header" + "alertDescriptionFormat": "User accessed this URL '{{Url}}' using User Agent '{{HttpUserAgent}}'. Perform a thorough analysis of the requests associated with this user agent header", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed using User Agent categorized as '{{UserAgentCategory}}'" } } }, @@ -855,7 +863,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "LocalFileInclusion-LFI_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "LocalFileInclusion-LFI_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -881,7 +889,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess", "Execution" @@ -893,58 +901,58 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", - "Decoded_url": "Decoded_url", "EventEndTime": "EventEndTime", - "EventCount": "EventCount" + "Decoded_url": "Decoded_url", + "EventCount": "EventCount", + "EventStartTime": "EventStartTime" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "Potential Local File Inlcusion(LFI) performed by user '{{SrcUsername}}' from IP '{{SrcIpAddr}}'", - "alertDescriptionFormat": "User requested for URL '{{Url}}' which contains LFI related keywords or indicators. It suggests an attempt to traverse directories and access files outside the intended directory structure" + "alertDescriptionFormat": "User requested for URL '{{Url}}' which contains LFI related keywords or indicators. It suggests an attempt to traverse directories and access files outside the intended directory structure", + "alertDisplayNameFormat": "Potential Local File Inlcusion(LFI) performed by user '{{SrcUsername}}' from IP '{{SrcIpAddr}}'" } } }, @@ -999,7 +1007,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultipleClientErrorsWithinShortTime_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "MultipleClientErrorsWithinShortTime_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1025,7 +1033,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess", "CommandAndControl" @@ -1037,51 +1045,51 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", + "RequestURLs": "URLs", "TotalErrorCount": "TotalErrorCount", - "ErrorThreshold": "Threshold", - "EventEndTime": "EventEndTime", + "EventStartTime": "EventStartTime", "EventResultSet": "EventResultDetailsSet", - "RequestURLs": "URLs" + "ErrorThreshold": "Threshold", + "EventEndTime": "EventEndTime" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "High number of client errors originated by user '{{SrcUsername}}' from IP address '{{SrcIpAddr}}'", - "alertDescriptionFormat": "The client has made a total of '{{TotalErrorCount}}' requests to URLs '{{URLs}}', which have resulted in client errors. A sudden surge in HTTP code errors, especially in the form of client-side errors like 400 or 401, could indicate malicious activity, such as attackers attempting to exploit vulnerabilities or perform unauthorized actions. For detailed information regarding the specific errors encountered, please refer to the following link: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status." + "alertDescriptionFormat": "The client has made a total of '{{TotalErrorCount}}' requests to URLs '{{URLs}}', which have resulted in client errors. A sudden surge in HTTP code errors, especially in the form of client-side errors like 400 or 401, could indicate malicious activity, such as attackers attempting to exploit vulnerabilities or perform unauthorized actions. For detailed information regarding the specific errors encountered, please refer to the following link: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.", + "alertDisplayNameFormat": "High number of client errors originated by user '{{SrcUsername}}' from IP address '{{SrcIpAddr}}'" } } }, @@ -1136,7 +1144,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultipleServerErrorsWithinShortTime_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "MultipleServerErrorsWithinShortTime_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1162,7 +1170,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess", "Impact" @@ -1174,51 +1182,51 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", + "RequestURLs": "URLs", "TotalErrorCount": "TotalErrorCount", - "ErrorThreshold": "Threshold", - "EventEndTime": "EventEndTime", + "EventStartTime": "EventStartTime", "EventResultSet": "EventResultDetailsSet", - "RequestURLs": "URLs" + "ErrorThreshold": "Threshold", + "EventEndTime": "EventEndTime" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "High number of server errors originated by user '{{SrcUsername}}' from IP address '{{SrcIpAddr}}'", - "alertDescriptionFormat": "The client has made a total of '{{TotalErrorCount}}' requests to URLs '{{URLs}}', which have resulted in server errors. It is recommended to thoroughly investigate this alert to determine the underlying cause behind this significant number of errors. For detailed information regarding the specific errors encountered, please refer to the following link: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status." + "alertDescriptionFormat": "The client has made a total of '{{TotalErrorCount}}' requests to URLs '{{URLs}}', which have resulted in server errors. It is recommended to thoroughly investigate this alert to determine the underlying cause behind this significant number of errors. For detailed information regarding the specific errors encountered, please refer to the following link: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.", + "alertDisplayNameFormat": "High number of server errors originated by user '{{SrcUsername}}' from IP address '{{SrcIpAddr}}'" } } }, @@ -1273,7 +1281,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MultipleUAsFromSingleIP_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "MultipleUAsFromSingleIP_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1299,7 +1307,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess", "CredentialAccess" @@ -1311,35 +1319,35 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "eventGroupingSettings": { @@ -1348,13 +1356,13 @@ "customDetails": { "UserAgentThreshold": "Threshold", "UserAgentArray": "UserAgentList", - "UserAgentCount": "UserAgentCount", "DestinationIPList": "DestinationIPList", - "URLs": "URL_List" + "URLs": "URL_List", + "UserAgentCount": "UserAgentCount" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed using high number of User Agents within short timeframe", - "alertDescriptionFormat": "The system has detected high User Agent count of '{{UserAgentCount}}' originating from '{{SrcUsername}}'. Further investigation is necessary to determine the reason behind the detection of multiple user agents associated with the SrcIpAddr in this incident. User Agent list include: '{{UserAgentList}}'" + "alertDescriptionFormat": "The system has detected high User Agent count of '{{UserAgentCount}}' originating from '{{SrcUsername}}'. Further investigation is necessary to determine the reason behind the detection of multiple user agents associated with the SrcIpAddr in this incident. User Agent list include: '{{UserAgentList}}'", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed using high number of User Agents within short timeframe" } } }, @@ -1409,7 +1417,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PossibleMaliciousDoubleExtension_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "PossibleMaliciousDoubleExtension_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1435,7 +1443,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "DefenseEvasion", "Persistence", @@ -1448,67 +1456,67 @@ ], "entityMappings": [ { + "entityType": "File", "fieldMappings": [ { - "columnName": "FileWithdualextension", - "identifier": "Name" + "identifier": "Name", + "columnName": "FileWithdualextension" } - ], - "entityType": "File" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", - "EventCount": "EventCount", "EventEndTime": "EventEndTime", - "DstHostname": "DstHostname" + "DstHostname": "DstHostname", + "EventStartTime": "EventStartTime", + "EventCount": "EventCount" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP address '{{SrcIpAddr}}' has been observed with posting potentially risky dual extension file", - "alertDescriptionFormat": "User posted file '{{FileWithdualextension}}' which potentially contain dual extensions. This type of activity could be malicious and performed to bypass file upload filters or security measures implemented by the application. Destination server name this request was targetted to - '{{DstHostname}}'" + "alertDescriptionFormat": "User posted file '{{FileWithdualextension}}' which potentially contain dual extensions. This type of activity could be malicious and performed to bypass file upload filters or security measures implemented by the application. Destination server name this request was targetted to - '{{DstHostname}}'", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP address '{{SrcIpAddr}}' has been observed with posting potentially risky dual extension file" } } }, @@ -1563,7 +1571,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentionalFileEnumeration_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "PotentionalFileEnumeration_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1589,7 +1597,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "Discovery", "CommandAndControl", @@ -1602,60 +1610,60 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "DstHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DstHostname" } - ], - "entityType": "Host" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "RequestCount": "RequestCount", + "RequestURLs": "RequestURLs", + "FileCount": "FileCount", "EventStartTime": "EventStartTime", "DestinationIPList": "DestinationIPList", - "FileCount": "FileCount", - "RequestCount": "RequestCount", - "EventEndTime": "EventEndTime", - "RequestURLs": "RequestURLs" + "EventEndTime": "EventEndTime" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed with performing file enumeration activity", - "alertDescriptionFormat": "User generated multiple requests '{{RequestCount}}' that has resulted in error code '404', suggesting the possibility of file enumeration activity. It's important to investigate the source and patterns of these extensive 404 errors to identify potential security threats. Details about this error code could be found [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status)" + "alertDescriptionFormat": "User generated multiple requests '{{RequestCount}}' that has resulted in error code '404', suggesting the possibility of file enumeration activity. It's important to investigate the source and patterns of these extensive 404 errors to identify potential security threats. Details about this error code could be found [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status)", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed with performing file enumeration activity" } } }, @@ -1710,7 +1718,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PrivateIPInURL_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "PrivateIPInURL_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -1736,7 +1744,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "Exfiltration", "CommandAndControl" @@ -1751,58 +1759,58 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "ip_inURL", - "identifier": "Address" + "identifier": "Address", + "columnName": "ip_inURL" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "Urls": "Urls", - "EventCount": "EventCount", "EventEndTime": "EventEndTime", - "EventStartTime": "EventStartTime" + "Urls": "Urls", + "EventStartTime": "EventStartTime", + "EventCount": "EventCount" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "Detected a private ip address '{{ip_inURL}}' carved in URL", - "alertDescriptionFormat": "User '{{SrcUsername}}' has been detected requesting URL '{{Urls}}' that contains private IP address '{{ip_inURL}}'. Encoding private IP addresses in a URL can be a method used by attackers to exfiltrate data from a compromised system" + "alertDescriptionFormat": "User '{{SrcUsername}}' has been detected requesting URL '{{Urls}}' that contains private IP address '{{ip_inURL}}'. Encoding private IP addresses in a URL can be a method used by attackers to exfiltrate data from a compromised system", + "alertDisplayNameFormat": "Detected a private ip address '{{ip_inURL}}' carved in URL" } } }, @@ -1857,7 +1865,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RarelyRequestedResources_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "RarelyRequestedResources_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -1883,7 +1891,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "CommandAndControl" ], @@ -1893,44 +1901,44 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "DestinationIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "DestinationIP" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "RequestURL", - "identifier": "Url" + "identifier": "Url", + "columnName": "RequestURL" } - ], - "entityType": "URL" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "EventEndTime": "EventEndTime", "EventStartTime": "EventStartTime", - "EventCount": "EventCount", - "EventEndTime": "EventEndTime" + "EventCount": "EventCount" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User with IP '{{SourceIP}}' has been observed making request for a rare resource", - "alertDescriptionFormat": "User requested (TotalEvents='{{EventCount}}') for URL '{{RequestURL}}' which contains a known script extension. The domain associated with this URL has not been accessed by any other user. This activity could be a potential beaconing activity to maintain control over compromised systems, receive instructions, or exfiltrate data" + "alertDescriptionFormat": "User requested (TotalEvents='{{EventCount}}') for URL '{{RequestURL}}' which contains a known script extension. The domain associated with this URL has not been accessed by any other user. This activity could be a potential beaconing activity to maintain control over compromised systems, receive instructions, or exfiltrate data", + "alertDisplayNameFormat": "User with IP '{{SourceIP}}' has been observed making request for a rare resource" } } }, @@ -1985,7 +1993,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RareUserAgentDetected_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "RareUserAgentDetected_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -2011,7 +2019,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess" ], @@ -2021,68 +2029,68 @@ ], "entityMappings": [ { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "DstIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DstIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", - "EventCount": "EventCount", "EventEndTime": "EventEndTime", "DstPortNumber": "DstPortNumber", - "HttpUserAgent": "HttpUserAgent" + "HttpUserAgent": "HttpUserAgent", + "EventStartTime": "EventStartTime", + "EventCount": "EventCount" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed accessing URL '{{Url}}' using a rare user agent.", - "alertDescriptionFormat": "The user agent '{{HttpUserAgent}}' has not been observed in the past 14 days. Conduct research on the user agent string to determine if it is associated with a known legitimate bot or if it is potentially linked to malicious activity. The URL is associated with the IP address '{{DstIpAddr}}'." + "alertDescriptionFormat": "The user agent '{{HttpUserAgent}}' has not been observed in the past 14 days. Conduct research on the user agent string to determine if it is associated with a known legitimate bot or if it is potentially linked to malicious activity. The URL is associated with the IP address '{{DstIpAddr}}'.", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP '{{SrcIpAddr}}' has been observed accessing URL '{{Url}}' using a rare user agent." } } }, @@ -2137,7 +2145,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RequestToPotentiallyHarmfulFileTypes_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "RequestToPotentiallyHarmfulFileTypes_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -2163,7 +2171,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess", "Persistence", @@ -2176,67 +2184,67 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "File", "fieldMappings": [ { - "columnName": "requestedFileName", - "identifier": "Name" + "identifier": "Name", + "columnName": "requestedFileName" } - ], - "entityType": "File" + ] }, { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "EventEndTime": "EventEndTime", "EventStartTime": "EventStartTime", "EventCount": "EventCount", - "EventEndTime": "EventEndTime", "DstIpAddr": "DstIpAddr" }, "alertDetailsOverride": { - "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP address '{{SrcIpAddr}}' accessed a potentially harmful URL", - "alertDescriptionFormat": "User accessed URL - '{{Url}}' that contains a file - '{{requestedFileName}}' with risky extension. Downloading this file could pose a potential risk" + "alertDescriptionFormat": "User accessed URL - '{{Url}}' that contains a file - '{{requestedFileName}}' with risky extension. Downloading this file could pose a potential risk", + "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP address '{{SrcIpAddr}}' accessed a potentially harmful URL" } } }, @@ -2291,7 +2299,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ThreatInfoFoundInWebRequests_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "ThreatInfoFoundInWebRequests_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -2317,7 +2325,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", - "requiredDataConnectors": "[variables('TemplateEmptyArray')]", + "requiredDataConnectors": "[variables('TemplateEmptyArray')]", "tactics": [ "InitialAccess" ], @@ -2327,65 +2335,65 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { - "columnName": "SrcHostname", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "SrcHostname" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { - "columnName": "DstIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DstIpAddr" } - ], - "entityType": "IP" + ] }, { + "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ], - "entityType": "URL" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "EventStartTime": "EventStartTime", "EventCount": "EventCount", - "ThreatCategory": "ThreatCategory", "ThreatConfidence": "ThreatOriginalConfidence", - "ThreatName": "ThreatName", - "EvenEndTime": "EvenEndTime" + "EventStartTime": "EventStartTime", + "ThreatCategory": "ThreatCategory", + "EvenEndTime": "EvenEndTime", + "ThreatName": "ThreatName" }, "alertDetailsOverride": { "alertDisplayNameFormat": "User '{{SrcUsername}}' with IP address '{{SrcIpAddr}}' has been identified as being associated with a threat named '{{ThreatName}}'" @@ -2443,7 +2451,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmptyUserAgent_HuntingQueries Hunting Query with template version 3.0.3", + "description": "EmptyUserAgent_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -2452,7 +2460,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_1", "location": "[parameters('workspace-location')]", "properties": { @@ -2528,7 +2536,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExcessiveForbiddenRequestsDetected_HuntingQueries Hunting Query with template version 3.0.3", + "description": "ExcessiveForbiddenRequestsDetected_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -2537,7 +2545,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_2", "location": "[parameters('workspace-location')]", "properties": { @@ -2613,7 +2621,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPAddressInURL_HuntingQueries Hunting Query with template version 3.0.3", + "description": "IPAddressInURL_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -2622,7 +2630,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_3", "location": "[parameters('workspace-location')]", "properties": { @@ -2698,7 +2706,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KaliLinuxUserAgentDetected_HuntingQueries Hunting Query with template version 3.0.3", + "description": "KaliLinuxUserAgentDetected_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -2707,7 +2715,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { @@ -2783,7 +2791,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialBeaconingDetected_LimitedDomainBased_HuntingQueries Hunting Query with template version 3.0.3", + "description": "PotentialBeaconingDetected_LimitedDomainBased_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -2792,7 +2800,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_5", "location": "[parameters('workspace-location')]", "properties": { @@ -2868,7 +2876,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialBeaconingDetected_SimilarSrcBytes_HuntingQueries Hunting Query with template version 3.0.3", + "description": "PotentialBeaconingDetected_SimilarSrcBytes_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -2877,7 +2885,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { @@ -2953,7 +2961,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PotentialBeaconingDetected_TimeDelta_HuntingQueries Hunting Query with template version 3.0.3", + "description": "PotentialBeaconingDetected_TimeDelta_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -2962,7 +2970,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_7", "location": "[parameters('workspace-location')]", "properties": { @@ -3038,7 +3046,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "RequestFromBotsAndCrawlers_HuntingQueries Hunting Query with template version 3.0.3", + "description": "RequestFromBotsAndCrawlers_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -3047,7 +3055,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_8", "location": "[parameters('workspace-location')]", "properties": { @@ -3123,7 +3131,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ThreatInfoFoundInWebRequests_HuntingQueries Hunting Query with template version 3.0.3", + "description": "ThreatInfoFoundInWebRequests_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -3132,7 +3140,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "Web_Session_Essentials_Hunting_Query_9", "location": "[parameters('workspace-location')]", "properties": { @@ -3208,7 +3216,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SummarizeWebSessionData Playbook with template version 3.0.3", + "description": "SummarizeWebSessionData Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3861,7 +3869,7 @@ "identity": { "type": "SystemAssigned" }, - "apiVersion": "2017-07-01", + "apiVersion": "2019-05-01", "dependsOn": [ "[[resourceId('Microsoft.Web/connections', variables('AzureloganalyticsdatacollectorConnectionName'))]", "[[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]" @@ -3921,15 +3929,15 @@ } ], "metadata": { - "title": "Summarize Web Session Data", - "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfo_CL, WebSession_Summarized_SrcIP_CL, WebSession_Summarized_DstIP_CL and WebSession_Summarized_ThreatInfo_CL.", + "title": "[Deprecated] Summarize Web Session Data", + "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfo_CL, WebSession_Summarized_SrcIP_CL, WebSession_Summarized_DstIP_CL and WebSession_Summarized_ThreatInfo_CL. \n **NOTE: It uses the legacy HTTP data collector API to ingest the data, which is about to be deprecated, so it is recommended to use the SummarizeWebSessionData_logingestion playbook instead.**", "postDeployment": [ "Authorize 'Azure Monitor Logs' and 'Azure Log Analytics Data Collector' API connections." ], "tags": [ "Networking" ], - "lastUpdateTime": "2024-06-03T14:20:36.224Z", + "lastUpdateTime": "2026-09-02T15:37:19.031Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -3953,66 +3961,1424 @@ } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName2')]", "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "version": "3.0.3", - "kind": "Solution", - "contentSchemaVersion": "3.0.0", - "displayName": "Web Session Essentials", - "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Web Session Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the ASIM.

\n

Prerequisite :-

\n

Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.

\n
    \n
  1. Palo Alto PAN-OS
    2. \n
  2. SquidProxy
    3. \n
  3. Vectra AI Stream
    4. \n
  4. Zscaler Internet Access
    5. \n
  5. IIS logs (via LA agent)
    6. \n
\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Product solutions as described above
    2. \n
  2. Logic app for data summarization
    3. \n
\n

Recommendation :-

\n

It is highly recommended to use the SummarizeWebSessionData logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.

\n

Workbooks: 1, Analytic Rules: 15, Hunting Queries: 9, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", - "contentKind": "Solution", - "contentProductId": "[variables('_solutioncontentProductId')]", - "id": "[variables('_solutioncontentProductId')]", - "icon": "", - "contentId": "[variables('_solutionId')]", - "parentId": "[variables('_solutionId')]", - "source": { - "kind": "Solution", - "name": "Web Session Essentials", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "criteria": [ - { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" + "description": "SummarizeWebSessionData-logingestion Playbook with template version 3.0.4", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion2')]", + "parameters": { + "PlaybookName": { + "defaultValue": "SummarizeWebSessionData-logingestion", + "type": "string" }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", - "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + "logAnalyticsName": { + "type": "string", + "metadata": { + "description": "Enter value for logAnalyticsName" + } }, - { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", - "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + "resourceGroupName": { + "type": "string", + "metadata": { + "description": "Enter value for resourceGroupName" + } }, + "subscriptionId": { + "type": "string", + "metadata": { + "description": "Enter value for subscriptionId" + } + } + }, + "variables": { + "AzuremonitorlogsConnectionName": "[[concat('Azuremonitorlogs-', parameters('PlaybookName'))]", + "suffix": "[[uniqueString(resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName')))]", + "DCEName": "[[concat('web-session-summarization-dce-', variables('suffix'))]", + "DCRName": "[[concat('web-session-summarization-dcr-', variables('suffix'))]", + "workspaceResourceId": "[[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsName'))]", + "destinationName": "[[concat('webSessionSummarizationDestination', variables('suffix'))]", + "monitoringMetricsPublisherRoleId": "3913510d-42f4-4e42-8a64-420c390055eb", + "roleAssignmentName": "[[guid(resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName')), resourceId('Microsoft.Logic/workflows', parameters('PlaybookName')), variables('monitoringMetricsPublisherRoleId'))]", + "connection-8": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuremonitorlogs')]", + "_connection-8": "[[variables('connection-8')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]" + }, + "resources": [ { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", - "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + "type": "Microsoft.Insights/dataCollectionEndpoints", + "apiVersion": "2022-06-01", + "name": "[[variables('DCEName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "Linux", + "properties": { + "description": "Data collection endpoint for Web Session Essentials summarized logs", + "networkAcls": { + "publicNetworkAccess": "Enabled" + } + } }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", - "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_DstIPV1_CL')]", + "properties": { + "plan": "Analytics", + "schema": { + "name": "WebSession_Summarized_DstIPV1_CL", + "columns": [ + { + "name": "SrcBytes_d", + "type": "real" + }, + { + "name": "DstBytes_d", + "type": "real" + }, + { + "name": "EventCount_d", + "type": "real" + }, + { + "name": "DstIpAddr_s", + "type": "string" + }, + { + "name": "SrcIPIsPrivate_b", + "type": "boolean" + }, + { + "name": "DstPortNumber_d", + "type": "real" + }, + { + "name": "DestDomain_s", + "type": "string" + }, + { + "name": "DstHostname_s", + "type": "string" + }, + { + "name": "EventResult_s", + "type": "string" + }, + { + "name": "EventResultDetails_s", + "type": "string" + }, + { + "name": "EventProduct_s", + "type": "string" + }, + { + "name": "EventType_s", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime_t", + "type": "datetime" + } + ] + } + } }, { - "kind": "AnalyticsRule", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcInfoV1_CL')]", + "properties": { + "plan": "Analytics", + "schema": { + "name": "WebSession_Summarized_SrcInfoV1_CL", + "columns": [ + { + "name": "SrcBytes_d", + "type": "real" + }, + { + "name": "DstBytes_d", + "type": "real" + }, + { + "name": "EventCount_d", + "type": "real" + }, + { + "name": "HttpUserAgent_s", + "type": "string" + }, + { + "name": "EventResultDetails_s", + "type": "string" + }, + { + "name": "EventResult_s", + "type": "string" + }, + { + "name": "UrlCategory_s", + "type": "string" + }, + { + "name": "NetworkApplicationProtocol_s", + "type": "string" + }, + { + "name": "HttpRequestMethod_s", + "type": "string" + }, + { + "name": "HttpContentType_s", + "type": "string" + }, + { + "name": "EventProduct_s", + "type": "string" + }, + { + "name": "EventVendor_s", + "type": "string" + }, + { + "name": "EventType_s", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime_t", + "type": "datetime" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_SrcIPV1_CL')]", + "properties": { + "plan": "Analytics", + "schema": { + "name": "WebSession_Summarized_SrcIPV1_CL", + "columns": [ + { + "name": "SrcBytes_d", + "type": "real" + }, + { + "name": "DstBytes_d", + "type": "real" + }, + { + "name": "EventCount_d", + "type": "real" + }, + { + "name": "SrcUsername_s", + "type": "string" + }, + { + "name": "SrcIpAddr_s", + "type": "string" + }, + { + "name": "SrcHostname_s", + "type": "string" + }, + { + "name": "DstIPIsPrivate_b", + "type": "boolean" + }, + { + "name": "DestDomain_s", + "type": "string" + }, + { + "name": "EventResult_s", + "type": "string" + }, + { + "name": "EventResultDetails_s", + "type": "string" + }, + { + "name": "EventProduct_s", + "type": "string" + }, + { + "name": "EventType_s", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime_t", + "type": "datetime" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2022-10-01", + "name": "[[concat(parameters('logAnalyticsName'), '/WebSession_Summarized_ThreatInfoV1_CL')]", + "properties": { + "plan": "Analytics", + "schema": { + "name": "WebSession_Summarized_ThreatInfoV1_CL", + "columns": [ + { + "name": "EventCount_d", + "type": "real" + }, + { + "name": "ThreatName_s", + "type": "string" + }, + { + "name": "ThreatCategory_s", + "type": "string" + }, + { + "name": "ThreatRiskLevel_d", + "type": "real" + }, + { + "name": "ThreatOriginalConfidence_d", + "type": "real" + }, + { + "name": "EventSeverity_s", + "type": "string" + }, + { + "name": "ThreatField_s", + "type": "string" + }, + { + "name": "SrcIpAddr_s", + "type": "string" + }, + { + "name": "SrcUsername_s", + "type": "string" + }, + { + "name": "DestDomain_s", + "type": "string" + }, + { + "name": "EventResult_s", + "type": "string" + }, + { + "name": "DstIpAddr_s", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime_t", + "type": "datetime" + } + ] + } + } + }, + { + "type": "Microsoft.Insights/dataCollectionRules", + "apiVersion": "2022-06-01", + "name": "[[variables('DCRName')]", + "location": "[[variables('workspace-location-inline')]", + "dependsOn": [ + "[[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", + "[[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_DstIPV1_CL')]", + "[[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcInfoV1_CL')]", + "[[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_SrcIPV1_CL')]", + "[[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('logAnalyticsName'), 'WebSession_Summarized_ThreatInfoV1_CL')]" + ], + "properties": { + "dataCollectionEndpointId": "[[resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))]", + "streamDeclarations": { + "Custom-WebSession_Summarized_DstIPV1": { + "columns": [ + { + "name": "SrcBytes", + "type": "real" + }, + { + "name": "DstBytes", + "type": "real" + }, + { + "name": "EventCount", + "type": "real" + }, + { + "name": "DstIpAddr", + "type": "string" + }, + { + "name": "SrcIPIsPrivate", + "type": "boolean" + }, + { + "name": "DstPortNumber", + "type": "real" + }, + { + "name": "DestDomain", + "type": "string" + }, + { + "name": "DstHostname", + "type": "string" + }, + { + "name": "EventResult", + "type": "string" + }, + { + "name": "EventResultDetails", + "type": "string" + }, + { + "name": "EventProduct", + "type": "string" + }, + { + "name": "EventType", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime", + "type": "datetime" + } + ] + }, + "Custom-WebSession_Summarized_SrcInfoV1": { + "columns": [ + { + "name": "SrcBytes", + "type": "real" + }, + { + "name": "DstBytes", + "type": "real" + }, + { + "name": "EventCount", + "type": "real" + }, + { + "name": "HttpUserAgent", + "type": "string" + }, + { + "name": "EventResultDetails", + "type": "string" + }, + { + "name": "EventResult", + "type": "string" + }, + { + "name": "UrlCategory", + "type": "string" + }, + { + "name": "NetworkApplicationProtocol", + "type": "string" + }, + { + "name": "HttpRequestMethod", + "type": "string" + }, + { + "name": "HttpContentType", + "type": "string" + }, + { + "name": "EventProduct", + "type": "string" + }, + { + "name": "EventVendor", + "type": "string" + }, + { + "name": "EventType", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime", + "type": "datetime" + } + ] + }, + "Custom-WebSession_Summarized_SrcIPV1": { + "columns": [ + { + "name": "SrcBytes", + "type": "real" + }, + { + "name": "DstBytes", + "type": "real" + }, + { + "name": "EventCount", + "type": "real" + }, + { + "name": "SrcUsername", + "type": "string" + }, + { + "name": "SrcIpAddr", + "type": "string" + }, + { + "name": "SrcHostname", + "type": "string" + }, + { + "name": "DstIPIsPrivate", + "type": "boolean" + }, + { + "name": "DestDomain", + "type": "string" + }, + { + "name": "EventResult", + "type": "string" + }, + { + "name": "EventResultDetails", + "type": "string" + }, + { + "name": "EventProduct", + "type": "string" + }, + { + "name": "EventType", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime", + "type": "datetime" + } + ] + }, + "Custom-WebSession_Summarized_ThreatInfoV1": { + "columns": [ + { + "name": "EventCount", + "type": "real" + }, + { + "name": "ThreatName", + "type": "string" + }, + { + "name": "ThreatCategory", + "type": "string" + }, + { + "name": "ThreatRiskLevel", + "type": "real" + }, + { + "name": "ThreatOriginalConfidence", + "type": "real" + }, + { + "name": "EventSeverity", + "type": "string" + }, + { + "name": "ThreatField", + "type": "string" + }, + { + "name": "SrcIpAddr", + "type": "string" + }, + { + "name": "SrcUsername", + "type": "string" + }, + { + "name": "DestDomain", + "type": "string" + }, + { + "name": "EventResult", + "type": "string" + }, + { + "name": "DstIpAddr", + "type": "string" + }, + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "EventTime", + "type": "datetime" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[[variables('workspaceResourceId')]", + "name": "[[variables('destinationName')]" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-WebSession_Summarized_DstIPV1" + ], + "destinations": [ + "[[variables('destinationName')]" + ], + "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), DstIpAddr_s=tostring(DstIpAddr), SrcIPIsPrivate_b=tobool(SrcIPIsPrivate), DstPortNumber_d=toreal(DstPortNumber), DestDomain_s=tostring(DestDomain), DstHostname_s=tostring(DstHostname), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", + "outputStream": "Custom-WebSession_Summarized_DstIPV1_CL" + }, + { + "streams": [ + "Custom-WebSession_Summarized_SrcInfoV1" + ], + "destinations": [ + "[[variables('destinationName')]" + ], + "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), HttpUserAgent_s=tostring(HttpUserAgent), EventResultDetails_s=tostring(EventResultDetails), EventResult_s=tostring(EventResult), UrlCategory_s=tostring(UrlCategory), NetworkApplicationProtocol_s=tostring(NetworkApplicationProtocol), HttpRequestMethod_s=tostring(HttpRequestMethod), HttpContentType_s=tostring(HttpContentType), EventProduct_s=tostring(EventProduct), EventVendor_s=tostring(EventVendor), EventType_s=tostring(EventType), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", + "outputStream": "Custom-WebSession_Summarized_SrcInfoV1_CL" + }, + { + "streams": [ + "Custom-WebSession_Summarized_SrcIPV1" + ], + "destinations": [ + "[[variables('destinationName')]" + ], + "transformKql": "source | project SrcBytes_d=toreal(SrcBytes), DstBytes_d=toreal(DstBytes), EventCount_d=toreal(EventCount), SrcUsername_s=tostring(SrcUsername), SrcIpAddr_s=tostring(SrcIpAddr), SrcHostname_s=tostring(SrcHostname), DstIPIsPrivate_b=tobool(DstIPIsPrivate), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), EventResultDetails_s=tostring(EventResultDetails), EventProduct_s=tostring(EventProduct), EventType_s=tostring(EventType), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", + "outputStream": "Custom-WebSession_Summarized_SrcIPV1_CL" + }, + { + "streams": [ + "Custom-WebSession_Summarized_ThreatInfoV1" + ], + "destinations": [ + "[[variables('destinationName')]" + ], + "transformKql": "source | project EventCount_d=toreal(EventCount), ThreatName_s=tostring(ThreatName), ThreatCategory_s=tostring(ThreatCategory), ThreatRiskLevel_d=toreal(ThreatRiskLevel), ThreatOriginalConfidence_d=toreal(ThreatOriginalConfidence), EventSeverity_s=tostring(EventSeverity), ThreatField_s=tostring(ThreatField), SrcIpAddr_s=tostring(SrcIpAddr), SrcUsername_s=tostring(SrcUsername), DestDomain_s=tostring(DestDomain), EventResult_s=tostring(EventResult), DstIpAddr_s=tostring(DstIpAddr), TimeGenerated=todatetime(TimeGenerated), EventTime_t=todatetime(EventTime)", + "outputStream": "Custom-WebSession_Summarized_ThreatInfoV1_CL" + } + ] + } + }, + { + "properties": { + "provisioningState": "Succeeded", + "state": "Disabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "logAnalyticsName": { + "defaultValue": "[[parameters('logAnalyticsName')]", + "type": "string" + }, + "resourceGroupName": { + "defaultValue": "[[parameters('resourceGroupName')]", + "type": "string" + }, + "subscriptionId": { + "defaultValue": "[[parameters('subscriptionId')]", + "type": "string" + }, + "ingestionEndpoint": { + "defaultValue": "[[concat(reference(resourceId('Microsoft.Insights/dataCollectionEndpoints', variables('DCEName'))).logsIngestion.endpoint, '/dataCollectionRules/', reference(resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))).immutableId, '/streams/')]", + "type": "string" + } + }, + "triggers": { + "Recurrence": { + "recurrence": { + "frequency": "Hour", + "interval": 1 + }, + "evaluatedRecurrence": { + "frequency": "Hour", + "interval": 1 + }, + "type": "Recurrence" + } + }, + "actions": { + "Condition_DstIP": { + "actions": { + "For_each_DstIP": { + "foreach": "@variables('multipleArraysDstIP')", + "actions": { + "Send_Data_DstIP": { + "type": "Http", + "inputs": { + "body": "@items('For_each_DstIP')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_DstIPV1', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable_-_multipleArraysDstIP": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable_-_multipleArraysDstIP": { + "type": "SetVariable", + "inputs": { + "name": "multipleArraysDstIP", + "value": "@chunk(body('Run_query_and_list_results_DstIP')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthDstIP'),variables('ArraySizeDstIP'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArraysDstIP": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeDstIP')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_SourceInfo": { + "actions": { + "For_each_-_SubArray_-_SourceInfo": { + "foreach": "@variables('multipleArraysSourceInfo')", + "actions": { + "Send_Data_SourceInfo": { + "type": "Http", + "inputs": { + "body": "@items('For_each_-_SubArray_-_SourceInfo')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcInfoV1', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable": { + "type": "SetVariable", + "inputs": { + "name": "multipleArraysSourceInfo", + "value": "@chunk(body('Run_query_and_list_results_SourceInfo')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthSourceInfo'),variables('ArraySizeSourceInfo'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArrays_-_SourceInfo": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeSourceInfo')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_SrcIP": { + "actions": { + "For_each": { + "foreach": "@variables('multipleArraysSrcIP')", + "actions": { + "Send_Data_SrcIP": { + "type": "Http", + "inputs": { + "body": "@items('For_each')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_SrcIPV1', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable_multipleArraysIP": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable_multipleArraysIP": { + "type": "SetVariable", + "inputs": { + "name": "multipleArraysSrcIP", + "value": "@chunk(body('Run_query_and_list_results_SrcIP')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthSrcIP'),variables('ArraySizeSrcIP'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArraysSrcIP": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeSrcIP')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Condition_ThreatInfo": { + "actions": { + "For_each_ThreatInfo": { + "foreach": "@variables('multipleArraysThreatInfo')", + "actions": { + "Send_Data": { + "type": "Http", + "inputs": { + "body": "@items('For_each_ThreatInfo')", + "headers": { + "Content-Type": "application/json" + }, + "authentication": { + "type": "ManagedServiceIdentity", + "audience": "https://monitor.azure.com/" + }, + "method": "POST", + "uri": "@concat(parameters('ingestionEndpoint'), 'Custom-WebSession_Summarized_ThreatInfoV1', '?api-version=2023-01-01')" + } + } + }, + "runAfter": { + "Set_variable_-_multipleArraysThreatInfo": [ + "Succeeded" + ] + }, + "type": "Foreach" + }, + "Set_variable_-_multipleArraysThreatInfo": { + "type": "SetVariable", + "inputs": { + "name": "multipleArraysThreatInfo", + "value": "@chunk(body('Run_query_and_list_results_ThreatInfo')?['value'],div(variables('MaxByteSizeAllowed'),div(variables('TotalCharacterLengthThreatInfo'),variables('ArraySizeThreatInfo'))))" + } + } + }, + "runAfter": { + "Initialize_variable_-_multipleArraysThreatInfo": [ + "Succeeded" + ] + }, + "expression": { + "and": [ + { + "greater": [ + "@variables('ArraySizeThreatInfo')", + 0 + ] + } + ] + }, + "type": "If" + }, + "Initialize_variable_-_ArraySizeDstIP": { + "runAfter": { + "Run_query_and_list_results_DstIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeDstIP", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_DstIP')?['value'])" + } + ] + } + }, + "Initialize_variable_-_ArraySizeSrcIP": { + "runAfter": { + "Run_query_and_list_results_SrcIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeSrcIP", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_SrcIP')?['value'])" + } + ] + } + }, + "Initialize_variable_-_ArraySizeThreatInfo": { + "runAfter": { + "Run_query_and_list_results_ThreatInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeThreatInfo", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_ThreatInfo')?['value'])" + } + ] + } + }, + "Initialize_variable_-_ArraySize_-_SourceInfo": { + "runAfter": { + "Run_query_and_list_results_SourceInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "ArraySizeSourceInfo", + "type": "integer", + "value": "@length(body('Run_query_and_list_results_SourceInfo')?['value'])" + } + ] + } + }, + "Initialize_variable_-_TotalCharacterLengthSrcIP": { + "runAfter": { + "Initialize_variable_-_ArraySizeSrcIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthSrcIP", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_SrcIP')?['value']))" + } + ] + } + }, + "Initialize_variable_-_TotalCharacterLengthThreatInfo": { + "runAfter": { + "Initialize_variable_-_ArraySizeThreatInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthThreatInfo", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_ThreatInfo')?['value']))" + } + ] + } + }, + "Initialize_variable_-_TotalCharacterLength_-_SourceInfo": { + "runAfter": { + "Initialize_variable_-_ArraySize_-_SourceInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthSourceInfo", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_SourceInfo')?['value']))" + } + ] + } + }, + "Initialize_variable_-_TotalCharaterLengthDstIP": { + "runAfter": { + "Initialize_variable_-_ArraySizeDstIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "TotalCharacterLengthDstIP", + "type": "integer", + "value": "@length(string(body('Run_query_and_list_results_DstIP')?['value']))" + } + ] + } + }, + "Initialize_variable_-_multipleArraysDstIP": { + "runAfter": { + "Initialize_variable_-_TotalCharaterLengthDstIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysDstIP", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_multipleArraysSrcIP": { + "runAfter": { + "Initialize_variable_-_TotalCharacterLengthSrcIP": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysSrcIP", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_multipleArraysThreatInfo": { + "runAfter": { + "Initialize_variable_-_TotalCharacterLengthThreatInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysThreatInfo", + "type": "array" + } + ] + } + }, + "Initialize_variable_-_multipleArrays_-_SourceInfo": { + "runAfter": { + "Initialize_variable_-_TotalCharacterLength_-_SourceInfo": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "multipleArraysSourceInfo", + "type": "array" + } + ] + } + }, + "MaxRequestSizeAllowed": { + "runAfter": { + "nowTime": [ + "Succeeded" + ] + }, + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "MaxByteSizeAllowed", + "type": "integer", + "value": 26214400 + } + ] + } + }, + "Run_query_and_list_results_DstIP": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_DstIPV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated < bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by DstIpAddr, SrcIPIsPrivate = ipv4_is_private(SrcIpAddr), DstPortNumber, DestDomain = tostring(parse_url(Url)[\"Host\"]), DstHostname, EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "Run_query_and_list_results_SourceInfo": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcInfoV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated < bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by HttpUserAgent, EventResultDetails, EventResult, UrlCategory, NetworkApplicationProtocol, HttpRequestMethod, HttpContentType, EventTime = bin(TimeGenerated, 1h), EventProduct, EventVendor, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "Run_query_and_list_results_SrcIP": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_SrcIPV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated < bin(nowTime,1h)\n| summarize SrcBytes = sum(SrcBytes), DstBytes = sum(DstBytes), EventCount = count() by SrcUsername, SrcIpAddr, SrcHostname, DstIPIsPrivate = ipv4_is_private(DstIpAddr), DestDomain = tostring(parse_url(Url)[\"Host\"]), EventResult, EventResultDetails, EventProduct, EventType, bin(TimeGenerated,1h)\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "Run_query_and_list_results_ThreatInfo": { + "runAfter": { + "MaxRequestSizeAllowed": [ + "Succeeded" + ] + }, + "type": "ApiConnection", + "inputs": { + "body": "let nowTime = todatetime(\"@{variables('nowTime')}\");\nlet lastRecievedTime = toscalar (\n union isfuzzy=true\n (\n WebSession_Summarized_ThreatInfoV1_CL \n | summarize max(EventTime_t)\n | extend max_TimeGenerated = datetime_add('hour',1,bin(max_EventTime_t,1h))\n ),\n (\n print (nowTime)\n | extend max_TimeGenerated = datetime_add('day',-1,bin(print_0,1h)) \n | project-away print_0\n )\n | summarize max(max_TimeGenerated)\n );\n_Im_WebSession(starttime=lastRecievedTime,endtime=bin(nowTime,1h))\n| where TimeGenerated < bin(nowTime,1h)\n| where (ThreatName != 'None' and isnotempty(ThreatName)) or (ThreatCategory != 'None' and isnotempty(ThreatCategory)) or ThreatRiskLevel > 60 or toint(ThreatOriginalConfidence) > 0 or EventSeverity in ('Medium','High') or isnotempty(ThreatField)\n| summarize EventCount=count() by ThreatName, ThreatCategory, ThreatRiskLevel, toint(ThreatOriginalConfidence), EventSeverity, ThreatField, SrcIpAddr, SrcUsername, DestDomain = tostring(parse_url(Url)[\"Host\"]), bin(TimeGenerated, 1h), EventResult, DstIpAddr\n| extend EventTime = TimeGenerated", + "host": { + "connection": { + "name": "@parameters('$connections')['azuremonitorlogs']['connectionId']" + } + }, + "method": "post", + "path": "/queryData", + "queries": { + "resourcegroups": "@parameters('resourceGroupName')", + "resourcename": "@parameters('logAnalyticsName')", + "resourcetype": "Log Analytics Workspace", + "subscriptions": "@parameters('subscriptionId')", + "timerange": "Last 1 day" + } + } + }, + "nowTime": { + "type": "InitializeVariable", + "inputs": { + "variables": [ + { + "name": "nowTime", + "type": "string", + "value": "@{utcNow()}" + } + ] + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuremonitorlogs": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]", + "connectionName": "[[variables('AzuremonitorlogsConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/Azuremonitorlogs')]" + } + } + } + } + }, + "name": "[[parameters('PlaybookName')]", + "type": "Microsoft.Logic/workflows", + "location": "[[variables('workspace-location-inline')]", + "tags": { + "hidden-SentinelTemplateName": "SummarizeWebSessionData", + "hidden-SentinelTemplateVersion": "1.0", + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + }, + "identity": { + "type": "SystemAssigned" + }, + "apiVersion": "2019-05-01", + "dependsOn": [ + "[[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", + "[[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]" + ] + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('AzuremonitorlogsConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('AzuremonitorlogsConnectionName')]", + "api": { + "id": "[[variables('_connection-8')]" + } + } + }, + { + "type": "Microsoft.Authorization/roleAssignments", + "apiVersion": "2022-04-01", + "name": "[[variables('roleAssignmentName')]", + "scope": "[[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", + "dependsOn": [ + "[[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", + "[[resourceId('Microsoft.Logic/workflows', parameters('PlaybookName'))]" + ], + "properties": { + "roleDefinitionId": "[[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringMetricsPublisherRoleId'))]", + "principalId": "[[reference(resourceId('Microsoft.Logic/workflows', parameters('PlaybookName')), '2019-05-01', 'Full').identity.principalId]", + "principalType": "ServicePrincipal" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId2'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId2')]", + "contentId": "[variables('_playbookContentId2')]", + "kind": "Playbook", + "version": "[variables('playbookVersion2')]", + "source": { + "kind": "Solution", + "name": "Web Session Essentials", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + } + ], + "metadata": { + "title": "Summarize Web Session Data using Log Ingestion API", + "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfoV1_CL, WebSession_Summarized_SrcIPV1_CL, WebSession_Summarized_DstIPV1_CL and WebSession_Summarized_ThreatInfoV1_CL.", + "postDeployment": [ + "Authorize the 'Azure Monitor Logs' API connection. Log ingestion uses the playbook's managed identity." + ], + "tags": [ + "Networking" + ], + "lastUpdateTime": "2026-09-02T15:37:19.733Z", + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId2')]", + "contentKind": "Playbook", + "displayName": "SummarizeWebSessionData-logingestion", + "contentProductId": "[variables('_playbookcontentProductId2')]", + "id": "[variables('_playbookcontentProductId2')]", + "version": "[variables('playbookVersion2')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.4", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "Web Session Essentials", + "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Web Session Essentials is a domain solution and does not include any data connectors. The content in this solution requires one of the product solutions below, as well as any other connector or data source normalized to the ASIM.

\n

Prerequisite :-

\n

Install one or more of the listed solutions, or develop your custom ASIM parsers to unlock the value provided by this solution.

\n
    \n
  1. Palo Alto PAN-OS
    2. \n
  2. SquidProxy
    3. \n
  3. Vectra AI Stream
    4. \n
  4. Zscaler Internet Access
    5. \n
  5. IIS logs (via LA agent)
    6. \n
\n

Underlying Microsoft Technologies used:

\n

This solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

\n
    \n
  1. Product solutions as described above
    2. \n
  2. Logic app for data summarization
    3. \n
\n

Recommendation :-

\n

It is highly recommended to use the SummarizeWebSessionData logic app playbook provided with this solution as it will significantly improve the performance of the Workbook, Analytic rules & Hunting queries.\nNOTE: This solution includes the playbook SummarizeWebSessionData, which uses the legacy HTTP data collector API to ingest data. Since that API is about to be deprecated, we recommend using the SummarizeWebSessionData_logingestion playbook instead.

\n

Workbooks: 1, Analytic Rules: 15, Hunting Queries: 9, Playbooks: 2

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "Web Session Essentials", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + }, + "dependencies": { + "criteria": [ + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + }, + { + "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" }, @@ -4116,6 +5482,11 @@ "contentId": "[variables('_SummarizeWebSessionData')]", "version": "[variables('playbookVersion1')]" }, + { + "kind": "Playbook", + "contentId": "[variables('_SummarizeWebSessionData_logingestion')]", + "version": "[variables('playbookVersion2')]" + }, { "kind": "Solution", "contentId": "azuresentinel.azure-sentinel-solution-paloaltopanos" diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json index 6590523a616..fed7b9a81bf 100644 --- a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json @@ -2,8 +2,8 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "title": "Summarize Web Session Data", - "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfo_CL, WebSession_Summarized_SrcIP_CL, WebSession_Summarized_DstIP_CL and WebSession_Summarized_ThreatInfo_CL.", + "title": "[Deprecated] Summarize Web Session Data", + "description": "The 'SummarizeWebSessionData' Playbook helps with summarizing the Web Session logs and ingesting them into custom tables for persistence. Although enabling the summarization playbook for the Web Session solution is totally optional, we highly recommend enabling it for a better user experience in environments with high EPS (events per second) data ingestion. After installing the solution, it will be deployed under Playbook Templates in the Automation blade of Microsoft Sentinel. It can be configured and managed from the Manage Solution view in Content Hub. This playbook will create four custom data summarization tables: WebSession_Summarized_SrcInfo_CL, WebSession_Summarized_SrcIP_CL, WebSession_Summarized_DstIP_CL and WebSession_Summarized_ThreatInfo_CL. \n **NOTE: It uses the legacy HTTP data collector API to ingest the data, which is about to be deprecated, so it is recommended to use the SummarizeWebSessionData_logingestion playbook instead.**", "prerequisites": [], "postDeployment": [ "Authorize 'Azure Monitor Logs' and 'Azure Log Analytics Data Collector' API connections." @@ -681,7 +681,7 @@ "identity": { "type": "SystemAssigned" }, - "apiVersion": "2017-07-01", + "apiVersion": "2019-05-01", "dependsOn": [ "[resourceId('Microsoft.Web/connections', variables('AzureloganalyticsdatacollectorConnectionName'))]", "[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]" diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json index af03e21332a..8ead95a9497 100644 --- a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json @@ -740,7 +740,7 @@ "identity": { "type": "SystemAssigned" }, - "apiVersion": "2017-07-01", + "apiVersion": "2019-05-01", "dependsOn": [ "[resourceId('Microsoft.Insights/dataCollectionRules', variables('DCRName'))]", "[resourceId('Microsoft.Web/connections', variables('AzuremonitorlogsConnectionName'))]" @@ -772,7 +772,7 @@ ], "properties": { "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('monitoringMetricsPublisherRoleId'))]", - "principalId": "[reference(resourceId('Microsoft.Logic/workflows', parameters('PlaybookName')), '2017-07-01', 'Full').identity.principalId]", + "principalId": "[reference(resourceId('Microsoft.Logic/workflows', parameters('PlaybookName')), '2019-05-01', 'Full').identity.principalId]", "principalType": "ServicePrincipal" } } diff --git a/Solutions/Web Session Essentials/ReleaseNotes.md b/Solutions/Web Session Essentials/ReleaseNotes.md index ff2418fd72c..fbf0605b90f 100644 --- a/Solutions/Web Session Essentials/ReleaseNotes.md +++ b/Solutions/Web Session Essentials/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-----------------------------------------------| +| 3.0.4 | 02-09-2026 | Added Summarize Web Session Data using Log Ingestion API **Playbook** | | 3.0.3 | 06-06-2024 | Updated Entity Mapping **Analytic Rule** CommandInURL.yaml | | 3.0.2 | 31-01-2024 | Updated the solution to fix **Analytic Rules** deployment issue | | 3.0.1 | 02-01-2024 | Tagged for dependent Solutions for deployment | From cc07c932ac662482113082c724bf89548a20fbcc Mon Sep 17 00:00:00 2001 From: v-sabiraj <94349919+v-sabiraj@users.noreply.github.com> Date: Wed, 2 Sep 2026 15:59:39 +0530 Subject: [PATCH 5/5] updated "lastUpdateTime" in playbooks --- .../Web Session Essentials/Package/3.0.4.zip | Bin 54882 -> 54871 bytes .../Package/mainTemplate.json | 4 ++-- .../SummarizeWebSessionData/azuredeploy.json | 1 + .../azuredeploy.json | 1 + 4 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Solutions/Web Session Essentials/Package/3.0.4.zip b/Solutions/Web Session Essentials/Package/3.0.4.zip index 268e791eede8b7949cca5c8c2e4aaae9948d8758..a4ca63f948ee2d19ece9420a48fed6f7cb9cd6fc 100644 GIT binary patch delta 22701 zcmV)}KzqO9tOM7q0}N100|XQR000O8NPn>m7#9sle zD9QFVJ+1M_w(iKb#&UPxUCY5J5=FAsAb^t)ekXtMpF!9=58q#gzXf6cJbX{X{|Lf^ z^YHyLoCM+FdHCT~I19qTdHCTn{2GKu=k0I(@0pK&JLn9)x4#``e!03De)*|=)!VK^9sgQIY891c#x!LxAiJRIO~Fb)TkaA1T35)P)}Q7=5|herqD(P4Nr2#=1! zqvP=CBs_W+9z73_aCk5c560o4(eAXr9e02FgYS=pUOruX4t^hugk>>;VmlY0DK1&| z12ja1^(W*aC`ge4D@Rj@0>C2jM}dBz&WM6tqvizx`5#|h8Q=Py!|yC9Nbx_%kQ$=b z0eDOL+aPMx8wp*}l3zSg(9Rgo2f(a=z`alh}3^B z89Ys4f{*A&;WB4XmmEY))HZVHL+d=04gB|;YkF}umn?=xuwfNkjO1XR9KGSXEs`Yu zg?pE$SP?H%SgJg2tab^ws0H>Xb7oe67B1D(_bEUkRZucx4-@ZBl}U;?B9t=hkP~bf z6fksbi}dG&X3POzb+@CY!-9)_#0Y;Ta^E+wkG+^qv4q9CB}UA!%%UD)(`=P8Rb9gS z`{)lDrC=qD7dF^Hb1+#fSlJyg=^$+4&&dMJ7)jRRx+{JupbW5siDW`$tG5EMtva|3 z{>z25=@mv|spb!CH3_-E1|%-KA;=;OZ@bFW(kWw}Nvu|WyEghOIzYoA=;wbTszvIh zq9#|3;Z;NGto?oT-o8QHjNmzzq=>V#05WZ;MFl9R4vcStEz9=N%!V&vIGRB-KKF5Q zH)t})mSMt@wz|K4di$)SaEG;bxJf^yuD8-ki1aXDcftZ1`8Ff6h=uLUiWWw=vZ|w0 zQ>?cXU5b%K4BevCSYt)gr4oMx3$24F#5p~mnx+VjngWq~L(qb8JGF-U=U^Foaw!{SPfvS*mAs`piL`j|pKLKqzmjX$c*GwmFyySp&QZ@= zb*nr~=SkCNK@(4E3lYPpuocJl-Nx*I(T`(DikvR=coR!`sgINCg5sg4me`a zV4-goIN&w_!}E2(9qE6?-Nxh z>-GAZ1r!hZcLEfzK*uI?sqK2!E2+1)j<4KxM%Bpc>bzqAn=4Sc{nY8fYAEp&OAiJ% zut>n@J>7(0S%7E+1dWQY34b3PY^)+UNv)ooW z!6nQ-0rA8!9708eEbw^BFPZ(FVRVT!lephZ7U!PW3&*t=6kg#a{DEzRu)1-q4~2hS5yfy%P}r(S647xDg-!CKhQiiR*jVre_AQlmTWY{rM78y2(xd?yOF=$Fuxs%=Oh%-_{NRp@9 zrmQm$bSqTzv;q&(J$n>3K`3~{PTBnyExK;>3eig@m;D$-B8Hv{vBW9<1d+5qiQjGBwOsw`B zhNRudBdmXPm}5JEiCsoJXS0$@9JTnPsFH%P}hCqg;nUyLC=gb{Z$PIgr zto?>P`EW8_n6miWQvAc4i+_x9^iRhW3B>mIVSay=;_n~N0FeNWB1q*tFWt%Cmp<|0DqiZJaS5>`W=&rfEFDIt0mDNvkN7q9C@Y@`prZW}dzi37 zwmkNZA+PqZ7y)E-^MBDHl&=;+-A?gENP@N9@+`NI@ zsDNV=W>5z$Ff(#of<1!XzHb8IVAUCfJp)zv_M+(}DS>tS7l^K0HCTTlXQZA;(U7H< zgl=L8pXjQ?{-LZj_%m8tu}r3uJtoR`CV^dvlr-sf@eUw2874m2h7k?fJx+g%8q*-g zWY;>nGWsHu&Qd(k^0j(Z$^Pp~*r}XmDs<}H)|_@~+|=fAQ}#l6#BG0cekM#i%vjnt=p76;xZc7}3YZ=91!%=uBAeN+fk#|% z^*dWA4=c%EV((kj&bJYKpWSkoSLPvwum?y;M@UIHwBuxTUI$W zhn!IH`V?{t%-n{u_8xPgAs76M^7v5$W*!7ElMY^h+kOjxnS*r!GrE6qtPhx3F}QJ0 zfSIZRCed*Xm`U=Z2F%oenOy|TR8}tQ0%kTDsk#el=Aabca&QOK%*wrPMBzRe)XZTS zYUZ#;&1?)c1IF>`j99(|kpJM2nZuj~rpnyYh0Gl0EB-VCo@g>T?0FP6Bq$rtAvACp zgySEagb{|N;z^7LkEwqc0B7Ml)Y!Feyu=xp9j4j7X2A)cV_Y29hO;&@=oG?EmLI2T z-~bxi0{jac;Tcg9B*Mz7djz{IaK(HCa`}qu`)d3zI@vSCgUG|?V9!VW0W$ECeSvxc z0CU6gH1O2vXbh$1U7l0U4J>|YkK(jO?m4^yE;icY6@CJ7N~(Xkdrj5$cY#S6NKgs@ zAf_NeDHYWj7aQJ$*hlt~~7$$;O?($$+Kz0LoojAM}nNM7bP5LKk6(%<7E14j) zIejuYXVB^O?1H$LWDdI~*3=%oI*(f>YUjZa zMi3>KeD_%B!3eH)U{z&~3sr3XeE zfJK(UegvU~r_tJLGpQ|3_LUx>lJpCLrV*Pn&Ev_8r{a>ptR;aOaSs4XV7igJI%TTP z!0~O=?{$9$&pJmZ$1s=w3Pi0*Fa6Od{SVCEkPBk6P3lkE5{)&|+Ql~*GCWbw{|Q3* zx7SP*ekxrC8<(Ro@o!)|X&v?YXm5{6ReO74b-0saRZG>1QuXr?9c@!P4Qeskf^u5V zRERVYvls?O8`M#9^``~_P^7%oJ@Pb-m8!lY4+?+hM!G{KZB;!m^48m5z_iGR@~*4{ zv!LEIFgKOmO3nSL2lKx6{0rOl-!o)l1`eEHh7KYeW6*MSF`J&mBlH&rl1tcIx$sh5 z+SLt}DwcrF&2h7sa|vG8Nx~99w?R45txgj5a7n_>EP79MfBVn1CBFD?hlkq$y6rR~ z30i+|8?v?YNWh&be!T0PiZ-mRbE+;AU6+Zj>mEOjWMv7%Rj3i=f&Qh01q?4GA3R0i zC`5tcSP1|a6JwSr#wgm8uDp|s_`I?$z#ss?g2j;}zC!teNPzC!ECR+an$aob&jt`^ z3QH;hs3w_FpF$V}jcrz0D0(Hrh{EMaYJGp@_n;TpH@}owL)~L~4M2%KfE}KlVwgEWFU4Wy9r4Y}fH&qxPrWwCS#PQcK3yE?Ab%@JGvJBhNI7`a zOYTE5*BZ-7CW5|jT4d?fV2V8Cv7Bcf+H<^q2knia`rh94*z4?h6BiMGvL~>o4C2Yo z_t6zho~>%m7b2X$4g1D2ZEO%jKs|pMX#r#+g*QK+8rRsG5CchJKoEI{BQmVTceX)H zzIV32wB-82U-90;+dm!KfzN*889@Tau~|`Ki>G<>#2HCsY!O-47mf)9k=fdZmshFt zo8TnW^itdka?HTUhbZ)Ww2(Q!sP}aVIxmsbOhtnN4$QT%2|%n?-0FpJvxt9q@#kNz zA`Rx^o4pzJ=fN0k8nJSi{yGIs#{Yl!5(aM(bAN$7pSb&%ENk6g4|)*I+kZ=l;q7av zJF|Xs&Ao|t4JF0cr(rT$eAb6o4fab1(V1nt*`$#6XYYacR0clHA<16MA)DONj z0`^04nm-`Jj!8ZLBfe=}!O?$tqAcBc6Y#s&E;w=I5-r zX#F6|A^X|4wi}~pe)GsH327&yw!8`02>@DluF{aSwcvai?kSV-_Mflc zLv2$wlXA)7jU@td~llP1-oy_gn5fMi_1II2Ey2H2fh5?j*gG( zr)U*1BFtTXEmG8PE8A05SZl(WuM(R;cmwxfLApJu=l zMX}wmL+DJz79o=%J7fa3436)YB9Q`I*lPYtXY(dp{A%(A1>w+ha!pM2;Rlz_sD;f} zQ18%yctn4b=Qn{aW(?*4b;_`X^f&r*Hcy{*j;MlOd%%=}5Rn&{u)^GbQS?5q%#>iK z485~Kv3Rul;1%}C%yyHlB4#I^X1SgC`7L-=i{tz&CohTP!jZ=&j=`pAg<6EqMb;-M zPiI4xv^>h&sn!XOL2jO_21p<;J(e4C&s6GLCFp;CpGjXde0xwaNLOE5KhTXJ6pciv zTjhad=?Vew^6!Y4H`-#*8^o`!npP*0*>ED6IxzO6lBMiU41d=-Ri~Ay&a2`Oe&Te|)Og`Zm^!`(o z04x)1R`>$(G7PegWYvJ{L^(mL>j3Cmsi2#z=k^B~!__-9@Q(x4@Ou6nWQxSBXkSZOcNF@ZWf;L?#nK$wWMog(8(GWb*p&zg<~^!4NTI zHFw~EGo+S9T-4eOw`DGYWW9@+`rM27cb^!kfFYIOQ+xKwG*7=J&6u&Oa0+V zMO0JwqN8E<;V0WQhzo2{BJHpPDmQF-o5 z>SfB^DGkCiqt#r&&TDp1sUd$mQXj{M_4Wh!OOt1Yez~`F3v5`?-MUie#m-h$99HqQ z-ub*Dx~)B}Nq*Fx*4op$bx-Tv^-9{$nx|Gabt=}oRmC3XhO3ccjY3dpxK8>f}K$7*nM*2QZ^OV;>mxwi4RKL#0RyT zcr$L|TUJ!&8h{sLY8b?l7m=g_`H@}6X(<#hs=_C>nc8)H@CaPTQrMBjT#MkAm`b^i z{Sn4PIh6PJ(FM3HAj#vDT|o-f4)udUM+}hW%de-ypf`Zw{0qkADDsltWye z*Oge;)U_>GO8kAD$NP=z+U_gcAVXtm;RT(vJ`Z|_U$W^$^Zc<&nnb1KwE&Ir442V2 zk|{0ax06?E(*A3tabTDEt(hNMal?XFI^%pTa${@mA1TDXj2VCaxYIkT&ewQ&_u_ml zag1)xN&84#tTM+x9$NsTFcm#E=p7;g)8TO+>cpfFRoFwI5ZJHK3GoBh0`%jYaNj6z z2ERc$KL?8M`JnoECLZwSLM!RXfmwDS?=v?F8Kg4s=inilM4*ldC^T7BfPF}5!@Fh@ z10S5@Yv{y-X_$X7N*D=DcX-=y(<*r@JFi^AJlWg#+V;U~dvv5rQCWL!cid}xkbAZ} zczCbv!PdOCMQm8xYg^FyLwRj09u-8lwbwSukJ@Wndu?~nYg<*X+}Ufp(F5t@^5qur z_EGzC?>w$2>&rbX@#U%|ChzPrY8b>Jmf?M{l4r8U=O};i>Brczscz)N+-r7F4rBld zf)rSva#?b%ma>#K=*vC35U1%g3$R8%u-`Tn=x!yYIIZcSs`n1}_75 zONf-mEKTx5!GFh!GjxAnq3R=oe~DdD{KYUibOc)&AAh|N8P%>u)bwe|z!nRd^bNH|OEI%kWJQ-kyi= zXm}Qc%k%KvGJF?=f1Zc$Uxoh+!rpoK{xbY62>XBM;d>hXM-U#Ihwqo+BnS`B!w;{* zSr87+!w;9?*C0GPZ-485&wTXTL1*y2{p~RG%hlEJ%TH~|g*Uvy67f=_2G7%+-10~#aOid0IY4Bkte#%YT%FlA9-kIv()M~ zq85CK_zIdimH3Q<-z&ry6n8dtMiXoql!bAINY)uE8f*vk*r(FL6eT3W>L+G{BFTTq z3etyGSmY#%B4k1+EQX>|U1`K=p?Sj<*v7;rR-?;!>X>1ar%Uq%tz5&dBW*D~4=;7G zngv{TG=p*zrfzxz;x{}y$fGlhF~RZ~V%rENyx;&q0P6KPeL|##3=<<}qE^U9*fd+E z%$B0QzmNWqg$)>loCQ`{wny6{@nC;Ch}=4Yp9^FMjIzabS3E5t4uT|!>V29uR(Q3h zJTj>bN*0qg|DzmP_wn$g<#Ul)pk#931%UIb?EK3+~a%r*%AUtNh zDRe1z4>5GBN@F0EO_wAFmP!Xvzv&^*r=|&|L_9i%LgT=q8-f;$)2W5nM`stw<(42a zn%oOF7I!OEq;`~Jf*z*XmCEOzUMaH97VnorjCm6sf zRr;0_os!GIqD&Cs|2dEz)f@TtNITAWJJj}7-4IKv%ao-s)ODUVI6Qyi!^NtMwUX4V zRgDf_>{n;2cJ#K$W5;vc8MC3z$-Uf}dm1<6By6MDfw2v^!<*YFHGS^%?7XrU3v3yu zmhsBAeAhO&26*TV`khbx-bsJ2*JJUW?e0b=?;ntuJMQm6b`cTmM zLqQ)ZdfP>}HS{6Lj~ajaP(vSf5c*J6uiO>-u!)$?;{rSsaP(0F9_~D@CkuEOlmH&o zDr7a_;qHKke_)fIQ!BWQvgOp5*0RzkWIJ6Jv<5%8%hBM`fFD5C5fgTH%bQ>F-Uj3$ z8FfQdDo*95)hbO2mWYGI4#z})kn$TG*r;{YUA2BDx7I!G3z{4{Fm|;aZP%Cqfa}S;RKAwCft|vk;flp0X z4)J?U=+`!RRC!9UAGi=lvRxEdaDB^$oFXXerK&ZquCugv!L^ba$#1qnMJp?3p2@&+J#xWFn7>}SyivB>B79j$?S1CE(`ehs2!Jg9@mp~ zTppD;F4e*owd3;cj>`)hrj%my?*vb5fcQp^%X7M*J~4k@+i>&h@7VjX6L6&kQoNY1 zI#v5J-R0xFg@ikn)9L#|_A0Kd~1J+fwp*d+3^alu5eD*MxFO+F;A0tY*+= z9H8LaoC4>#2NXd1pQ1-bz%au%b2^zbOfWl8F~`X`8tj-ro*UcUi!*8okLn5UFM7fg zltV{T3KxGprfBTiH^7q{>;ZEaydK&9oVXDa#yqXM=zT!}1TU@x4ABwK`Sp%kbP+5R z7DjD28rFl|hQVeT*>ZxEPUm*udc$Wq-5GQ`C2$Z$tX+~Z;2$CrkTMV5fCG1d0jFKz z!@e6pFn9z595I*eu+K+yHst~WH{g~KI`*Jji}QcN1I#aD52QAdUx5;jqQj=>|C8-w zbM!m!Xmm+^;tda3|L-+JgH}Q=S?+m$pMkQOal1@x_c$1rrB&*B4w=B!1jGai25gVP ztBRUpTDvCwN}ADXV7P6^wQrZmv}c~6@$bCtC(#I;%sz1`W-h!|Ny@cIdXpac^nH-m z#Pffp^I3(bJJ|KeC~!@1XtzIKvEtxY4Jgx)@72~MLaT7|^H4*kI$$k89&L+nwy;`~tWL%b_^DqAp~1rk zaeWUELY0XzY3h5B1ui4e>b$63a8<(u8%BR`QmAb(m6}qnehIF>0mwa|IYDRxe-9yb zh`*h#HM$Nm<^aV_{H)TNjdSENAUl5Mb5{CCFHyhOV{4FSITMS;V{BkbaJ=Me-66JP zl6a?J4^!)PFE*(cJw@j#oT2eexfijp|R+GcF82UO9+fpZ<1-UwMu?hhZv9+SuS4-tf#-`NBQO)TrOaY17&Cee1xjq2%iR>4 z9)Vjg)Q2CqNW5jy5WH|q(h*V?S2R(?4A~BWTWRc>Y0s#Iyon2ijO{7vqi83=j$?|u zZu|phqR5GcK7P|lwMm*>qQthN*d_b>=--KtAdD&ricGX+-UoyLW=}Ih?uLIE(bSf3 zN(yTmn2;|uz)~=cBI}BcB_g(q=pNbQ(aQ;&yQl&TC>Rj=l#XEL%3f0X;aO7Gjnh%# zPJa%0KQi(&1UCn4J{nQJ!!k+k%<-a$DMT-ak#$zSDiGt~N3yW5NqQ$?oKtKn?DKj$ z8jT&>eN3eHlJjbksgEt6rnY}q+e(@lVEBrb!|lO^2L~fYUoHD4N=b(tesgmxh>jh)rWRdLJ36T^s69e-$5Czs=;-0m9YeG{#{-(R5_-i65hc6t zA|dz)4oqkavcHuZZxK#_U1st=MRn7L=-?;;hhUi|J-GeChd?2{nSqyk=+yIq1qXuVgVW?Fy6{HN5jY|%dTy>5A6glov zkb-`%2R?P>{lZIjO1u0_h`dqK9~cdY{qw?heGc7V&UQAS{CjpVd6)3NvMCx9{|2IN z@PQ~d0Wd213`zevY#c8jw@TGrNo*w(9KhK7QdYL$dPMo@@UFNi`CV)6`6Myo0EXq9x$`3)}&%4JD?*KpEnghIu4Qo5V3p#%& z2YAI}ljyc~fG7D;JHTrP_zpV2tLl}zI>0x5IDda!9_|9}K57s5oyYZLJ=`ZH9`2Lc z!+qZ#ZaB@qCZ>;nWZ!mL4#kVA_=ydu_HCa$a^LntxUnNQGWe;bADdW)coe&~<>D)F zY_oSHW`07zvF$f zJ{Et&zw=Js*`EKFdHpQEa3}!(pNfWS4oKX4Ant@%K38Yz7oYI~+yMO9;fj`4I({04#cKe=!2cpN^`+mcr zxGcji$V>up^D4gmxl%1FeJmh${=fG8Y#4t)by!CoAnZ*#N!KzwiMxeA*_-nIrRuXM zw|?^7A+pGAIxf<0cUaT-qoP?njJ}FTj%51Gx)c&RgaTRwW^e=|+-h>sZSsy&+(`#e zoRs{Bz{5u2!3zwULGf^<=|K z&q~5e&+72fM#4)XYX=nP{k!dZa6R0`Hzsj^=nE5R=@T!iLML{ZI;iw)_k&78$hli% zZ2KG)I}w7umD>^f`{+OHfF*yL!iE9GKU|*GhWca?<>a9r&tHcvd@@AKu;hWR-#(rL%{LqfwwET$|Rk0JhOzqfx zzWa_{QA^Ng(vE+qHHFF-EDZv+7=A5+j6bB0SGgrXZXvZd-(nI@*{jArFS!2Rwg^;) z$<&CiR3e`HC&@K|BW(xqWe?nu|9&L~B>(P!W z@|F@ajfAdVg+9ifwqmN#U#RuJQA_1Y1`;2)ZnwdW)JlI2qzeHE?;p0S0A;n_|D^cBEDjfY(R*mJ;MFOTD`Las$md^Scdn(N*;3> zpV=`A$o?4HF4fJLm`lwL$}un79n>taFXi&%dMkfr3vJLRd?`H;v5)CB_A$B;oPScT zUnx%F=cE*AT)as$t08$JbZy3hZWv^W1JnOqo@;ZMt1->x>f_Fd)VVZ`7;2dIj3w{| zNK!5_sV=kMTo4}{Ku)E@z#B*&!Qo*n)og}_bQj-C1|gTzzq@weY-_;rai-Q(t+TKZJGq|ey^gc^wJRdEH~9=@tfV0 zic}XFQ*LR7v+fqQMSa_a8|bBJzwC=~fUjT`yf>h38fC$Nc9Yj){#JEOsBHxPpudasCV_L_Py0(~okOeufh zcA0+FdbU@!V00pVZqMjMwQY{Oy<@O#fTvT_zKO}u*)|0>4m0tSXVQu`O+3C>&I_6; zn;Ac#Xg%n880U(XORhQfIk5uLU1>wh)eNjsvMbpt73t3Ob)STnTPGE%PIj~jl68;u z<7oIUoz05n_oK)@Gbx@Lw^B2N8X|wY-Gm4I?ZC|+FSrpzrn$xo)X!^{H%H*B1Y-{3 zwI6qqJUO2Vb?eV5F4HxQSGHv^Z3rp5&Mpe)wX`?Z>aFdLphQM_hphP&QfN))F!W!P zEpQQ-K6OlT3Z<|;)>Tsr99fk<*7A~A#t2S{)rd??(5XXXYq*#q_8zsIz^{Km6l*-T z4JK{Bd}Fr}Tg@alo9*xAUqq-OuKHB_C_;^Md)ECV#up!>N72#R;GZA8I?oZxYC^73 zXnTHT^5Si?>MM$?>lanSsylGA{ke&YP5LjN71Q+0XeRBjTn222M+@T5ZDv$Dz^y8; zIM`=PX&*auA8hebf=h@k{JDR46b(19PNzO`D=kQWBv=2aJJPKFJd8xLo5)TrZu(`7 zQAs`URw%Cg#zh@f8}YYFlw1=3chOUchODZKqQ#>lt3(cC#K|v{d0>5Qflg~RKL*x_ zp-)EGGDdK>dc-Tkc~Z6g?Q@g8+WgWn=(XzOe}`}3lJX_}lbo8SeM5i1)t_p^axlJ{ zV;4_+;+_+0=FdgPs{5Y}1UeGGwcG7NSt*eJ?|0bct1St6!IAz+)?5{pR>YUPSW~xv z8WLxtqM=|GS}P>7Oc-YnW@9`n*8sm1%yqd2?X9CWHp^hSxX-4m9!Fx6PNaXfruHW7 zy6)&Q7&G3&KP!Erx}|>?_jfPmUUhPJ!RE{1^!BVkz+GBXyS4*sJMjMPz^82S?VfF? zXvU2jc&h5!yp^Z+t~K@429MX?OK-Nd-B)V&RW~M{qVWd>p*LvvZOFa@s_w_MD;w{Q zSasXA-fACSZM!{$4==gupSb%@GuU0T?wE4iykW<+`90Wlykmd8Imdr{yq28YscH+Z z+=8oOE<8cwEzTmbNzYxiUaK2(aewz=(LDlNPT}bG%(|F{+Aml8<+c!?O{kTpYvmOV zd&lfOg|>|weX7peyyd6%t~LME29MVUtiERI5N>+be-LX>FGk6rb}-IMoYl;>)Wqx+ZVjHhYm<+gKJb9HPvy-(ZvyT9T1eiidVnQRJ0C0B z`ngx%c1P;7?#Nvg_!Tc=t|#jStE*P{_i!~;$~%U49)$qj^LexAh+9kGJwPlUp9DU{ z`LFccS<8RoeZfB-pFlp)QLM@-uolbvx?{LoV)+i=iW+VTo@o=JXW2JUOQ;s5a#6|x z%I@uWb8vjn9}IfEZHrw6WX{?Wm?zrXRc#gF+|`0>621*(;lzSNL*&~A_6byZYh5*d z`KCY(MVn^(`&9#~!?6l;*z-S<2_@IWh&u2l*u;M>YF%0Ioxoxh0K94N=by`=?*@cF zhyO$q@n3O@EtF`B)B! zm|87pt#sPy&!N(t?6lp<8wGM)YWb)o*mZYe47_Z1x||r+=cvbs$S^|G-s|EUyyRaW z^%Q?fZe}vdnY&=H49#yB-+@uGxS3%{AMfuNqJb4Js$H_v7+*jJS_XK_&ip zO?*sEPdpRFE;@++33nShj8VyQhk{)~h$8t!!z7anQ!-XbGPhE4xfPPisrissOCwhV zS}q!G^>lG@nmD$*=+osZ&7oCp#$ctL%(^;*tgBvzPnx8xB`A3LhL-Kw+_V*Ylbe6c zxjjQs4=75;T+&M-^>&7+bPCs!&Oo2I*qU*Au;-&bG71ge?+;*HZ1#9nTNt}yVZ`a1 zY8#`rF;=xPe)W9^>bRcHh*h+~OA7#MqQ<3d-xD8Fu%9}PNqGwY3)lATiEVaR&*BjB zj%{N6(JN8%h*=1#1(3BCP=DS|+ZTWAuiuGf*sgrNwl%8mCbg|m+ZqpJYiugORht>R zWM71sAt(wHrIb&Ds9?r zWV`Yu>3}GEQMThR^JgEa_w}4y6BE5e$31xN+tl*K8y{RcqZT$_+18XAP_U_uULw|v znFN>Qnn1N-s0rR`z9R+=7Eqj;&gM<_kqixQDKUZB>V(90(onII;=y*rzhg&BiuO(! z(VZl@vI9m;+60SDvz4u?LZ5$)w6-Fn^yb#gCWs$k2McD4wmIo2*l;#@G|Z za#yLDtt&sBLs4Ak`p(}f{uDJHcdhF?pu5t*hzApo+)Cyf5r~4`AH9DFq{@2Vml{hy z$_i1W?UN;Qlf~sV?2fd4x<<4t2<>U!k-W*wcLDpf-^O`D-k4LvAXfL1SU$Cg`H3tX z6Z=F;S#;iwPg{8~oxHA+wX3VV89`v=dee|?Eo}U*qup_Bhq!(&B(7ml&oS}xzHA8KbFOJ8Hx=cR zqj=W32YNN0)xeKNURK+FAB%*nYE-Nv6Ne8c6CWJ#{!rV(=9z!x(b?Sh_9Mo7iaE0& zK8BT1L23>Ty1hR9pW~8iN^XjzN0?fw2@!q1+3qwIGwKp5u~UB;(b?=sLrq#8-DZb* zyjz}QQeRDN?1&a;MxS-daut8Mi=;T%C6+ICIugZf<$iyI?|-?{D@nMt%^?3iNHoWPkTDV_6MEx$V0>UxqkWW5YdGYIkLk^v zoRc>W{CWPVH@?awWh{p%vcS~LP{f|DK#UhSj_vx@sX?!7*RlEXETc?x{>vg-E)#o^ z^O8>)c&BvOCbhmoySeW>-i!Tx@r}LYH}0UP)IYx@zTJO_)J%p;4WIg~P-ElsYvQtS9$ENIEevQpPl53Z} zo&LC79Eg8<$cKBf<`UU#pxEr78-nI^HaC~ZB@=tGfD0Vam#EKr#Ar->pSURSh>OUr z12+t;34v${v976WTMJ_Of)UUidUJ7!S_Hxc9t;P0WMW%J8!i)J$pzcmLkuj2sO14& z(clEd9U$O_nkE_(WDv)+m&8DUWe_)>0(pY+fEs^z`!w+F1?S7y#0Ek36vfL%9-sEm znU5yeg03eJV3`FjG1w%Db2XZ}FfDU}-mwQrsx$=q7JN-8Wb|t=-b0_})QcyAQ9WU` zu+h{GTsg~Z{K?7V6aS(V2Hq(_aCOSAs=?SQL}~XRI{DL2?>~Hc^8%O@c*J9DFv$#0 zmgs-iPoFOMI3hzBonD+F-xd?g8bgB)x|!3-90U)K?ZAg7d?v*T?I6#FIi_ALeZ+uf zfk#+3IZJS4+OtTCVy=T65p3-J^iyVi!!?`NOoTvGbtlWlDccZ0TX3rmz2jybItPae zW1sjTc^L%=La!os8)JrIO7Eq#U{a}pD#d@E|Cbqd z%!q`)B0CO&-UhdM$(LPX66}%pwy(EnR9ivomQeJrviprqY<*=eD2;I^zNI_Zi|_@K zUoATptA8qgs2gm%I_9K&_a6n;Wco~0!38F}6=1vq%F+!p1kyF$UBUd7Zwc9wauqF; zb&gDe&S>|FY0Ms(4!ga9_Q(_;l{6!fU0*t60@K8t3Gu6mqqX*k6&d3T$e7EMxwhG5v|OaWS6U@Wkt&U6Mw&!ujqHA7kSPvK|92V9t-|SoFoJ&w9v6E; z8tJ>KTFT1e(FKPSod~_L!0u%sTV`TsXjsvm)5zS{-Nq=gM65cDWYBCIV@Of3%5gP0 zngn(ty%LJuhRH}{x-B@e^22IbtE=G!(ody>DS3oW~1WeJ+MfakUpVQn7PpIXU zlzaAGxNZQiU%kn)<%W#A9@l>f-NcEiYfK36NYPuI16t<1e)Vy+zTN75YvOR3*!b=+ zK1;vBoE5B3EsumsmRg!Md>y}2nNLEvsWp2?e3wqVi(qV0Z%*8gwkeo)_`H93)bAPH z!NGLU9gx96_ZdDObO#5$$>H-}@92n(Gab9ONqCeJHokZavw-H=CJ}$@K!u1?9oRI1 znYJi|CUMY z+}+usaAGGJddY#CN^pgqkSpJbW z;9AvY;@Uz0k9!`gNlU+1CM}w1U3QZJRZ!rj{JlSVb>6&V?9IfC+~|w?@RdAA6~|f1 zXv~R;CDoB?UO|?s~xnilxath?l&+UIv5MQL&Di`?mhLKl+ z1no(4eIkl#FfLB-q+GDT(Z3Tb!2YF3UFOMMvTXCn{5(NG5=mfhP*y{PuyThD>p!f?y=_D#*c1OiQw^$TU9ERwO#ep?W#m(vaRdq z-P*Obzm+R#;I@BBMt%aiZBmsk zV{P<3b)!#7N3v~q+AjF?cENX)%*(f3*Wyn2^mfDo-@#+au9$YUO;tP7wr5ktmn3%F zuu2hnf7aD5SQc@1wXL4E5_#RWPf3(fZrc-+&0)9YsIq@dowxltVoCdIYj`(K2DJ&g zYtV<orCO9;u?ig$hq-M!;$z;nDTxe|N`w>|ChL-tL}pf^r`UbE0p7&; z%&kvUHPs#E0_dB8Az|w_(d~$tP`AxIFcvd?HJKoQpdR^5^&&e_MiMhfyu{=wX{z zVOKBK4SgF9?ycl=-jkY9OCctH49%3=amp8?r@W{5N@0R3`8Zj;U2UX1PBw~epK05Q zU*#*&6|q!f@mx0JH@H%5;9M#Y*K4$Njiz$U#PXK-VGVIFTSkdADsdy_al32(op78!l|8z2sj1g*W3i5(Moo0vVe*%# zsd9N$elzt$)Kqu9H2F@pg5Mt;txD8J>drdu_>0R#~nNp~A$L_y> z>3t(B7JSlGYv9!FNQNmVk=KrxqK}ZKk;RK8!&l zt$59}Qf;T)>QkRT7vJUja$mP&t5tKVNVleJ%>5BwUcad#)#*|=_eXM6NKD>uTajv! zR>UP!;==yY+U%t|s7f;P&Z3gJvWNwLBr4HdW`#87YPEFIkAyCsX)#j7!WAoJ)~qANFU@~LWV^LC%wyVm%BQyV;93oyO?)|OzY zCAivl`qa!p2=s5z65No*2UOjUu~#^-I~ zH*e~3{eBNt9`9Ih;PKxcuWcvyuG*$6x9O@F5KqvYiveGo^zK#bwYqs1_jeyQ-p*Qg z3Lk4juQv3m8G0&zg!9Q+d+8l6p=h42-B&p59kT!x+BR+ms`_yAwxHU()*w_HJYK7? z`kJW&zv)^3LF_}l7$rmD#dywY;#!91*qVSwtcw^?t~@I#&PJqH)&(?3?VFmFGMy_& z2H4YCadCo_jy9Q+yaN*F&WbXB<~A$O_b<;G-_y>^bHzjb z`a-<}ro>~E>=jJp`xkG$O}+CnUKuvF3EjQ@0QqAS^A)fk51_@hV3A!F^W0FyCM3P0 zHB<|FSuVQVNxFA&7gx#eV7ojfiQlXpvx?DF%l;i?{~^tqstX{;x_L~iVB?m~ik4Nq z7VfeSJfQ7=Q+YGcn?Sq27Ls?d9$*R7&c}+je(r_2-I4mNJ91YAe#PsX>&be->Z%p~ zJzQv&@{Zx1M+h&Y+@I+t}OUYU{Tvb)SCu>{<$3bZb0~R_)jzu|CN6YYw)+d$$%|?mrwP=Xsa7WlMTFto~xXn(#Gp1GxS}UD)`t!EZal4Z@4&=Dh@=;4L z?C!)Ec-ic9IWeryQI8RkVT4G-+{HI|$-h48DU`lewGM6y=8Kqi(Lc^FaS%L)(;i0Y~i}*!bjs*?T1pc?x zM&o6iL6KZ^ULRE+~mw?<|QUChbQ&i_6$Wmpg&|~tdd^TOuX4K zrt|ccbO!pw#nz0|gFPShkx^*!et!Ue^J23HtlGxd6&pjX;Zj=}wUx1|m60eHRj|cN z8$hl5R8-$dQ@ANpnn|g@fQA}-0rlsp5>1IpOiIP2+S;hJpVZbyZEZY^wXvxnS8ZtQ zlA%#MGiqnX-JBUpAtY>)O>GSq=~R)AnIARPZo~9R4Z+^k?qQt zq!Xg-#i;fsdpT8Q6TL*oJ$UXz7NGokn&>5B%@V~k5w%dO`HmPgSTsA$U+HY#WFN`U zz{_YRLq)NrG*s-Qc(CcJqM6cvp`9|KQ$;`%r9RU}SZtiFY*!WfZKS;wS#EUzs5YDG z0MLE8WMcHux2JIDSq`TvEJ&1KtbXa?Ti{RL+c&ND_Xk6y=^kqy>ZZ6t+1ZLkXCoFA zM0FL6fgh&LV<)T^h2R?*zV6BvU22)sA}n3uKChB& zoI2FoPme9XQu_LmnSPWN)o1}H3*KIscsaK1uet1wOAV$fJj-&#|M3nY$>G@=F>Unf#X&{4|j&Zm+MI2!lApGQ1C#ejCYE zEqAH;t6lT=ro7Uh`m$<0_w4#ek<_Tbc~K+1QM7E=Q=1!GlV2%+D^b_@T}N$caeIS$ zj)|9>+YEr0xjV1iAe4`c;+g3_)2rmHHeFvPP6K~#yYx?9LDscR!dL2oSbh}=IXLL{ z1}jKN@(cM=;Z1B#>OHUE9o8VJ?X1~B`5UB8VccOA!0fyxQwrvOY@Mmr$ww`zSt*Kp zNpVB0BWlgw5#ObM6YnAzo79^V_oEHP)N|Pc-m3|9uo)YT#dY0R;$H_fn=fsFK~r&y5-;$x81ic1>uQ+FMg zTvKvWw6rx9kfYBx+nuIjyr+IhTsKgI!|zLWc6bpr7Fhha+X*9m$skV5y)Fxl73*Ya5AN;dvyA*~c}s_2d9!E(T+W@}JBt>KU-KBl)WbI!0(gxt=BeZ-f8q>SYd zMHZNv8H(6{(-nyE0>`mkzdAMOmF+q)IXEEOe0b=87?(^>YK?U5K=`8PC+Q}s5L_X%s!KK)Y0k1S$cpCgG3t= z%YiW`sF`!JY9hJR(43f#hi<4pk9_O!Ie(s{1WY`C9v|Q|@FojHE#F2HmiQm}Op4Id zc98?C(eq&=+C!(NKevO~91#nTP1(Er8WRO1moa-g{c*WY5cQA`mr%_mve`hf*+Dl1 z&FO4zE|E(n_F@5dBcd-+pY@2*nD{<%QQ#35ky{7A`__a&2!dGG)U~;B#~A_Lp*I(o zs71hk2k*gfkVhuAWwha*4whW7tv$q0ScqC4&=n0%P}~6mZm4OZF+m1#OnXTT6j%mv z<0+75SP!Uyw@(A#UU0sQO>7WkPf@&r{7}XPhR-PJ7?ZB0@%*LObJU;O+Dj=*orQoPe z`CTv=VWkl0US^HJEs)o28eqD0)@?(YZG#2oN!k zy(?MS^r8ugET@!;N!z6j*ztdJAi^yC(O`odcYDvfy@OA^-V64B|Ct$|@WEt9C4k0% z;N30xvP(>YJ@Vf6_2z=Q5o=v7u~JjFma&PgugtBcv7E%WbVm*0Wk>R>Wi9~qPvsAF z_i8wJ@)gg>KMMAI*+ww}wOhCNJvA=*c64&qy{b9q$@fZa1@#?afn84KWPufW5BGY> z=~>5Clkfhcz*I~73vxD}u4&Jr)uQ`o|j)I zU(N2C9aL(Is+QER{({+}KRYjf_I%g2W-mcAzW8}x{Dm%CKtE$Ncgb{k6d%8Qn5jHy!T*2c z*53DBLiQKf^NG7J=fT_mgN*-r&=Xwz>p?H(9s~)QhZ@ z4sxw6yw~LMlHa0 zYzHkBa}+)gJ}i&8a5zAJfo0m0udELiqeVia8h{Q;@KO?NoACcl`tkysHXK%LbaDE= z`{DBEeUplxF8>u!uPu6XJPF zi?g#!eyD0)Q;g0}5rzw7ZP{XVWDr7F$cH^(D^T`zD!T zb6;#+U3h8|FwL>q^@+Ri_OBWsNAN3KMxGDn5fB#GIuXaT!e_C;OGjc;F~vd1}=iR>=Nx{5a@Ga@uP(?x569dnbK1$)t16(SLIN+;Oz%_X7>c#VJDA?_5^1RR~k zN`*Kobl!>XjUyNQ{pkO~3+La^uK{Sz84~y9_pYpHAN}xu>CFp%=!_5eTrnokPbg=o z9dt9NlX-mL0%4jg(XXFAT}ZXcLJ+pgj%>ayM1%dfhb}1$!=GcH{S3PU=rw4^PwOt3 za6H}(QG5&B9|PaZp=+cXxbY}pqaxVY%TBxGh-4+msGP-qCz|nyzbu}jwmFI$Nq+y6 z^IK{4JZ>a^t#|e3gP5E=wa*r^+zPK6FVA7)mz$1ObYREduAjXh!Ko!c{8 zU|2?xd&s+6c4E+nxr07jYtV=KK_BkKpa;2w9;`L!fqu|~ zofz~{?x2s>8uXEV&__El=;Pc$AFnm&WBs6ycVf^dxr07gYtSe9L7(izpr7Rq`q^58 zex@Jvvz-|9^V~r{Uu)3M^@D!C6NB#e@~xA9-g@RqFULOV?Z&_h%(6A@vOL3VH!QP$ zzG>E9&o*N{>ju6X)>%K_JnOG#pRt~G1K$k`t)FkA_1Ck}SkJnF?}nAu&o|Th>)C0n zXWhWpu+)V251fC?RmMG6-cwGT>f<||IQ9LiPuD+jZf?v6xno{MspDT9ZBg?~$Y@iaXvr5r1;fQUB=VdGF}i;Na-s+4DW|a6|TQ-p@Wfq;NOfT#$pN5RKKtq7zvIvpT30=gj}Xc{^2`mKp$ zQsqbQc|~fjhMUhvnupwdHjT!?^jIONzT+frlg|M$G=;IR9 zf3x+*nE42v^}F2GV!r{s|64g9PvAi}2Q3>9^Kv~T&Ci=ToADYwhDNA8uk)RiZmgZ# z0whs6_&f;Pxohrm5o6FGSJH`5mQu~&jHel*z|`Tctw(l#QKa}6@D(|~C|bN~=&lX; z3b@(AhacYE^2H)10&^h7mw^@d_>W=fBEh5Tu5;)raNtolS9h#jVPutjcsl;0htPMk z88M{iw?Z+5=V6Ht>LW4a=V_2A+VgIq7~-?+44ni(h|&%v*?fz{cM;6W1X{Ah4= z;4M9NUs4oTSAJBqVQ|u{BTo-Wi~k#Nkq~YyY7~eTbdeBd#Sv;QgjdMGs&@~~E!}oU zw?{dmkOajfrx^*=OL;995>z;j3ELq%i41iu*4@t8eWx$Csi%?n3dB?JNVmXVrth^# z%$EycwHH(Lq}y8mF{b*%EuFxvmyQm%baknt*6)iXBX7g28M!qJTg!r3VWa{0X0O4J zZ71|uO%<{dL}k`F9nC~8>d_NDUhoZjmN>H7p?ov#7i`5J1v3ly_j?)8E4(5Je#tf(9bi}w<>t-1$vyO^SPVCI=4#(F8nMVVE|i1hvVLvLBx9)^xKL&o_T z{28Cku`cAmv_ZG7!N7D*VtF7Z1vZl-xq8sc;5Au_z!ctMG%QBj1<};N&z0yk1JUj` zQ{1w~B<_?s{W>1Rb*s3v``+#u_~^O8O18OwN< z{xBM+CgA1vUQclw&7o(H_AOQLT%U%2#{uj)6G~;cDX@?N2c03j)mT|ng!Qz=B~U|tXhv~SR@^`B zYji~`b)^K%vepsIdMdw0sF?SJW&&nU->(ttY2pOm_Y-Yu2N0xyq$rLs&Ai7594Hy< zZ9^1Eqz@N6&2bO8e37|$fz8X$_awXt-v>b-ma%5nX-XYKG#m0E6lFZ#5&nyn2K#25 zs@bB**}jZgr#(h`-GhNp0=V8)z0Q?0;3{P8qQoaLvAduJIl56ENF5@NUQEz4@>ebZ z(HWXu*yLp`DSs1intxZW4-n_KYE9U9r@$)dY76Ja4^1&p@jrOpRsG)EL)WF!vbxGz z*t*$)UFeG{*qo*4wApB^(ADJ;xZllHDQTQ>_~~U+DP-(#*=KZZiRc1dfA+c%87SF@ zV_FzRXlW^OTir0_$CoW~^fFv}`GZX7sB=^{Vf#L-JC{vhk9V-LmV+sGzj+LS)$ATI ziY|T|gOSp*dt5VU^zQ{qiDGHiz?*dg|HFVWGf9BN_9tTvXQv}(^azPCw$c<TJK4yrMCK0_88XQY9UY`tvV7$!6qb5a|;8G zHedW?QJn)&jDL=ZWPqzcDfqLn&MoMR+AO-3Ir0&K#vLQb!dPPqn}s|L**&qab{v|4|mVL*vmvEb2M!9>F(b z6?#E?qg4|Ug$h=Iu!>O9OE2g7bdCFmI1L%(520I4k!Yr1O@q|Oa;T_2g4&^|_k!AS zy=~dfZgtg?_82LI_kq8AS)iy%jUmJz{G%p(op;{Md58-Dim%)3d%qEZ6#oPihcx`3S zT$RJObfn3QZT%uMm4VX1^f3)*(luo?CCK{m722HF#}VK~FY`TKZmB8`v!)^UiJk#o zzjHmkj8Qp%8B~1ZVx+(wu09?QrGY-J=(MUo)ZF18h)#A*>s|Ru4{AboLr**rKNwJR z6RdFenL!v}0b-;X1Og~tgMt(3S_(6429Bh66NzQm)H94eGK9n78OsT~tjF}fXF9kT zPsfd>i8z(_Z!Mh7j8h1r6ltxwr8xt4ZC@Y5->SkJa&8Mp3Z6mw0T-Lm@bxy3h>Fx% zFGSVz#>f&-ykECFG+Y-O$p0vPG1As=-J3=VRCyA(4lUEz33vH1h<}&*?m`r*dP1c& zP=ey+-iMAx9t|Dx3P-$)``bm5h+P=xCdx!Jqv4vMjtf$9BJG(zTii7uIrRGjG{&FU}>P9NXk z*jpgQr3#LV7Z#DRg$m6J#jFBQ2-9+?H_8j6Y_T_>pZj=tr9}#nD}S3MUO*-I(9hV1}#3&MfSzxr}I zpG`{V^kU%kyVGkK{{$Ez38l>{g{$PPX8%?R&sh<5J_%xyxNnbq(LQs#2;nm)(LwkQ zB|FHyHr3X&bjMC5VnQ>v3bB3-Q^-{Gfx;vDhm@Cq=e+Ly%s_hS;o^?A(I3{8CON-+ z%*Z#r@2JXZQc<;;(P(gfJtka=vAAVqNPi|uVfv&wen(tDmTO>oLMzVYGtO9ckciD_ zTp;NjlC`R~xM9J{y%!9qlZr9+PJke+lflTYs}~UL9<2po#3U?@{yP%#@#VMy9mzK>sYFxU!wzM3ouGf5^I%b z)f8Fx@{8tSj;BCelM!=zq}KO-$qHys%qnplEU@gwR;Gx*2|+jZbFVHj^KW~^jnCC@SARnh46jSsm#HA+4<2fU z_<)l0l}&|-u4_191*0Jwa*%}>cJDlQ6Mi78-lJTRU)QnJpB5RD5%>;viyJ`(x0(47 z`kr`lM`+xjO*0%m;)*pzy6IEh5F10`5jkHWiG}dfEC6d=KkQ#RdP{F<=wTr+G%+}6 zLRMjNunQRY14T~B8$5|nu)$0|ZFS7#9gv+W>7BS)a>Oyp&vbTsw7e$_S>(S2zG?{A z%pBkS4du_U#0t-vg%lJ#_m*fM8a?twzB@Rc;28-C3qlPPaR_@;_-t7(@+Xsp*$TzOH| zK}`YC{)qYJzfqRx5k6;s)4wLF>l02qhkFTqfdYo+ka`}WzB#Qr2Awyx9svrC3ytfD zy!F4y6IuiVNulVr*cf)$1k{lyGW~U^(dJ=ILb>xe>nE0k`gLI;OfD> zV20u5M>y1umhy`I(Qyy{JjaHR9pR|LlR(Rr9is@V@>$ zP!L1QnKUsRare|r7XwtHwT{T_2oQCqZq(7WYTe{mg#o;=!B?@?o=8uPkTBW3$)6!A z6|Cn=FyJICa#?0pf1ADB?q1U5|rDuXu;9azOf*aW!Q>|!>ZE!ZOCu9zW%{UzMbXYqmAp-Sx}qN$ zJKBjBaI&J(MVnyBgV*BorB6qlx*A-cP?7lAhx=$D>Iv1W@cJexcYwhHpbd#96XYVu zbu#(JvCM70&;I6xlpXi+aZiJ?L3sd%>L7JPW7S)1?;-W3$o9ER$LJTCQS-5WJIKt7 z4nUg~aWUvSL!MSxSb-Be3q3|HeX~P(%{=k-pp*Fy%BA zTO2t5eicT+)DkFQ<$@xC(eBm#B1mwl8h@W4aEIWUicgha4lw!<)EyjFx7ogtk5jz; zX=%nTvJLVWWkP{nY-tpnGhxyvKIZ#e`;Ex=(-i^6(z_xvI!kocxU`(Hf19no6{1nQ zo&D1hY%Ckuq>KAgX@Is)!olF}$t<_N4Y@!S{kp!M@^=sJ=Xe1uyQv60!6NP>rcitu zNX7QGZ$wgkI6$UGCMGm}B#BAI_Q+b-p9(y-IzD(rM~cgfhQKgAlAgA^2s4H&e~=bZ z&y&gIhn|fcf+qJbEU)0S37=7CKl|ot#ARd%egB`yiNC&W1u~p7q+H$?)NV>SY4WD% zwQ>20j#ht3uU872A?p~&u&xWE``rBboo-xdbVU}MP7v6q2Q%{&{zO4@2saMG__Drb zRB`L3cgFZ-U9|Az)@=rv->`#}U%4@Ky~VPxb8vNVpTrK@>~BlI^Sujbcb8FMT~un0 z(bEDFWXcsNKTnFCbe-5W|D($z8p>jef`B$fyEYObEq!k4j}`^V1LW}|Xpvx@w~!T^ zoZhFW)p#456Q^C>vM@< zapKFj#@yK8T~>x%7!-HeuB%`CW4wU&wS1*$)RZ!8)*He;7S{R#%KrB^3lFu`Z17M3 zR8t!2V@y1gnn5nvr}7%8rZcMYnqTgJaORt9F7E-O8OJxtHN6is+vcW#^_YgQoVLvp znAuKhMSq$@twH9}%g}q{1|vyc)^8F+P}}z2KL}Y<81Y5zv&3(EN$=TG4&`@TKam(vsj(?2@$dpDJr{4Uf?^~Zo>vY+oMDP=sU_DL(Ww=e z5Pb0fxq;4EG|&clkk-O4#-xdK?9neF^>k^>R)G2A%Txtpjgp`7e&nTrD&?|1SSu*i z*7FI!zAjv?dO$`W~$ZcNcF5eHhnrmJ7?*2^`-*yDXuFPJ)y{lkIMfq>jeF>3mhe z2Ms}bvu>Xp<8Mlkcy+)BUr~57v{`fDa`^5uHfhF$>Eqzh&oQiw|J91Ne})OH@?TsP zyzfiGg7G;P{%d0rqY_)iX`jyX^A!$@sjT1M)vPhl=iJ<5G#YHFGlwBG{Z<2(63#Gye z6P~BJ-ziIx-1vgBSoDVSeVq=Dx%v4eb+_VIKPOU~tuF?I*W_LDI6+GaO?eTn(1R?G1G*)M>v^e$LyO;rwW^5t~i0s5i%uFUpnH{x?1(?6xP z!EFs@62jH*$xv5_2U#w;X&?>8R$fLs{ctBC6NOr;$MLr0SfXsD`Jr)61%zFxq3wg9 zJt0|<<*)gzmJ-SFBF_rL&+5W9Ad37$_OjWx@?kGa8tXnve?$v4a|w}azqE`)_vg35 z1BqAQ+5%A{fY{J~`NrrxFJh!hs72Xg`PBOZHM!%xIZR`37CksYA1m_Ei)N9>%Mm#p z3otpn3fkpwz8T{knbFnrm7x1J{dPW^;VC%F3{)r6sx$bph+7EvTRndB{jB(O_PCH; z`ax(%yet#sa1g1zR=1U=B4Bc}ww(PUhg8o-6(M#G+{Rbl@DOfv@tYtMm#lisiDKbZ zOo!2>R3&kLOMw zw-P=L5C`)^Xw9hAF0C`IMhDF-|L=N$Q@~ae35q8JBU9~Jet;7?*R*#e`bCq-TGkS8 z0xD5}lZPNcU+Xkl5_;5py)yKq?&tLHPEvoT@sl*60H+pz@~?*7Ys4F(_9o|f!*`Zn z+vH%o4Vwn`@{DA8K+Mrrtz^}YS=ILfN`cP+M}y-SkpSky2}>#@L2xL!z+#zUx?vR! z^LLhK_i5GvyXOh0>RI%^Ey|yBeL3{b+pbpyt7d24Uz`R>lGVDwkonM%II3z7K7nsn&Gd~)zMBEu2n`4RFA}TAlBL!s##NNwxR1MB7r!2iSfEC zf|d_qrw^N!x7U-Ct&
r=&53*NV$F5d@6{yR|4&DOfrm*8}*jn=L>D^}Qb*?cbFu(;axZLvW-Hcmnj> z^dWS&f9sK+{~Uf8wDri(FNzpn06RPlvLGf-0PQNcI>HQ7^XJ0>bn9ECc)7%IbaG$? zF@6FVx?%9Bg6lOizaMGtR^cY{bEL!v{m}#Ho&1Ol{w<~OgZW4d{h9wL0rXCNL?lrF z^Jd3>1P3x^=SP8)0~eB^z=5~;@pEB7HsCEk_FnKdH$O4FoNVL5tM}T;U5^;9|C8sH zz+;z~|LHPvGb_-F84)oU<)LSZsEz1yh6COTJ6h z*2@tV(Y24-Z-<0uF&6rJUj@*+R8z^2wb@!X&Y$oW;|50iB4rCCJ;s4H6$kKee0YuG zY5zGd$h#;>)m-U(%eW^Esx%;m&+=gls!H%OJ4v5P(Se$}5e0l1`EWH|6q)bs^HC|1 zHxW#AHPOnYvO2T#9R2i)8P>@9^%3jRE0q4E#wV0K$gO`};r3~j^7h~cTzs1o6>V@W zLiafanzvPb!H}U4^QZ35Ve-fXw6X)zHHiszcDzVgEHZCf5N{O7MC=Fx$kh#w3C%La z;9nSRMgUR}YvLK#819nO)vsWFgyezB2fIbx^M&l4ky2jzELH8Nz|ABfc--)%ZsErygiwX z)GRYjI0sX2V9eT4ug`Z^F+~Pqo8wfuNU=U3s>nc#5W2#)otmTWi++^97hW4Fk1{>Y z&Kw60Aw2Fn#xK)c73Kj_!Hy`l7W|~`y$y`Lsgks~|8;Uw7DK#P53P=Y0Cv!XN*Qhr z0I9k48qABm+8)u_P>tz8DL7`9emFB2r7OEzxflbxZ-FY%Oi_YNv8>ZHJtOf~2jh^9 zvNvBQm}MLHij9-B3yTV=Ok@Z`rDCon_bANp8P_Tl;ll;-SbaUoCgIm^T(gvu$v$d* zYrB#zl9bV*0;r#c)UX=(tjFXwslRx%H5la8Y_I4NE9@;ioX0_QlDjsZ*H-4nrP9ZH zO@iMMEY#VSr}2ANWqOe*puRWV&7Ppvaooev!zMV=xo7El{xttqaGmuxf1F&`f0R6dBU9+T1E@drcwwzaD)i66qPJi=2sU@ZbMA6X`VI zNs6~c5m}NzcQppt)5F^NBSdvloSF zEJVK|AeY4R#LxFSjsGVC_>q*yOhEc#p~z%)Pko;OoPQxsJnEh30={D*N>2z$AE4|r ziW1%lrM07g=iJiIY-go@v6rafcJJVJI=PD2+Babq@u36!S~k{_5gT264kw6(UA~@> zcvs~bB+P{WnHFBVCEE!9vzdj=^^ZCo?Eg^*&srfz&(oldefPE8Ff$F=1KlXo>TWE8 zbwVh2f;3~7GcqAz#m(=(w>P|B*y~n-+gwhZ;p1ayyv+U`CkLSOHHRMH^EAx=4SN@L zwGxp7=m5j#33*tdV)m!sn7;aRc6 zi3aU4tqJxRjU9+3p*UM&)h#&G#RDmKmsAbn7(gN;5ba0VoH(|eVh8^fA0(#Rb*;02 z@^f}9!?v2oB3;1VFnJ84qmPXLfy3&rG`kGcy9CqmEyEtL`-(Jl3Ajnp#`)=c&Ax;} zAs8DX;uk|sKi$Radv3Gg;6^y{6E23YM}Vyf{`o7CvxJg2SfXWK$aQp^ylwNvHQY66LVyo)eXye^6o=H@oi~i2znP8#NPD5POt$M z=%u{LCLve}#r^F^A1P;M9=Adlww?+iJ7@{I9~V4QAZq{yf{=zRw-qHvA>x1P zFk{m?O;+y$%m54$oMQsGD(1vof0g#_^U1coY3tc{i_M>jcGHFuyPJNis>PW6St2`X z6NbLuLQ@@zZihs!M_KS9gcNGlNpKT{-!GQ# zKYjMmje?{?TV+8MVQ}bV(sv@_2wJqVr4<(vxUH$uRX4@nU@cT^NBk~@qGka6#r|{K zGfnF|9Qi}=0Zh?d7n&ap{0U1N|qW7JLtl=wuzxrKo3#%HIsZocyB^10e2ZzE5y&9rvi(k zoGWFbT+ZxRaV*Tg73JknUyg0K-Aa;WK5-`rAr-vVkWJh?II~p0oGy69JhG4+tA!91 zRkJ_XO_{xH6`rI}oyF%;+Px|*hR*XjdsOLf$ZJA6LHPIi1f8rW``vb$)_R&UXii4^%W_Qm!7o2PK&MLd+?TQ^YLUQIfar`1&@3RZtvg zLDa}E+0;H*Ljr?8`bcZbN@kan)`z9ru?uukltdi;xa+%CwAX+Mh<=@4#NE1?9~@&GjM$YR^!OHo`O_OKggKM z6q>i(EER%P3Aue&R3T9cwrCFMd|lbiZxuE;Gbt_)xW=n6-6`s2Lgp`B z+l{IGc~u}eYy_n-bLtH)``K9#Fsfpgk%ySX7xMz$4_OZwFUJoT5l#G=f=m56jYfNc z^{&G!W3jU?K94GjaXh&b@jCPXmG8f4C;zN`nqWC)xUkYa^1aRnc5AR&*aUz=y0U^5wq( zAU#ikLVr-$-|lun=gU1X!T#MZ*5D$<5c%)ZzYf5Cd1_WAZF6~{SX(Y4B6yvjOHgK( z5{@xkb-&u@Z~h~M#U)0uwd_rCnt~~y)J0_Q+_SBL;!%0sxB~05E`4eH??>4EBDRC~ zx?CFrui%MBN*24l=|=}#I4%W@cLt?r2;l^OsLJ%C!c(7%VAx19Csc9W#ZEs$I77U5 z?tLpnex&vBm0kF;{6>FV8m1}_Z*{buY%z&~RR{dhgsvsTU_$_cPZ7=AQ=A5Nt#9%} z;fseSUV{3ITABM~0-it(!g zG8w;nwXH!E%Z}`I{g(~fPi8;!-~gy#s9P2U2$nu*)?EBfu*75Gq~SU)$EwBed=l4} zS|?0&$2o7$$gAuf-X>xAmTz9d&QXwf%gTdUL*K%_etqD7H3zdJ-+BJ}yui?uOnUo;d z>G`j+{Bt?i82ayE?EIB>nLM%rIq3J{9KdRb?sNG~A(!mAPg>)7AhvQQn&bx(qsZz< zVKRpM`6B)*sobDSSmDK<_W&638GY3z`bV9aIBkYWAa;@fPm2On3UWLUuy)gNX z0>sEU9w!W{bj$reM5WR>vOa+eJ$ZE)KpcD?A6>_0F zx6QzoVhwEBL?j;Y4D{LTBul@B8}WNjGb7pj)buWLwE5%dKiyHI+O?ssMR$xT2zV9z z6UXyKIyE2uOy#!wIW8|(@ok!$tNf{2fn;la z-)Kho5}~jV#im7>|MG8+Foenp`N|4?E$JhO29EmUU4Fgxa4$Ra8VnyfRUSU6)65f| zi>4Nn{c)X+#T6aKY7#Emm(NRCIb%|O*P|}A{}~C3tjU=d{B1r8y)+OHxJKPjHh(;# z5j^knnEsKzG_oUu-6dVE7dKlCBmYLiQQiYl6+Cs|b)STT8W$N&NkQb7-AFP?BQoIV zelDd!D&)(*de(_n_XwW*6LuE#PblvapuL4YJ+G%WEW?EPqqvth%XG^Sl@)6Ua7ISy z#-Brf#mG1rlQ0yBA}ay`kA4S;*H8UIQ3V$h61o48W8gn>fLizJrT>v5>OXP}q=9_V zNe2Fx90RL@ucE9bZfH7WO|_5zz(Ltg(O@)|!-1LcPhvDP<~1nKw=fyoAHLJ>!(Ax`R3A0`$tlTxJNz~Cq~QN3HSE#I z9hi1wm}~XjwboX?mOffZg*D_5J&8}mSJ-#rUhaK%rw`mL=>y);_a2mhxST2HU{ zC_I@I5E@zxSq==zX(DID$Udr?d1c?Dj4Qy0(ly&*^}ci=Rm~|%?KQ4_Iel_z#%9zo zvQ%oLA((16SjN3`gm*5)3(~jixF4o9J3Q<6U4my^1(RXqM9MZ|7o_7>G6`9iK7Nqz zLbvhN8{>GTZFH^7b5_7kA$}3ts{GAwr13xw6bxsVD>|i;W?$Rg$*r%BUC0GY9GYGRw6cz@R+@;DdV$T zgj8qV6{*u-2N3dIx7@93Dyf)ae_#ANx9ctYZNZrwj^oxC^Uq%%FEf~DZMZCr-ZRcO zpz_YK)&YDZ{k)bx8*RTz+|n^@x(cCM_TwvdQc^Zn$MegVyJ{ypvN=M7Cy?&l)5bwnWsYq^HB` zH^hQD`{NgKNnfp##duUItPvKZy*m)mf#=ok6cJ-rswgFoCcN^D1!jl%ULC|C;sFP- za~eN)(N8D51)7GX4)*`l9@7;J4evaoy(tGXm+A$BRRW3VxE(aT8-~)E>N9%Fd( zX&Not3h#J#acg^!I!|>w^iod2DgS2a$F&}Z@^qa48rryJZ@TX<@{KiX*?p{5t%Ee0 z`(+KmUPXV1W?u?0?7+c$u2@Vquxn7JnZW-Yx0Elr3YaIg(*|&5DL0gD%MSS78o=eH zq`pizI^MgT@nhc}4H!PNMn7~MRftQaFUV}~%qD4(M`G^mWsI)1bn}Xr@tlx-br_hT zqjDsmYBdnqN!vE8Sb4v1n=-Be> zbfj)m|BXQwTP(ay!$FZmZ)Q(g|E%5{`FIfed%d3?*10ABK~3~CMuTZ*+^D+3KpZu? zQGG*=9l2&7OOHB^3!#xC|C2+oiTgpjF36itooLmn&T!4O z=Wzmo%XYzcQT2_v*yj!a&!bkj?Zx!Q%GKXTn|zD4ro!k?NE(Unhxe9d^W*(=vnKcM zBC4>Km(%8$X24RmzddN!;ev*5b?lt!*UK0Yw(9I7D0If)*GseICZyJb#mc8|KC0F2 z>-sKf=(P>&qf9U&{#ocI){l2{>=o?XJ9%Itp&oZ{+R*JtD@6D(7F)V09e9 zX&iX@g;%&%Ny|SDe;U^Ae`_o6d8s=h4PhyB_4Khel9t-fsCso5ikcppAN$>O?H<`> zbDuA{y7*00>(FWQ`oH}F|LqSt-GoaEfluI6EQ+Tbuf$hPh%8c1#V|IJKnQy#(TjpA zCe4Onke~z92w-wc*l!M0;~X0baQ4Pc$+Q0CE-F#}L46Ti(biZzk>7SU=273{@8P#` zHu}Ob<{>aV`!?<|_WRevwc#~FPn+6B2*VXVO#mwP)BB)-i{?dFTn1dQla$Ye=;Isy zU?8gDFtn{33x=i1pfDGEJ*onm9jaESG5OJ-6wiwtRv_7M1MKamgw09kTC*AVN&1BnBq1)II4zj9BXX#fsrmUsC=-~zfflz{}Pqce2Lbmr~eLV_2Atp zAT0X#?q&V_=ipBmP8$ov39PgA%I0L(b9XQg;$}pHt2wxc;@S~90H(5&=cj#7pk`r2 zv2xebTP57Wwr;qIM_^w;KTsU~ z$R;+38`C6X56M+7G8DrGiAYtO<;Z}f$#Qu{uU(9Sv=t4GuQTI5@mTdasWEm?s)75Z zE$DQ2pmwa{z2a!~4T^=t-mjcu*~`ZqrL(eSB^Q73uzWm9o(l2F z0HF0tFP8W< zx5ypdQ(3iEM!6|`+HZ01;%g5ZJe%`ysalGxSB%+xFF<;IHd!nL{i^v@5wCf->jBSV z=huwGj(@Gw2<>CT?rID9r;2gCTi#T|k@0X+M;SZKSIct_vX8-|G zfVdgwL8!5LMT@31jbs!V{ruw}3$J$h z2W~&73Y+7G+C!Gsz|QCJrQE~5oB}@P1kF??wT|B!IuxuNzBCW@FB7gJxoTMtiDnU` zQI)t`t_>y?Eyg5_bv6RB@o)zW;~s8d=ZOa-frJk29E{`Uc`TGJIi~iV*XCc0mtD*lZEx*IzINBFyMDbYAf@#`l)tvC{ zL-|fFq9op6ams!)`sID4mgzV6tYq3ONRgDs{iV9pwvOfMVq`YCuuDtYlS$?0-(buX zZZPFVIs_Dgus`8Wx7QGB;Zc*m4Gzty(59!)V9n^53Q*J!}Y zkJ;CEQ+e)ni%F?0ynfNM7Ps`orGt6)sD*CobU7CDAj;V9(IS-JnT0Q8 z%W9Z2RkU@kRu-%_P$<~lyN+c^(}b1~!>o6XH_mtI6bU!S211x919P=bAjH(;+U_;3gk_SJdj&6JpkYA2{&K3zV%mrsnrFSZNd&P5 z9j$^uzy**s$E48uOIhqiRGxnrNaVnx#rEHAHw`q^Ecu$M>cGDjlW;tl8<)a&-{p5- z!Ph=UZN&_tZ|I#@QXk0wDG_(dmeIVMRtDGAkoSEu!v@o;_{Icx+dXSJHZDVWtXC+! zpSR-f)5@fX%W*e9KgQAg9DF-e!;*D4ogMKuF((7Q1(1qVgJnj8GRtqLE>o1p6yT)tlpXA)n8d_4wGGd|C z0X#of)kQ;!98{bf7Eh^}+^K^DBmqlvHeA;bs#mN#-30t^(TAAuPpoeL+~Ph|Xa`Ah zeaUKvljX%w-F#CR&&Ul!!(zA)*AV1>3D&IT^x3d+Xx8PMb-M z6GLPL!lGAfNM>6#P%t`GN0o$eHPWfg(6gfjLH-}xzjN?tg@91_1#jiP2cM+fP*UV(D$^p5ruj30T_cj-Uwk>iS?*xYz)iD(u_l;3s`>1Xx z)$jap4IDR;y(rU?o8PJxcc@E_#$1?C>I-?y4rPu~5KiD4!Q1#8uOnh&#<;ILk&jk5 zrQb5F%0Vpw%}HcSYmWLAQT3L=yem;DA?#`70djCQX3+D(XHd9b6w&cvTq>STxu9TZkb|{ zQpmLirX>75{G-IXrB;MjW|(GD-f}5Jku${394-84VfjiwU;-&&=?ag_(6ed!FA{ws zi61GEe}SIpf6cJlU+5*kXR1wgO2kALQOD3xiy?*R`1b^r@tpVs#=WvDy#MfnRpxGeL{+n@~0b8)`}>w? z!VLU8e=T2bS@B)3e`!|e`xA9oj((%hfXC55*X1y+*WtjEZBD42+;o5($au;20lnCN_@Ug2MCg&44uDO!M7BPx7!wltH2ugLrZZg9v+oKvdrC`^@~1i zkG)ZPQ-?A*ugBTqE1sM5xGasv<==Wp+++)a@9-soN^j~9-n1O{jz#YR&BcV1@wSF8 zMeTPqJ)1MvQ|wy18=C`D=xFN%3I(=|31QEN-sonTVNF&*|!12MHrZ&&5y zP!oup^g%Q|CEd71UY{GYl6+X}DZu6Sq%&yvF(;a!Z5!{7g4r*AETIW!HWQN| zYxze{ojXM19|+|qt1M&t)D%vJT>D5{8liQj&lggziMIO8`=5~EXX~PmdY=TOdTf`t6KGcErph*Uz!}w zf|zsw4e(iV++S+Xj#9?7cju)6`sfF5){Yl*w=3yTAv%jC4-JAKvG(nji>Y5xLt{q) zC$a^}$(Bp!zrJ1`pMfsu^K)EUehzm1JBfzvjvP+@%5lb+Q|bQWZ0bi0>*v31W@+TN z@6}ab>zIpC9E3!i2HiW(@{`%C)_&5_<_$Xo!|GO9qAm{}16U7Qi;gu) zCa)+J)-pQ8&6}?C3d&qMV*Bri|EG<+jEX9X_5iLl(p}OmIdnG&(j^Tl4FgCs3~-eY z>Fykm6p$Vo=~O^+=#=g*dFZS4)_NcJI(MCQ&d2-PXa57qz72GDX99>^guz~(pSZ!S zd-WSq8hbb0q(b~u1OT-VRTbpvc}F3}gzG--q0rZ2rb|f4Qh+fas3yeB96ijbsM&Vw zfz=XrlqQ~2JeuEpo2FBl-ps0Wd~iSl>YQw06~GKV&DKJ8-dsq~X-jug!Qb%m(TyE} z;=DVPwj*-e#T*f)mCLB*qYE%aWgbbUlT&*VV9^GA~Tw#HUTqv4sh;z6I&qTOlg8!&inbtf$Ba z!I#~8DI^Vm^pvZ$$39RDKT&4O5c(T!Z_Wz4+Q#i@@?;&Fr%qIolkUy zs+)(IwHgYafkhgGS4SY44oX}hsaqfcUFSY_3+$Ye>^zPTQ0e-b&r|QZxD$~@wif?F zCys!mZ@~uLgi$^2h{&boSG6BQe~^ZkAYisb`C2WM{xd|X%wL4CXoYKDd;hp-EjTo* zo;WKztpP^%X;RV`Zl~H#4>e?DYJQ&-r)@Px-=0^ zVs$a0co5`;!cqy+sSnOIG15Hn2m`9K8xFt&5ZX#zJ1f~63sF^X4WJ71JQD!t&Ec-K z2dgIyeLcwtqwOqg+ATQt{>8QaD#AICMTqHI{))s^mtRE$YO0e!yqoXD{<-sXpv|dv zV0UM>E;HcDdX37h$NLmkLf6HtVTHQoTwf89`+~7l>_2l z59)_hMm5U`6~@Tlq+p4Ggo@2wfy4w9O*&el%rIXqXAJ|q%1RVH0jauW9~=Ijp3Aq` zl=eRy3kw{?tzYNd+=)JLPp8~AQJYkx>#8&fT3a5(9If7{GnZ&2cQ#7Lcgejw37AXQ zi>PJ5O(R6VNa^+BnUvL!PlJ*s{{WH{Iq9^+elzgsSvNAWH!?e?Q#To2?Zq>G!(+rQ z402NYLD}Ir0;@44!CNV)2 z`<|>$Ey2at!#-ZOuY)7SQ-4GtVhR>h*TR$xddD22N#Y$q;cuDB0kDDZx4AoES7?x26XrlcXQ6B>{2Q+rIgmorZdxzc3Y`A*9G&~F!? zhd&8{U=GHS6&fv{mve`?s{^u2at7CIA7yaHor-%i0%VrD)s*Rn=Lor=8>UUey8YXq1U5A%wUvW#A< zhm4s}8=(f8TMEiFrjGdUIwDV)<^LIjD?OZq)lj}2B2Sw*SHcx{Y}VPo-*?YyHGcTT zx8*61pjlio`OIPdOM0NhepVR8L5yYAuUZn^mTrlzDY2SK$|Q-Gt; zX^L|69njv@X5p;T{|q=d)2v=8WvgRoo9}6BG7~dpB*8|lG4^OwAjMq6eohr>+e5jW zlG(`pdTc>`qSuRplk5`Vu@GcvwQhDIA0b!=x8JUNner#~nDmd)4$+2FdvQAy^kgWZ zS)7A6s6ENd5D~Jm*U7tnGr`$a1V%o{sVmwVEYI*OHJ)o*C;~1j1piE+#Y`iqIkzV< z8`@!3z_X+T-SLs`O=?l#R>yxybMKKfi@eOONAxdDASR_KN=m&>B!{X%FI96puR z**7@)6}uI1`;`4`#m{ZZ+$}VMJ-x{BaswAS!YLC{U!L)?RBFDBtN8JR7?Y1De8Jgn zQ~KS-Z3@7@)#6b)*7A|cuE}g5T@m$S$)(?wQzGUV(Fw01-APh^ilcMOVpE{JIT-i! z!Xw!tlkUGvv-^KdQxp2vGy$W#zo=>O>o00v{zFZz{~t9!Mg2ofnLmF~bMGH&8va8~ zz5hYY#0YNp_ye=~9{m&X8SWUBRk&kcnWcb!HGqx)lxqt2koqf~X~tj7G!@hoTI-jG zH17e(cy_mmi`Zu@qkq1IT$z=j8zLp0R(&bYfxLAFzDVsy&l`NSIKBC8Q=MJY^dbbn zBQq{&vGm#0##olj5k8G>NJ3de-a0u}S(eXycs7!i#JNazw|0!Vj!fM%n2E$u)$$Gc z`Ib5P@Tk0>s(d-Ep58avzw5mQ?trp*wZ>S<4G4ld zapxZ=mxCw`Nd5ZY#ZL4)8u!u{u{HQiEs3E`) zD^<5$f}syK`Gyz90t#*oj9~JpoB4|@->=h@x?i7`Cux|pLUgwq5QCKH#$ppETJpSm z2i@d8`Yv^%pt2F|6oR;S!OC6py}~{{?NU205|tj*PB;~V?66M7#Y`ge*zFr=yd-j+ zQZvu~*EdOWGeljLB~o~S8wzG)xvtN=MuDg}E3gWNh$}^tXjGgrlt1t>g*E-e4G|+3 zR2%{`^UIeL)LhpIhA(~_x{?TP^QF8$STg$0w~Meh@~5ZzID~B$lWpA`<=rQs-B&8z zSZuXgddRRIauUmIs}%e^EvYfypX>AM(e86UewYtZDu#Jae+Nt+@(TTQ-7lve`!}45 zS^Wm+1Fv>1q^9#(Y?UNAKoAgE)TLINrkOcX{M$AmbgyaT>72z3YG%vt(HHz&wZAk9 z4YFh%%!GSb)qgJ_J#X=oAG+{BT8(cVaQZ!;4XZ>y3oVP(AB{*46PE0?%3cioDU%~I zlkVzUxeKG=a|6^D5AoiZgD*emBgk*xSr!YLzTn8O=9{YHd$*D2R_|kvT1vLkN) zOt|0`Kl?e^sFo#9?xKWt9{cMsm68TMBdUUngu&V3vZ&B1p?Z?_QtT*yK7kjuN*lus z8T|6>C{42V&U0-!{B!x zzOi_PxR$}RT|JgqKJS4e` z9Se()nS98?_v$w^;qpQ~|N6cI-@d6YJ+z6PTidJNY77yJD%!|SL~t0`Xb`m0VprV8 zyGd*1m)kpKStp`Nv=oUipQm7}LH&~)z{$%7x1{=LA6{qaf;hElD+2JbDCO04&Smov zVWCm5?Ba?*&{0<{WH0zU58scmYuX8sr_PmN99+O5v8*2-HO}mb7jHRKk=WK~#X?)4 zC}{fqI1o<8Vjksm>&ViauM-sZY@|A~<}2jo35(#8=-zk$l`SU3NdqUya9kRUZH2<%dI&gGcxPp&`g2wcMJ8O7gAmKy~o)>k>hvOd+j;F&!7fvaFeVS z@iY^w5r~yl@AFYf0?~LuN9Gn}o9D*Wf@PDt`R4JG1E>b{xV%fQznYz17PiFa+*CVD zUY^}3$Leu(K(rZKli^@t-3-9QB*B86L)+li?4{FNS7=a^D$%!kIK>klesA+eSvFb< zMgH-CLW2Q&r=~`=%$vn|udSSxz%t8>;BOPCRV{pkZay;y7t^t^S7g-%omn%P6HxOG zXqhbGoKb5?wXkwlXG7PE4+w~QA@T5iznE@$LX5G_xDN4o{PHKmmlHsGD`U1i>p_UL zP>DF}&zDr;CAQU=Ee1qQ-8NPNzo$JdA^AHFq=!i~`<*GM;3_BPsg zS8`I{7P?OED^aAMJ$mXVB#Iq%gDM8H?k>6#<`jYTB4?g|jJo)1N>2t?+QOxNC;Z$O zQ}9;_{MmLH{EI&)u$lL$sE4lq6g2_$ucEHSdJa`T>?FIxKJ!$`b87Z$O_81PORT*A za@NdvUHyb}S|_) zJ2L^s87vZf?$*vueS<|k}Hoy53vU#1M|f}5_CSpP(cr&8?X9GexAmZlM>IMAFA zUlCxGoe5R*X8L z`HqqZl_>=T6~A_E)WG+QLr>BAK~jy7sY1vJqx{$gJ6FWYvs}D;>dn~6qaAbpc`Vh3 z#x?ek5It^=`NL&7=0|*#s)`az_qAw#q$YX5g_~PD=mXwj$O>JG8hFUAQ<9pq@r?;} zx0c~&WA0HBTn(*xBqZlz`#g{=no;^iIC(!DdsRV~Zlsc13)v;-CcAank0N7+u0K1^ z4s`$-jGhIt3*_4JMbeH)JH!uCk3RzEmLQMwv2IaAKYa0$uMFv!4t7>*zgfe*5hwzj z1qdQ{FgY}%3hNL1jcnFpG--0K$e8h`%H`hceZAr)kF3zLiV z4fa?~Px4pb%qS%xs#L?NYhIU-X6O}ABJAVpagul0;_l{gmcuS2`k1rEeCVXPw4)%OIi52W3O>%IUZbe6~t z85f+Upe7d#awFWdflurX+h~UsZ^47`;9M1Ytm$DEbYd0O6pWrWwH(dph9P=?sj%Dl z+R*sX6k<#H-&L|3xEO}gy-gCTzBr=l{n}L>W+sFDr@L2Qx3g+Op6zQ-rr%7O@Iucv zH->V|MykpYs-uxS0aEw?3=1gaCJ^^y9I=@N9J+qE@?!L&l!jTSVLUDywzX6Tn77?M z{26(Okg7&R2+BxX3V8Q>_>dTv{|k#qEtPoR@c?YiN*z6y!zGdNQiZ^Mm{(gZ^;7ooF-qGWaL=O3#)klLjeqXkME(=%N6`INeu6KiR z4HjIty?GV8M3j5RI_51Xuug}WMzr|tOord)Q$ z*fryoA#wd$AbT$W7PH9!<;OO~Nr%ZP=`D(m>5;`s)c~=`a1k<6>O^Q`jZ#CyUIXDO&vMYElU1LK(9tdN?GG4C zp+}4}z_f8>FnWC0G3(W@9$5S#AJwUFIfa@;{FnZ`zdrq_(xaL3a8lyBG6Uz>SUI#> z6(!HghN+Iw`@rtba-JMA;)>NstQvO97bRf2nicdQ5X{nsf)(san?)F1%+-Zp*Y73a zsn=AQRKPGvS&Z^We};rc>#l%Trj?RWWcDmT_&`i(JE0-!{E%wdz_X6=)SoAb<|bHA7T+y@F~g_XDqasu=22eSC?Z6deexu6QnOLE^Qpj^MiSrY z6~yxDI(?zQxRt0;xsk@9Kz2m=a1}42t3~wQkCcPtUCAhfqeVRW`O$U$0~Sy6!>53A zS-|~gYy8VhojZV-9=(ILu7Ud6D2}0L2MHxI0SAZ>BE$TI9?Pa(4V}^KLjvuMNpK)ba_J^u{D;y-RR*$dC>e*MYp=5(EN*O&sNN_ zZ`j;NUsB=RC`)hUw~~8EyN}*Sp)E|~HMNrk(OBX7R*vPO-^k)!yc_LH3zAy28|}N1 zr9JG))#O9>uO7?QJPVRSM94}HJwL07Lc3R!-m-;)wl>p(0@}uMbAVm+dp{nugmgHf!%~)#yJ&5+ zq{cjR3cF4=`BmAT$V+$}gPBItj;f{;_>&jL<2hGmtQGPSEM4Z+1!VBxA^_r(?PWRU8%QemgX;$wr?jR8{6?L zX{@3l)Ley!2K>KUN8k26u5DJ9{H@mf$xl^&r%sDH?mT{aZAIIA$N9L=bHVd_hu%Bz zV=3`iW(xc*TRK$uZ*5*iQ%PgBv_f@(PP#BZci( zw$HMQ=t0BOsWP%#yOZ}1Fx9y~cqKoXZS)STpdiN3bx;?(TVhnvB=>IdX85z7o4>fc z4)H!J14KmpE?O9AqKjo1qIl&QqDY+`(kG7ZDimp@VnRci zH4_CXPIWtD#@2YM>;y*UzF;xAfwR!KvO}T`UNSsT;Mki8UrtbERVlkS$RYZ!*&OQ+ v2NHRg9&Ul#KT8jD4|rOtPmze9{C5sz{ngDSq-F617Zt diff --git a/Solutions/Web Session Essentials/Package/mainTemplate.json b/Solutions/Web Session Essentials/Package/mainTemplate.json index ce3cb043503..ab7f480005e 100644 --- a/Solutions/Web Session Essentials/Package/mainTemplate.json +++ b/Solutions/Web Session Essentials/Package/mainTemplate.json @@ -3934,10 +3934,10 @@ "postDeployment": [ "Authorize 'Azure Monitor Logs' and 'Azure Log Analytics Data Collector' API connections." ], + "lastUpdateTime": "2026-09-02T00:00:00Z", "tags": [ "Networking" ], - "lastUpdateTime": "2026-09-02T15:37:19.031Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -5292,10 +5292,10 @@ "postDeployment": [ "Authorize the 'Azure Monitor Logs' API connection. Log ingestion uses the playbook's managed identity." ], + "lastUpdateTime": "2026-09-02T00:00:00Z", "tags": [ "Networking" ], - "lastUpdateTime": "2026-09-02T15:37:19.733Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json index fed7b9a81bf..b9fee898b65 100644 --- a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData/azuredeploy.json @@ -9,6 +9,7 @@ "Authorize 'Azure Monitor Logs' and 'Azure Log Analytics Data Collector' API connections." ], "prerequisitesDeployTemplateFile": [], + "lastUpdateTime": "2026-09-02T00:00:00.000Z", "entities": [], "tags": ["Networking"], "support": { diff --git a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json index 8ead95a9497..2bb837c12d6 100644 --- a/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json +++ b/Solutions/Web Session Essentials/Playbooks/SummarizeWebSessionData_logingestion/azuredeploy.json @@ -9,6 +9,7 @@ "Authorize the 'Azure Monitor Logs' API connection. Log ingestion uses the playbook's managed identity." ], "prerequisitesDeployTemplateFile": [], + "lastUpdateTime": "2026-09-02T00:00:00.000Z", "entities": [], "tags": ["Networking"], "support": {

• Review the solution Release Notes