From 58d7cea2766dff4d61c98152f282469cffa4da70 Mon Sep 17 00:00:00 2001 From: emnp Date: Tue, 11 Jan 2022 07:00:08 +0000 Subject: [PATCH 01/25] new integration - azure frontdoor --- packages/azure_frontdoor/_dev/build/build.yml | 3 + .../azure_frontdoor/_dev/build/docs/README.md | 57 ++++ packages/azure_frontdoor/changelog.yml | 6 + .../_dev/deploy/docker/docker-compose.yml | 8 + .../deploy/docker/sample_logs/fdaccess.log | 2 + .../_dev/test/pipeline/test-common-config.yml | 5 + .../_dev/test/pipeline/test-fdaccess.log | 3 + .../pipeline/test-fdaccess.log-expected.json | 277 +++++++++++++++++ .../_dev/test/system/test-default-config.yml | 7 + .../agent/stream/azure-eventhub.yml.hbs | 33 ++ .../access/agent/stream/stream.yml.hbs | 7 + .../elasticsearch/ingest_pipeline/default.yml | 206 +++++++++++++ .../data_stream/access/fields/agent.yml | 62 ++++ .../data_stream/access/fields/base-fields.yml | 21 ++ .../data_stream/access/fields/ecs.yml | 144 +++++++++ .../data_stream/access/fields/fields.yml | 48 +++ .../data_stream/access/manifest.yml | 65 ++++ .../data_stream/access/sample_event.json | 160 ++++++++++ .../waf/_dev/deploy/docker/docker-compose.yml | 8 + .../_dev/deploy/docker/sample_logs/fdwaf.log | 2 + .../_dev/test/pipeline/test-common-config.yml | 5 + .../waf/_dev/test/pipeline/test-fdwaf.log | 3 + .../pipeline/test-fdwaf.log-expected.json | 130 ++++++++ .../_dev/test/system/test-default-config.yml | 7 + .../waf/agent/stream/azure-eventhub.yml.hbs | 33 ++ .../waf/agent/stream/stream.yml.hbs | 7 + .../elasticsearch/ingest_pipeline/default.yml | 146 +++++++++ .../data_stream/waf/fields/agent.yml | 62 ++++ .../data_stream/waf/fields/base-fields.yml | 21 ++ .../data_stream/waf/fields/ecs.yml | 120 ++++++++ .../data_stream/waf/fields/fields.yml | 36 +++ .../data_stream/waf/manifest.yml | 65 ++++ .../data_stream/waf/sample_event.json | 126 ++++++++ packages/azure_frontdoor/docs/README.md | 287 ++++++++++++++++++ .../img/azure-frontdoor-overview.png | Bin 0 -> 284058 bytes packages/azure_frontdoor/img/front-door.svg | 1 + packages/azure_frontdoor/img/sample-logo.svg | 1 + .../azure_frontdoor/img/sample-screenshot.png | Bin 0 -> 18849 bytes ...-d05e0860-6ea7-11ec-bf35-712f9048d91f.json | 283 +++++++++++++++++ ...-03737aa0-6ead-11ec-bf35-712f9048d91f.json | 114 +++++++ ...-1870ee80-6eab-11ec-bf35-712f9048d91f.json | 94 ++++++ ...-594f3970-6eab-11ec-bf35-712f9048d91f.json | 85 ++++++ ...-63822080-6eae-11ec-bf35-712f9048d91f.json | 85 ++++++ ...-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json | 134 ++++++++ ...-8139b390-6eae-11ec-bf35-712f9048d91f.json | 85 ++++++ ...-85519480-6ea8-11ec-bf35-712f9048d91f.json | 134 ++++++++ ...-c3757a60-6ea8-11ec-bf35-712f9048d91f.json | 85 ++++++ ...-dcef2360-6ead-11ec-bf35-712f9048d91f.json | 94 ++++++ ...-fdd991c0-6eab-11ec-bf35-712f9048d91f.json | 94 ++++++ packages/azure_frontdoor/manifest.yml | 76 +++++ 50 files changed, 3537 insertions(+) create mode 100644 packages/azure_frontdoor/_dev/build/build.yml create mode 100644 packages/azure_frontdoor/_dev/build/docs/README.md create mode 100644 packages/azure_frontdoor/changelog.yml create mode 100644 packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml create mode 100644 packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log create mode 100644 packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml create mode 100644 packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log create mode 100644 packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json create mode 100644 packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml create mode 100644 packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs create mode 100644 packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs create mode 100644 packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/azure_frontdoor/data_stream/access/fields/agent.yml create mode 100644 packages/azure_frontdoor/data_stream/access/fields/base-fields.yml create mode 100644 packages/azure_frontdoor/data_stream/access/fields/ecs.yml create mode 100644 packages/azure_frontdoor/data_stream/access/fields/fields.yml create mode 100644 packages/azure_frontdoor/data_stream/access/manifest.yml create mode 100644 packages/azure_frontdoor/data_stream/access/sample_event.json create mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log create mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log create mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json create mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs create mode 100644 packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs create mode 100644 packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/fields/agent.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/fields/base-fields.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/fields/ecs.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/fields/fields.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/manifest.yml create mode 100644 packages/azure_frontdoor/data_stream/waf/sample_event.json create mode 100644 packages/azure_frontdoor/docs/README.md create mode 100644 packages/azure_frontdoor/img/azure-frontdoor-overview.png create mode 100644 packages/azure_frontdoor/img/front-door.svg create mode 100644 packages/azure_frontdoor/img/sample-logo.svg create mode 100644 packages/azure_frontdoor/img/sample-screenshot.png create mode 100644 packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json create mode 100644 packages/azure_frontdoor/manifest.yml diff --git a/packages/azure_frontdoor/_dev/build/build.yml b/packages/azure_frontdoor/_dev/build/build.yml new file mode 100644 index 00000000000..08d85edcf9a --- /dev/null +++ b/packages/azure_frontdoor/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@1.12 diff --git a/packages/azure_frontdoor/_dev/build/docs/README.md b/packages/azure_frontdoor/_dev/build/docs/README.md new file mode 100644 index 00000000000..69502f8c504 --- /dev/null +++ b/packages/azure_frontdoor/_dev/build/docs/README.md @@ -0,0 +1,57 @@ +# Azure Logs Integration + +The azure frontdoor logs integration retrieves different types of log data from AFD. +Azure Front Door provides different logging to help you track, monitor, and debug your Front Door. + +- Access logs have detailed information about every request that AFD receives and help you analyze and monitor access patterns, and debug issues. +- Activity logs provide visibility into the operations done on Azure resources. +- Health Probe logs provides the logs for every failed probe to your origin. +- Web Application Firewall (WAF) logs provide detailed information of requests that gets logged through either detection or prevention mode of an Azure Front Door endpoint. A custom domain that gets configured with WAF can also be viewed through these logs. + +The package contains the following data streams: + +- access log +- waf logs + +### Credentials + +`eventhub` : +_string_ +Is the fully managed, real-time data ingestion service. + +`consumer_group` : +_string_ +The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. +Default value: `$Default` + +`connection_string` : +_string_ +The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string. + +A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages. + +`storage_account` : +_string_ +The name of the storage account the state/offsets will be stored and updated. + +`storage_account_key` : +_string_ +The storage account key, this key will be used to authorize access to data in your storage account. + +`resource_manager_endpoint` : +_string_ +Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. +Ex: +https://management.chinacloudapi.cn/ for azure ChinaCloud +https://management.microsoftazure.de/ for azure GermanCloud +https://management.azure.com/ for azure PublicCloud +https://management.usgovcloudapi.net/ for azure USGovernmentCloud +Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints. + +## Acceess Logs + +{{fields "access"}} + +## WAF Logs + +{{fields "waf"}} \ No newline at end of file diff --git a/packages/azure_frontdoor/changelog.yml b/packages/azure_frontdoor/changelog.yml new file mode 100644 index 00000000000..7b5f7fd8f9a --- /dev/null +++ b/packages/azure_frontdoor/changelog.yml @@ -0,0 +1,6 @@ +# newer versions go on top +- version: "0.0.1" + changes: + - description: Initial draft of the package + type: enhancement + link: https://github.com/elastic/integrations/pull/0 # FIXME Replace with the real PR link diff --git a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..dab43b824ac --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,8 @@ +version: "2.3" +services: + fdaccess-log-logfile: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" diff --git a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log new file mode 100644 index 00000000000..7a6bf75fa83 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log @@ -0,0 +1,2 @@ +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.603","timeToFirstByte":"3.603","trackingReference":"00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:36:54.0059097Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.542","timeToFirstByte":"3.542","trackingReference":"00mK5YQAAAABiYkksxXO5SqADULPyu7WxU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:36:54.0036459Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..5622947e4b8 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,5 @@ +dynamic_fields: + event.ingested: ".*" +fields: + tags: + - preserve_original_event diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log new file mode 100644 index 00000000000..9a40350e25f --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log @@ -0,0 +1,3 @@ +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"103.25.241.29","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"103.25.241.29","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:10:11.6479719Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"103.217.158.198","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"103.217.158.198","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:49.9266300Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"103.217.158.198","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"103.217.158.198","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:50.0584922Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json new file mode 100644 index 00000000000..d4104890e24 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -0,0 +1,277 @@ +{ + "expected": [ + { + "source": { + "geo": { + "continent_name": "Asia", + "country_name": "Myanmar", + "location": { + "lon": 98.0, + "lat": 22.0 + }, + "country_iso_code": "MM" + }, + "as": { + "number": 133384, + "organization": { + "name": "5BB Broadband" + } + } + }, + "url": { + "original": "https://erp.mitcloud.com:443/StockSetup/GetStockListByCir" + }, + "tags": [ + "preserve_original_event" + ], + "network": { + "protocol": "HTTPS" + }, + "cloud": { + "provider": "azure" + }, + "@timestamp": "2021-12-15T03:10:11.647Z", + "ecs": { + "version": "1.12.0" + }, + "client": { + "port": 50382, + "address": "103.25.241.29", + "ip": "103.25.241.29" + }, + "http": { + "request": { + "method": "POST", + "bytes": 2545 + }, + "version": "2.0.0.0", + "response": { + "bytes": 1205, + "status_code": 200 + } + }, + "tls": { + "version": "1.2", + "version_protocol": "TLS" + }, + "event": { + "ingested": "2021-12-29T11:50:11.818647743Z", + "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"103.25.241.29\",\"clientPort\":\"50382\",\"httpMethod\":\"POST\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SIN\",\"requestBytes\":\"2545\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/StockSetup/GetStockListByCir\",\"responseBytes\":\"1205\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"103.25.241.29\",\"timeTaken\":\"0.384\",\"timeToFirstByte\":\"0.384\",\"trackingReference\":\"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\",\"userAgent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:10:11.6479719Z\"}" + }, + "user_agent": { + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", + "os": { + "name": "Windows", + "version": "7", + "full": "Windows 7" + }, + "device": { + "name": "Other" + }, + "version": "96.0.4664.93" + }, + "azure": { + "frontdoor": { + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "access": { + "pop": "SIN", + "error_info": "NoError", + "rules_engine_match_names": [], + "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "routing_rule_name": "erp", + "is_received_from_client": true, + "cache_status": "CONFIG_NOCACHE", + "time_to_first_byte": "0.384", + "time_taken": "0.384" + }, + "category": "FrontdoorAccessLog", + "tracking_reference": "0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" + } + } + }, + { + "source": { + "geo": { + "continent_name": "Asia", + "country_name": "Myanmar", + "location": { + "lon": 98.0, + "lat": 22.0 + }, + "country_iso_code": "MM" + }, + "as": { + "number": 135405, + "organization": { + "name": "WELINK" + } + } + }, + "url": { + "original": "https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392" + }, + "tags": [ + "preserve_original_event" + ], + "network": { + "protocol": "HTTPS" + }, + "cloud": { + "provider": "azure" + }, + "@timestamp": "2021-12-15T03:35:49.926Z", + "ecs": { + "version": "1.12.0" + }, + "client": { + "port": 6610, + "address": "103.217.158.198", + "ip": "103.217.158.198" + }, + "http": { + "request": { + "method": "GET", + "bytes": 1984 + }, + "version": "2.0.0.0", + "response": { + "bytes": 2308, + "status_code": 200 + } + }, + "tls": { + "version": "1.2", + "version_protocol": "TLS" + }, + "event": { + "ingested": "2021-12-29T11:50:11.818677727Z", + "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"103.217.158.198\",\"clientPort\":\"6610\",\"httpMethod\":\"GET\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SIN\",\"requestBytes\":\"1984\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392\",\"responseBytes\":\"2308\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"103.217.158.198\",\"timeTaken\":\"0.122\",\"timeToFirstByte\":\"0.122\",\"trackingReference\":\"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\",\"userAgent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:35:49.9266300Z\"}" + }, + "user_agent": { + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", + "os": { + "name": "Windows", + "version": "7", + "full": "Windows 7" + }, + "device": { + "name": "Other" + }, + "version": "96.0.4664.93" + }, + "azure": { + "frontdoor": { + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "access": { + "pop": "SIN", + "error_info": "NoError", + "rules_engine_match_names": [], + "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "routing_rule_name": "erp", + "is_received_from_client": true, + "cache_status": "CONFIG_NOCACHE", + "time_to_first_byte": "0.122", + "time_taken": "0.122" + }, + "category": "FrontdoorAccessLog", + "tracking_reference": "0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" + } + } + }, + { + "source": { + "geo": { + "continent_name": "Asia", + "country_name": "Myanmar", + "location": { + "lon": 98.0, + "lat": 22.0 + }, + "country_iso_code": "MM" + }, + "as": { + "number": 135405, + "organization": { + "name": "WELINK" + } + } + }, + "url": { + "original": "https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892" + }, + "tags": [ + "preserve_original_event" + ], + "network": { + "protocol": "HTTPS" + }, + "cloud": { + "provider": "azure" + }, + "@timestamp": "2021-12-15T03:35:50.058Z", + "ecs": { + "version": "1.12.0" + }, + "client": { + "port": 6610, + "address": "103.217.158.198", + "ip": "103.217.158.198" + }, + "http": { + "request": { + "method": "GET", + "bytes": 1971 + }, + "version": "2.0.0.0", + "response": { + "bytes": 637, + "status_code": 200 + } + }, + "tls": { + "version": "1.2", + "version_protocol": "TLS" + }, + "event": { + "ingested": "2021-12-29T11:50:11.818685158Z", + "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"103.217.158.198\",\"clientPort\":\"6610\",\"httpMethod\":\"GET\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SIN\",\"requestBytes\":\"1971\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892\",\"responseBytes\":\"637\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"103.217.158.198\",\"timeTaken\":\"0.064\",\"timeToFirstByte\":\"0.064\",\"trackingReference\":\"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\",\"userAgent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:35:50.0584922Z\"}" + }, + "user_agent": { + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", + "os": { + "name": "Windows", + "version": "7", + "full": "Windows 7" + }, + "device": { + "name": "Other" + }, + "version": "96.0.4664.93" + }, + "azure": { + "frontdoor": { + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "access": { + "pop": "SIN", + "error_info": "NoError", + "rules_engine_match_names": [], + "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "routing_rule_name": "erp", + "is_received_from_client": true, + "cache_status": "CONFIG_NOCACHE", + "time_to_first_byte": "0.064", + "time_taken": "0.064" + }, + "category": "FrontdoorAccessLog", + "tracking_reference": "0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" + } + } + } + ] +} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..bf558a5272d --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml @@ -0,0 +1,7 @@ +service: fdaccess-log-logfile +vars: ~ +input: logfile +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/fdaccess.log" diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs new file mode 100644 index 00000000000..b5354f4e5dc --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs @@ -0,0 +1,33 @@ +{{#if connection_string}} +connection_string: {{connection_string}} +{{/if}} +{{#if eventhub}} +eventhub: {{eventhub}} +storage_account_container: filebeat-activitylogs-{{eventhub}} +{{/if}} +{{#if consumer_group}} +consumer_group: {{consumer_group}} +{{/if}} +{{#if storage_account}} +storage_account: {{storage_account}} +{{/if}} +{{#if storage_account_key}} +storage_account_key: {{storage_account_key}} +{{/if}} +{{#if resource_manager_endpoint}} +resource_manager_endpoint: {{resource_manager_endpoint}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..5845510de80 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs @@ -0,0 +1,7 @@ +paths: +{{#each paths as |path i|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +processors: + - add_locale: ~ diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..d3e00782012 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,206 @@ +--- +description: Pipeline for processing azure frontdoor access logs +processors: + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + - set: + field: ecs.version + value: '1.12.0' + - rename: + field: message + target_field: event.original + ignore_missing: true + - set: + field: cloud.provider + value: azure +# - grok: +# field: event.original +# patterns: +# - '{ body: %{GREEDYDATA:body}, properties: %{WORD:properties}, offset: %{NUMBER:offset}, sequence_number: %{NUMBER:sequence_number}, enqueued_time=%{GREEDYDATA:enqueued_time} }' +# ignore_failure: true +# - gsub: +# field: body +# pattern: \' +# replacement: "" +# - json: +# field: body +# target_field: azure.frontdoor_access + - drop: + description: Drop if inavlid json + if: "ctx?.event.original.contains('\"records\"')" + - json: + field: event.original + target_field: azure.frontdoor.access + - rename: + field: azure.frontdoor.access.resourceId + target_field: azure.frontdoor.resource_id + ignore_missing: true + - rename: + field: azure.frontdoor.access.operationName + target_field: azure.frontdoor.operation_name + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.trackingReference + target_field: azure.frontdoor.tracking_reference + ignore_missing: true + - rename: + field: azure.frontdoor.access.category + target_field: azure.frontdoor.category + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.clientIp + target_field: client.ip + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.clientPort + target_field: client.port + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.requestBytes + target_field: http.request.bytes + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.socketIp + target_field: client.address + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.ErrorInfo + target_field: azure.frontdoor.access.error_info + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.rulesEngineMatchNames + target_field: azure.frontdoor.access.rules_engine_match_names + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.cacheStatus + target_field: azure.frontdoor.access.cache_status + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.userAgent + target_field: user_agent.original + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.httpMethod + target_field: http.request.method + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.timeToFirstByte + target_field: azure.frontdoor.access.time_to_first_byte + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.pop + target_field: azure.frontdoor.access.pop + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.responseBytes + target_field: http.response.bytes + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.timeTaken + target_field: azure.frontdoor.access.time_taken + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.routingRuleName + target_field: azure.frontdoor.access.routing_rule_name + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.httpVersion + target_field: http.version + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.backendHostname + target_field: azure.frontdoor.access.backend_hostname + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.isReceivedFromClient + target_field: azure.frontdoor.access.is_received_from_client + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.requestProtocol + target_field: network.protocol + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.httpStatusCode + target_field: http.response.status_code + ignore_missing: true + - rename: + field: azure.frontdoor.access.properties.requestUri + target_field: url.original + ignore_missing: true + - convert: + field: client.port + type: long + ignore_missing: true + - convert: + field: http.request.bytes + type: long + ignore_missing: true + - convert: + field: http.response.bytes + type: long + ignore_missing: true + - convert: + field: http.response.status_code + type: long + ignore_missing: true + + - date: + field: azure.frontdoor.access.time + target_field: '@timestamp' + ignore_failure: true + formats: + - ISO8601 + +# - grok: +# field: azure.resource_id +# patterns: +# - /SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace} +# - /subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/namespaces/%{NAMESPACE:azure.resource.namespace} +# pattern_definitions: +# SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} +# GROUPID: .+ +# PROVIDERNAME: .+ +# NAMESPACE: .+ +# ignore_failure: true + + - dissect: + field: azure.frontdoor.access.properties.securityProtocol + pattern: '%{tls.version_protocol} %{tls.version}' + + - remove: + field: + - azure.frontdoor.access.properties.securityProtocol + - azure.frontdoor.access.properties.httpStatusDetails + - azure.frontdoor.access.time + - azure.frontdoor.access.properties + - event.original + + - geoip: + field: client.ip + target_field: source.geo + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: client.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + - user_agent: + field: user_agent.original + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/azure_frontdoor/data_stream/access/fields/agent.yml b/packages/azure_frontdoor/data_stream/access/fields/agent.yml new file mode 100644 index 00000000000..bca66ea4ae0 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/fields/agent.yml @@ -0,0 +1,62 @@ +- name: cloud.account.id + external: ecs +- name: cloud.availability_zone + external: ecs +- name: cloud.instance.id + external: ecs +- name: cloud.instance.name + external: ecs +- name: cloud.machine.type + external: ecs +- name: cloud.provider + external: ecs +- name: cloud.region + external: ecs +- name: cloud.project.id + external: ecs +- name: cloud.image.id + type: keyword + description: Image ID for the cloud instance. +- name: container.id + external: ecs +- name: container.image.name + external: ecs +- name: container.labels + external: ecs +- name: container.name + external: ecs +- name: host.architecture + external: ecs +- name: host.domain + external: ecs +- name: host.hostname + external: ecs +- name: host.id + external: ecs +- name: host.ip + external: ecs +- name: host.mac + external: ecs +- name: host.name + external: ecs +- name: host.os.family + external: ecs +- name: host.os.kernel + external: ecs +- name: host.os.name + external: ecs +- name: host.os.platform + external: ecs +- name: host.os.version + external: ecs +- name: host.type + external: ecs +- name: host.containerized + type: boolean + description: If the host is a container. +- name: host.os.build + type: keyword + description: OS build information. +- name: host.os.codename + type: keyword + description: OS codename, if any. diff --git a/packages/azure_frontdoor/data_stream/access/fields/base-fields.yml b/packages/azure_frontdoor/data_stream/access/fields/base-fields.yml new file mode 100644 index 00000000000..f245714ba9e --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/fields/base-fields.yml @@ -0,0 +1,21 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: input.type + type: keyword + description: Input type. +- name: log.offset + type: long + description: Log offset. +- name: log.file.path + type: keyword + description: Log file path. diff --git a/packages/azure_frontdoor/data_stream/access/fields/ecs.yml b/packages/azure_frontdoor/data_stream/access/fields/ecs.yml new file mode 100644 index 00000000000..34b91e4755f --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/fields/ecs.yml @@ -0,0 +1,144 @@ +- name: client.ip + external: ecs +- name: client.address + external: ecs +- name: client.port + external: ecs +- name: destination.address + external: ecs +- name: destination.as.number + external: ecs +- name: destination.as.organization.name + external: ecs +- name: destination.geo.city_name + external: ecs +- name: destination.geo.continent_name + external: ecs +- name: destination.geo.country_iso_code + external: ecs +- name: destination.geo.country_name + external: ecs +- name: destination.geo.location + external: ecs +- name: destination.geo.name + external: ecs +- name: destination.geo.region_iso_code + external: ecs +- name: destination.geo.region_name + external: ecs +- name: destination.ip + external: ecs +- name: destination.port + external: ecs +- name: ecs.version + external: ecs +- name: message + external: ecs +- name: event.action + external: ecs +- name: event.category + external: ecs +- name: event.created + external: ecs +- name: event.id + external: ecs +- name: event.ingested + external: ecs +- name: event.kind + external: ecs +- name: event.type + external: ecs +- name: file.mime_type + external: ecs +- name: file.size + external: ecs +- name: network.community_id + external: ecs +- name: network.protocol + external: ecs +- name: host.ip + external: ecs +- name: related.ip + external: ecs +- name: related.user + external: ecs +- name: source.address + external: ecs +- name: source.as.number + external: ecs +- name: source.as.organization.name + external: ecs +- name: geo.continent_name + external: ecs +- name: geo.country_iso_code + external: ecs +- name: geo.country_name + external: ecs +- name: geo.location + external: ecs +- name: geo.city_name + external: ecs +- name: log.level + external: ecs +- name: source.geo.city_name + external: ecs +- name: source.geo.continent_name + external: ecs +- name: source.geo.country_iso_code + external: ecs +- name: source.geo.country_name + external: ecs +- name: source.geo.location + external: ecs +- name: source.geo.name + external: ecs +- name: source.geo.region_iso_code + external: ecs +- name: source.geo.region_name + external: ecs +- name: source.ip + external: ecs +- name: source.port + external: ecs +- name: user.full_name + external: ecs +- name: user.domain + external: ecs +- name: user.name + external: ecs +- name: user.id + external: ecs +- name: user.name + external: ecs +- name: tags + external: ecs +- name: url.original + external: ecs +- name: http.request.bytes + external: ecs +- name: http.request.method + external: ecs +- name: http.response.bytes + external: ecs +- name: http.response.status_code + external: ecs +- name: http.version + external: ecs +- name: tls.version + external: ecs +- name: tls.version_protocol + external: ecs +- name: user_agent.original + external: ecs +- name: user_agent.device.name + external: ecs +- name: user_agent.name + external: ecs +- name: user_agent.os.full + external: ecs +- name: user_agent.os.name + external: ecs +- name: user_agent.os.version + external: ecs +- name: user_agent.version + external: ecs diff --git a/packages/azure_frontdoor/data_stream/access/fields/fields.yml b/packages/azure_frontdoor/data_stream/access/fields/fields.yml new file mode 100644 index 00000000000..95f710f451c --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/fields/fields.yml @@ -0,0 +1,48 @@ +- name: azure.frontdoor + type: group + fields: + - name: resource_id + type: keyword + description: Azure Resource ID. + - name: category + type: keyword + description: Azue frontdoor category name. + - name: operation_name + type: keyword + description: Azure operation name. + - name: tracking_reference + type: keyword + description: The unique reference string that identifies a request served by AFD, also sent as X-Azure-Ref header to the client. Required for searching details in the access logs for a specific request. + - name: access + type: group + fields: + - name: time_to_first_byte + type: keyword + description: The length of time in milliseconds from AFD receives the request to the time the first byte gets sent to client, as measured on Azure Front Door. This property doesn't measure the client data. + - name: time_taken + type: keyword + description: The length of time from the time AFD edge server receives a client's request to the time that AFD sends the last byte of response to client, in milliseconds. This field doesn't take into account network latency and TCP buffering. + - name: time + type: keyword + description: The date and time when the AFD edge delivered requested contents to client (in UTC). + - name: rules_engine_match_names + type: keyword + description: The names of the rules that were processed. + - name: routing_rule_name + type: keyword + description: The name of the route that the request matched. + - name: pop + type: keyword + description: The edge pop, which responded to the user request. + - name: is_received_from_client + type: boolean + description: Boolean value. + - name: backend_hostname + type: keyword + description: The host name in the request from client. If you enable custom domains and have wildcard domain (*.contoso.com), hostname is a.contoso.com. if you use Azure Front Door domain (contoso.azurefd.net), hostname is contoso.azurefd.net. + - name: error_info + type: keyword + description: This field provides detailed info of the error token for each response. + - name: cache_status + type: keyword + description: Provides the status code of how the request gets handled by the CDN service when it comes to caching. diff --git a/packages/azure_frontdoor/data_stream/access/manifest.yml b/packages/azure_frontdoor/data_stream/access/manifest.yml new file mode 100644 index 00000000000..69961a248f7 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/manifest.yml @@ -0,0 +1,65 @@ +title: "FrontDoor Access" +type: logs +streams: + - input: logfile + title: Azure Frontdoor Access logs + description: Collect frontdoor access logs + vars: + - name: paths + type: text + title: Paths + multi: true + default: + - /var/log/*.log + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - azure-frontdoor-access + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: "azure-eventhub" + template_path: "azure-eventhub.yml.hbs" + title: "Azure Frontdoor Access logs" + description: "Collect Azure frontdoor access logs using azure-eventhub input" + vars: + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - azure-frontdoor-access + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. " diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json new file mode 100644 index 00000000000..6e0eec6f986 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -0,0 +1,160 @@ +{ + "@timestamp": "2021-12-15T03:36:54.005Z", + "agent": { + "ephemeral_id": "a0b1e4bf-8bc8-44a8-904f-ff7b55f6039b", + "hostname": "docker-fleet-agent", + "id": "1be0b35e-6d0c-4359-8f1e-3d43aade3bea", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "7.16.0" + }, + "azure": { + "frontdoor": { + "access": { + "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "cache_status": "CONFIG_NOCACHE", + "error_info": "NoError", + "is_received_from_client": true, + "pop": "SGE", + "routing_rule_name": "erp", + "rules_engine_match_names": [], + "time_taken": "3.603", + "time_to_first_byte": "3.603" + }, + "category": "FrontdoorAccessLog", + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3" + } + }, + "client": { + "address": "2400:ac40:60b:7aeb:418d:7c32:ac90:e100", + "ip": "2400:ac40:60b:7aeb:418d:7c32:ac90:e100", + "port": 65238 + }, + "cloud": { + "account": { + "id": "k-researach-lab" + }, + "availability_zone": "asia-southeast1-b", + "instance": { + "id": "7627326072194210872", + "name": "elmuu" + }, + "machine": { + "type": "e2-standard-2" + }, + "project": { + "id": "k-researach-lab" + }, + "provider": "azure", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "azure_frontdoor.access", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "1.12.0" + }, + "elastic_agent": { + "id": "1be0b35e-6d0c-4359-8f1e-3d43aade3bea", + "snapshot": true, + "version": "7.16.0" + }, + "event": { + "agent_id_status": "verified", + "dataset": "azure_frontdoor.access", + "ingested": "2021-12-30T05:03:08Z", + "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"2400:ac40:60b:7aeb:418d:7c32:ac90:e100\",\"clientPort\":\"65238\",\"httpMethod\":\"POST\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SGE\",\"requestBytes\":\"3081\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/Dashboard/getTopStockList\",\"responseBytes\":\"3191\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"2400:ac40:60b:7aeb:418d:7c32:ac90:e100\",\"timeTaken\":\"3.603\",\"timeToFirstByte\":\"3.603\",\"trackingReference\":\"00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:36:54.0059097Z\"}", + "timezone": "+00:00" + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "1fe40eba24f3f02b88864749eb7679a3", + "ip": [ + "192.168.112.7" + ], + "mac": [ + "02:42:c0:a8:70:07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "Core", + "family": "redhat", + "kernel": "5.11.0-1022-gcp", + "name": "CentOS Linux", + "platform": "centos", + "type": "linux", + "version": "7 (Core)" + } + }, + "http": { + "request": { + "bytes": 3081, + "method": "POST" + }, + "response": { + "bytes": 3191, + "status_code": 200 + }, + "version": "2.0.0.0" + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/fdaccess.log" + }, + "offset": 0 + }, + "network": { + "protocol": "HTTPS" + }, + "source": { + "as": { + "number": 136255, + "organization": { + "name": "Telecom International Myanmar Co., Ltd" + } + }, + "geo": { + "city_name": "Yangon", + "continent_name": "Asia", + "country_iso_code": "MM", + "country_name": "Myanmar", + "location": { + "lat": 16.7827, + "lon": 96.1771 + }, + "region_iso_code": "MM-06", + "region_name": "Rangoon" + } + }, + "tls": { + "version": "1.2", + "version_protocol": "TLS" + }, + "url": { + "original": "https://erp.mitcloud.com:443/Dashboard/getTopStockList" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", + "os": { + "full": "Windows 10", + "name": "Windows", + "version": "10" + }, + "version": "96.0.4664.93" + } +} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..151c4d107bb --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,8 @@ +version: "2.3" +services: + fdwaf-log-logfile: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log new file mode 100644 index 00000000000..64de7f9c0c6 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log @@ -0,0 +1,2 @@ +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"8.38.147.74","clientPort":"56094","details":{"matches":[]},"host":"connect.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"8.38.147.74","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T15:00:06.6330668Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"122.248.108.128","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.mitcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"122.248.108.128","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T16:03:09.8128356Z"} diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..5622947e4b8 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,5 @@ +dynamic_fields: + event.ingested: ".*" +fields: + tags: + - preserve_original_event diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log new file mode 100644 index 00000000000..9c876863421 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log @@ -0,0 +1,3 @@ +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"8.38.147.74","clientPort":"56094","details":{"matches":[]},"host":"connect.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"8.38.147.74","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T15:00:06.6330668Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"122.248.108.128","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.mitcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"122.248.108.128","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T16:03:09.8128356Z"} +{"records": [{ "time": "2021-12-27T16:00:28.7593936Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942200","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects MySQL comment-/space-obfuscated injections and backtick termination","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7601443Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942260","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_expenses_with_cc_gofresh","matchVariableValue":"{\"lvl1ExpensesWithCC\":\"Food Stuff\"}"},{"matchVariableName":"CookieValue:w_cogs_gofresh","matchVariableValue":"{\"lvl1cogs\":\"Cost of Sales\",\"lvl2cogs\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_expenses_without_cogs_gofresh","matchVariableValue":"{\"lvl1ExpensesWithoutcogs\":\"Selling & Distribution Expenses\",\"lvl2ExpensesWithoutcogs\":\"Selling & Di"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_top_gofresh","matchVariableValue":"{\"dataSelect\":30,\"cusSku\":1}"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},],"msg":"Detects basic SQL authentication bypass attempts 2/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7601736Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942200","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects MySQL comment-/space-obfuscated injections and backtick termination","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7608904Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942260","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_expenses_with_cc_gofresh","matchVariableValue":"{\"lvl1ExpensesWithCC\":\"Food Stuff\"}"},{"matchVariableName":"CookieValue:w_cogs_gofresh","matchVariableValue":"{\"lvl1cogs\":\"Cost of Sales\",\"lvl2cogs\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_expenses_without_cogs_gofresh","matchVariableValue":"{\"lvl1ExpensesWithoutcogs\":\"Selling & Distribution Expenses\",\"lvl2ExpensesWithoutcogs\":\"Selling & Di"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_top_gofresh","matchVariableValue":"{\"dataSelect\":30,\"cusSku\":1}"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},],"msg":"Detects basic SQL authentication bypass attempts 2/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7611593Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942330","policy":"waf2","action":"Block","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects classic SQL injection probings 1/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7618185Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942330","policy":"waf2","action":"Block","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects classic SQL injection probings 1/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}}]} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json new file mode 100644 index 00000000000..d64f1afe6c2 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -0,0 +1,130 @@ +{ + "expected": [ + { + "rule": { + "name": "AllowMyanmar" + }, + "source": { + "geo": { + "continent_name": "Asia", + "country_name": "Singapore", + "city_name": "Singapore", + "location": { + "lon": 103.8547, + "lat": 1.2929 + }, + "country_iso_code": "SG" + }, + "as": { + "number": 13335, + "organization": { + "name": "Cloudflare, Inc." + } + } + }, + "url": { + "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1", + "domain": "connect.mitcloud.com" + }, + "tags": [ + "preserve_original_event" + ], + "cloud": { + "provider": "azure" + }, + "@timestamp": "2021-12-27T15:00:06.633Z", + "ecs": { + "version": "1.12.0" + }, + "client": { + "port": 56094, + "address": "8.38.147.74", + "ip": "8.38.147.74" + }, + "event": { + "action": "Log", + "ingested": "2021-12-29T11:50:39.365361636Z", + "original": "{\"category\":\"FrontdoorWebApplicationFirewallLog\",\"operationName\":\"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write\",\"properties\":{\"action\":\"Log\",\"clientIP\":\"8.38.147.74\",\"clientPort\":\"56094\",\"details\":{\"matches\":[]},\"host\":\"connect.mitcloud.com\",\"policy\":\"waf2\",\"policyMode\":\"detection\",\"requestUri\":\"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1\",\"ruleName\":\"AllowMyanmar\",\"socketIP\":\"8.38.147.74\",\"trackingReference\":\"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-27T15:00:06.6330668Z\"}" + }, + "azure": { + "frontdoor": { + "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "category": "FrontdoorWebApplicationFirewallLog", + "waf": { + "policy_mode": "detection", + "details": {}, + "policy": "waf2" + }, + "tracking_reference": "09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" + } + } + }, + { + "rule": { + "name": "DefaultRuleSet-1.0-SQLI-942330" + }, + "source": { + "geo": { + "continent_name": "Asia", + "region_iso_code": "MM-04", + "city_name": "Mandalay", + "country_iso_code": "MM", + "country_name": "Myanmar", + "region_name": "Mandalay Region", + "location": { + "lon": 96.0833, + "lat": 22.0 + } + }, + "as": { + "number": 131322, + "organization": { + "name": "Yatanarpon Teleport Company Limited" + } + } + }, + "url": { + "original": "https://erp.mitcloud.com:443/accountcategory/getAccountCategory", + "domain": "erp.mitcloud.com" + }, + "tags": [ + "preserve_original_event" + ], + "cloud": { + "provider": "azure" + }, + "@timestamp": "2021-12-27T16:03:09.812Z", + "ecs": { + "version": "1.12.0" + }, + "client": { + "port": 59781, + "address": "122.248.108.128", + "ip": "122.248.108.128" + }, + "event": { + "action": "Block", + "ingested": "2021-12-29T11:50:39.365385870Z", + "original": "{\"category\":\"FrontdoorWebApplicationFirewallLog\",\"operationName\":\"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write\",\"properties\":{\"action\":\"Block\",\"clientIP\":\"122.248.108.128\",\"clientPort\":\"59781\",\"details\":{\"data\":\"Matched Data: {\\\"selectPeriod\\\":\\\"0000\\\",\\\"fromDate\\\":\\\"20210701\\\",\\\"toDate\\\":\\\"20211231\\\",\\\"checkDate\\\":\\\"20211226\\\",\\\"ccSyskey\\\":\\\" found within CookieValue:w_db_ibp: {\\\"selectPeriod\\\":\\\"0000\\\",\\\"fromDate\\\":\\\"20210701\\\",\\\"toDate\\\":\\\"20211231\\\",\\\"checkDate\\\":\\\"20211226\\\",\\\"ccSyskey\\\":\\\"\",\"matches\":[{\"matchVariableName\":\"CookieValue:w_db_ibp\",\"matchVariableValue\":\"{\\\"selectPeriod\\\":\\\"0000\\\",\\\"fromDate\\\":\\\"20210701\\\",\\\"toDate\\\":\\\"20211231\\\",\\\"checkDate\\\":\\\"20211226\\\",\\\"ccSyskey\\\":\\\"\"},{\"matchVariableName\":\"CookieValue:w_solist_ibp\",\"matchVariableValue\":\"{\\\"refNo\\\":\\\"\\\",\\\"secRefNo\\\":\\\"\\\",\\\"crossRefNo\\\":\\\"\\\",\\\"custCodeOpt\\\":\\\"c\\\",\\\"custCode\\\":\\\"\\\",\\\"custNameOpt\\\":\\\"c\\\",\\\"custNam\"},{\"matchVariableName\":\"CookieValue:w_pilist_ibp\",\"matchVariableValue\":\"{\\\"refNo\\\":\\\"\\\",\\\"secRefNo\\\":\\\"\\\",\\\"crossRef\\\":\\\"\\\",\\\"status\\\":\\\"0\\\",\\\"venCodeOpt\\\":\\\"c\\\",\\\"venCode\\\":\\\"\\\",\\\"venNameOpt\\\":\\\"c\\\",\"},{\"matchVariableName\":\"CookieValue:w_ah_ibp\",\"matchVariableValue\":\"{\\\"selectedAccCat\\\":0,\\\"showTrial\\\":false,\\\"showAmt\\\":false,\\\"isCc\\\":false,\\\"isDept\\\":false,\\\"ccSyskey\\\":\\\"-1\\\",\\\"d\"},{\"matchVariableName\":\"CookieValue:w_silist_ibp\",\"matchVariableValue\":\"{\\\"refNo\\\":\\\"\\\",\\\"secRefNo\\\":\\\"\\\",\\\"crossRefNo\\\":\\\"\\\",\\\"custCodeOpt\\\":\\\"c\\\",\\\"custCode\\\":\\\"\\\",\\\"custNameOpt\\\":\\\"c\\\",\\\"custNam\"}],\"msg\":\"Detects classic SQL injection probings 1/3\"},\"host\":\"erp.mitcloud.com\",\"policy\":\"waf2\",\"policyMode\":\"detection\",\"requestUri\":\"https://erp.mitcloud.com:443/accountcategory/getAccountCategory\",\"ruleName\":\"DefaultRuleSet-1.0-SQLI-942330\",\"socketIP\":\"122.248.108.128\",\"trackingReference\":\"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-27T16:03:09.8128356Z\"}" + }, + "azure": { + "frontdoor": { + "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "category": "FrontdoorWebApplicationFirewallLog", + "waf": { + "policy_mode": "detection", + "details": { + "msg": "Detects classic SQL injection probings 1/3", + "data": "Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"" + }, + "policy": "waf2" + }, + "tracking_reference": "0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" + } + } + }, + null + ] +} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..2e77b442a0f --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml @@ -0,0 +1,7 @@ +service: fdwaf-log-logfile +vars: ~ +input: logfile +data_stream: + vars: + paths: + - "{{SERVICE_LOGS_DIR}}/fdwaf.log" diff --git a/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs b/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs new file mode 100644 index 00000000000..b5354f4e5dc --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs @@ -0,0 +1,33 @@ +{{#if connection_string}} +connection_string: {{connection_string}} +{{/if}} +{{#if eventhub}} +eventhub: {{eventhub}} +storage_account_container: filebeat-activitylogs-{{eventhub}} +{{/if}} +{{#if consumer_group}} +consumer_group: {{consumer_group}} +{{/if}} +{{#if storage_account}} +storage_account: {{storage_account}} +{{/if}} +{{#if storage_account_key}} +storage_account_key: {{storage_account_key}} +{{/if}} +{{#if resource_manager_endpoint}} +resource_manager_endpoint: {{resource_manager_endpoint}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..5845510de80 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs @@ -0,0 +1,7 @@ +paths: +{{#each paths as |path i|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +processors: + - add_locale: ~ diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..d64e8c9d00c --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,146 @@ +--- +description: Pipeline for processing azure frontdoor waf logs +processors: + - set: + field: event.ingested + value: '{{_ingest.timestamp}}' + - set: + field: ecs.version + value: '1.12.0' + - rename: + field: message + target_field: event.original + ignore_missing: true + - set: + field: cloud.provider + value: azure +# - grok: +# field: event.original +# patterns: +# - '{ body: %{GREEDYDATA:body}, properties: %{WORD:properties}, offset: %{NUMBER:offset}, sequence_number: %{NUMBER:sequence_number}, enqueued_time=%{GREEDYDATA:enqueued_time} }' +# ignore_failure: true +# - gsub: +# field: body +# pattern: \' +# replacement: "" +# - json: +# field: body +# target_field: azure.frontdoor_waf + - drop: + description: Drop if inavlid json + if: "ctx?.event.original.contains('\"records\"')" + - json: + field: event.original + target_field: azure.frontdoor.waf + - rename: + field: azure.frontdoor.waf.resourceId + target_field: azure.frontdoor.resource_id + ignore_missing: true + - rename: + field: azure.frontdoor.waf.operationName + target_field: azure.frontdoor.operation_name + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.trackingReference + target_field: azure.frontdoor.tracking_reference + ignore_missing: true + - rename: + field: azure.frontdoor.waf.category + target_field: azure.frontdoor.category + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.clientIP + target_field: client.ip + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.clientPort + target_field: client.port + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.action + target_field: event.action + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.socketIP + target_field: client.address + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.ruleName + target_field: rule.name + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.details + target_field: azure.frontdoor.waf.details + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.host + target_field: url.domain + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.policy + target_field: azure.frontdoor.waf.policy + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.policyMode + target_field: azure.frontdoor.waf.policy_mode + ignore_missing: true + - rename: + field: azure.frontdoor.waf.properties.requestUri + target_field: url.original + ignore_missing: true + - convert: + field: client.port + type: long + ignore_missing: true + + - date: + field: azure.frontdoor.waf.time + target_field: '@timestamp' + ignore_failure: true + formats: + - ISO8601 + +# - grok: +# field: azure.resource_id +# patterns: +# - /SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace} +# - /subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/namespaces/%{NAMESPACE:azure.resource.namespace} +# pattern_definitions: +# SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} +# GROUPID: .+ +# PROVIDERNAME: .+ +# NAMESPACE: .+ +# ignore_failure: true + + - remove: + field: + - azure.frontdoor.waf.time + - azure.frontdoor.waf.properties + - azure.frontdoor.waf.details.matches + - event.original + + - geoip: + field: client.ip + target_field: source.geo + ignore_missing: true + - geoip: + database_file: GeoLite2-ASN.mmdb + field: client.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/azure_frontdoor/data_stream/waf/fields/agent.yml b/packages/azure_frontdoor/data_stream/waf/fields/agent.yml new file mode 100644 index 00000000000..bca66ea4ae0 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/fields/agent.yml @@ -0,0 +1,62 @@ +- name: cloud.account.id + external: ecs +- name: cloud.availability_zone + external: ecs +- name: cloud.instance.id + external: ecs +- name: cloud.instance.name + external: ecs +- name: cloud.machine.type + external: ecs +- name: cloud.provider + external: ecs +- name: cloud.region + external: ecs +- name: cloud.project.id + external: ecs +- name: cloud.image.id + type: keyword + description: Image ID for the cloud instance. +- name: container.id + external: ecs +- name: container.image.name + external: ecs +- name: container.labels + external: ecs +- name: container.name + external: ecs +- name: host.architecture + external: ecs +- name: host.domain + external: ecs +- name: host.hostname + external: ecs +- name: host.id + external: ecs +- name: host.ip + external: ecs +- name: host.mac + external: ecs +- name: host.name + external: ecs +- name: host.os.family + external: ecs +- name: host.os.kernel + external: ecs +- name: host.os.name + external: ecs +- name: host.os.platform + external: ecs +- name: host.os.version + external: ecs +- name: host.type + external: ecs +- name: host.containerized + type: boolean + description: If the host is a container. +- name: host.os.build + type: keyword + description: OS build information. +- name: host.os.codename + type: keyword + description: OS codename, if any. diff --git a/packages/azure_frontdoor/data_stream/waf/fields/base-fields.yml b/packages/azure_frontdoor/data_stream/waf/fields/base-fields.yml new file mode 100644 index 00000000000..f245714ba9e --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/fields/base-fields.yml @@ -0,0 +1,21 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: input.type + type: keyword + description: Input type. +- name: log.offset + type: long + description: Log offset. +- name: log.file.path + type: keyword + description: Log file path. diff --git a/packages/azure_frontdoor/data_stream/waf/fields/ecs.yml b/packages/azure_frontdoor/data_stream/waf/fields/ecs.yml new file mode 100644 index 00000000000..f5dacaaec80 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/fields/ecs.yml @@ -0,0 +1,120 @@ +- name: client.ip + external: ecs +- name: client.address + external: ecs +- name: client.port + external: ecs +- name: destination.address + external: ecs +- name: destination.as.number + external: ecs +- name: destination.as.organization.name + external: ecs +- name: destination.geo.city_name + external: ecs +- name: destination.geo.continent_name + external: ecs +- name: destination.geo.country_iso_code + external: ecs +- name: destination.geo.country_name + external: ecs +- name: destination.geo.location + external: ecs +- name: destination.geo.name + external: ecs +- name: destination.geo.region_iso_code + external: ecs +- name: destination.geo.region_name + external: ecs +- name: destination.ip + external: ecs +- name: destination.port + external: ecs +- name: ecs.version + external: ecs +- name: message + external: ecs +- name: event.action + external: ecs +- name: event.category + external: ecs +- name: event.created + external: ecs +- name: event.id + external: ecs +- name: event.ingested + external: ecs +- name: event.kind + external: ecs +- name: event.type + external: ecs +- name: file.mime_type + external: ecs +- name: file.size + external: ecs +- name: network.community_id + external: ecs +- name: network.protocol + external: ecs +- name: host.ip + external: ecs +- name: related.ip + external: ecs +- name: related.user + external: ecs +- name: source.address + external: ecs +- name: source.as.number + external: ecs +- name: source.as.organization.name + external: ecs +- name: geo.continent_name + external: ecs +- name: geo.country_iso_code + external: ecs +- name: geo.country_name + external: ecs +- name: geo.location + external: ecs +- name: geo.city_name + external: ecs +- name: log.level + external: ecs +- name: source.geo.city_name + external: ecs +- name: source.geo.continent_name + external: ecs +- name: source.geo.country_iso_code + external: ecs +- name: source.geo.country_name + external: ecs +- name: source.geo.location + external: ecs +- name: source.geo.name + external: ecs +- name: source.geo.region_iso_code + external: ecs +- name: source.geo.region_name + external: ecs +- name: source.ip + external: ecs +- name: source.port + external: ecs +- name: user.full_name + external: ecs +- name: user.domain + external: ecs +- name: user.name + external: ecs +- name: user.id + external: ecs +- name: user.name + external: ecs +- name: tags + external: ecs +- name: url.original + external: ecs +- name: url.domain + external: ecs +- name: rule.name + external: ecs diff --git a/packages/azure_frontdoor/data_stream/waf/fields/fields.yml b/packages/azure_frontdoor/data_stream/waf/fields/fields.yml new file mode 100644 index 00000000000..84c4fbc77c1 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/fields/fields.yml @@ -0,0 +1,36 @@ +- name: azure.frontdoor + type: group + fields: + - name: resource_id + type: keyword + description: Azure Resource ID. + - name: category + type: keyword + description: Azue frontdoor category name. + - name: operation_name + type: keyword + description: Azure operation name. + - name: tracking_reference + type: keyword + description: The unique reference string that identifies a request served by AFD, also sent as X-Azure-Ref header to the client. Required for searching details in the access logs for a specific request. + - name: waf + type: group + fields: + - name: time + type: keyword + description: The date and time when the AFD edge delivered requested contents to client (in UTC). + - name: policy + type: keyword + description: WAF policy name. + - name: policy_mode + type: keyword + description: WAF policy mode. + - name: details + type: group + fields: + - name: data + type: keyword + description: Detail data. + - name: msg + type: keyword + description: Detail msg. diff --git a/packages/azure_frontdoor/data_stream/waf/manifest.yml b/packages/azure_frontdoor/data_stream/waf/manifest.yml new file mode 100644 index 00000000000..479a6309d8e --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/manifest.yml @@ -0,0 +1,65 @@ +title: "FrontDoor WAF" +type: logs +streams: + - input: logfile + title: Azure Frontdoor WAF logs + description: Collect frontdoor waf logs + vars: + - name: paths + type: text + title: Paths + multi: true + default: + - /var/log/*.log + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - azure-frontdoor-waf + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: "azure-eventhub" + template_path: "azure-eventhub.yml.hbs" + title: "Azure Frontdoor WAF logs" + description: "Collect Azure frontdoor waf logs using azure-eventhub input" + vars: + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - azure-frontdoor-waf + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. " diff --git a/packages/azure_frontdoor/data_stream/waf/sample_event.json b/packages/azure_frontdoor/data_stream/waf/sample_event.json new file mode 100644 index 00000000000..5d7d94fafe6 --- /dev/null +++ b/packages/azure_frontdoor/data_stream/waf/sample_event.json @@ -0,0 +1,126 @@ +{ + "@timestamp": "2021-12-27T15:00:06.633Z", + "agent": { + "ephemeral_id": "4e3dcda0-ff10-4d61-b8d3-d8ad468c59ec", + "hostname": "docker-fleet-agent", + "id": "4da1e81c-6b6e-441c-b06e-8075f54ea45a", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "7.16.0" + }, + "azure": { + "frontdoor": { + "category": "FrontdoorWebApplicationFirewallLog", + "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=", + "waf": { + "details": {}, + "policy": "waf2", + "policy_mode": "detection" + } + } + }, + "client": { + "address": "8.38.147.74", + "ip": "8.38.147.74", + "port": 56094 + }, + "cloud": { + "account": { + "id": "k-researach-lab" + }, + "availability_zone": "asia-southeast1-b", + "instance": { + "id": "7627326072194210872", + "name": "elmuu" + }, + "machine": { + "type": "e2-standard-2" + }, + "project": { + "id": "k-researach-lab" + }, + "provider": "azure", + "service": { + "name": "GCE" + } + }, + "data_stream": { + "dataset": "azure_frontdoor.waf", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "1.12.0" + }, + "elastic_agent": { + "id": "4da1e81c-6b6e-441c-b06e-8075f54ea45a", + "snapshot": true, + "version": "7.16.0" + }, + "event": { + "action": "Log", + "agent_id_status": "verified", + "dataset": "azure_frontdoor.waf", + "ingested": "2021-12-30T06:02:58Z", + "original": "{\"category\":\"FrontdoorWebApplicationFirewallLog\",\"operationName\":\"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write\",\"properties\":{\"action\":\"Log\",\"clientIP\":\"8.38.147.74\",\"clientPort\":\"56094\",\"details\":{\"matches\":[]},\"host\":\"connect.mitcloud.com\",\"policy\":\"waf2\",\"policyMode\":\"detection\",\"requestUri\":\"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1\",\"ruleName\":\"AllowMyanmar\",\"socketIP\":\"8.38.147.74\",\"trackingReference\":\"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-27T15:00:06.6330668Z\"}", + "timezone": "+00:00" + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "1fe40eba24f3f02b88864749eb7679a3", + "ip": [ + "192.168.208.5" + ], + "mac": [ + "02:42:c0:a8:d0:05" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "Core", + "family": "redhat", + "kernel": "5.11.0-1022-gcp", + "name": "CentOS Linux", + "platform": "centos", + "type": "linux", + "version": "7 (Core)" + } + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/fdwaf.log" + }, + "offset": 0 + }, + "rule": { + "name": "AllowMyanmar" + }, + "source": { + "as": { + "number": 13335, + "organization": { + "name": "Cloudflare, Inc." + } + }, + "geo": { + "city_name": "Singapore", + "continent_name": "Asia", + "country_iso_code": "SG", + "country_name": "Singapore", + "location": { + "lat": 1.2929, + "lon": 103.8547 + } + } + }, + "url": { + "domain": "connect.mitcloud.com", + "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" + } +} \ No newline at end of file diff --git a/packages/azure_frontdoor/docs/README.md b/packages/azure_frontdoor/docs/README.md new file mode 100644 index 00000000000..87556902c17 --- /dev/null +++ b/packages/azure_frontdoor/docs/README.md @@ -0,0 +1,287 @@ +# Azure Logs Integration + +The azure frontdoor logs integration retrieves different types of log data from AFD. +Azure Front Door provides different logging to help you track, monitor, and debug your Front Door. + +- Access logs have detailed information about every request that AFD receives and help you analyze and monitor access patterns, and debug issues. +- Activity logs provide visibility into the operations done on Azure resources. +- Health Probe logs provides the logs for every failed probe to your origin. +- Web Application Firewall (WAF) logs provide detailed information of requests that gets logged through either detection or prevention mode of an Azure Front Door endpoint. A custom domain that gets configured with WAF can also be viewed through these logs. + +The package contains the following data streams: + +- access log +- waf logs + +### Credentials + +`eventhub` : +_string_ +Is the fully managed, real-time data ingestion service. + +`consumer_group` : +_string_ +The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. +Default value: `$Default` + +`connection_string` : +_string_ +The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string. + +A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages. + +`storage_account` : +_string_ +The name of the storage account the state/offsets will be stored and updated. + +`storage_account_key` : +_string_ +The storage account key, this key will be used to authorize access to data in your storage account. + +`resource_manager_endpoint` : +_string_ +Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. +Ex: +https://management.chinacloudapi.cn/ for azure ChinaCloud +https://management.microsoftazure.de/ for azure GermanCloud +https://management.azure.com/ for azure PublicCloud +https://management.usgovcloudapi.net/ for azure USGovernmentCloud +Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints. + +## Acceess Logs + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| azure.frontdoor.access.backend_hostname | The host name in the request from client. If you enable custom domains and have wildcard domain (\*.contoso.com), hostname is a.contoso.com. if you use Azure Front Door domain (contoso.azurefd.net), hostname is contoso.azurefd.net. | keyword | +| azure.frontdoor.access.cache_status | Provides the status code of how the request gets handled by the CDN service when it comes to caching. | keyword | +| azure.frontdoor.access.error_info | This field provides detailed info of the error token for each response. | keyword | +| azure.frontdoor.access.is_received_from_client | Boolean value. | boolean | +| azure.frontdoor.access.pop | The edge pop, which responded to the user request. | keyword | +| azure.frontdoor.access.routing_rule_name | The name of the route that the request matched. | keyword | +| azure.frontdoor.access.rules_engine_match_names | The names of the rules that were processed. | keyword | +| azure.frontdoor.access.time | The date and time when the AFD edge delivered requested contents to client (in UTC). | keyword | +| azure.frontdoor.access.time_taken | The length of time from the time AFD edge server receives a client's request to the time that AFD sends the last byte of response to client, in milliseconds. This field doesn't take into account network latency and TCP buffering. | keyword | +| azure.frontdoor.access.time_to_first_byte | The length of time in milliseconds from AFD receives the request to the time the first byte gets sent to client, as measured on Azure Front Door. This property doesn't measure the client data. | keyword | +| azure.frontdoor.category | Azue frontdoor category name. | keyword | +| azure.frontdoor.operation_name | Azure operation name. | keyword | +| azure.frontdoor.resource_id | Azure Resource ID. | keyword | +| azure.frontdoor.tracking_reference | The unique reference string that identifies a request served by AFD, also sent as X-Azure-Ref header to the client. Required for searching details in the access logs for a specific request. | keyword | +| client.address | Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | +| client.port | Port of the client. | long | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host, resource, or service is located. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.id | Unique ID to describe the event. | keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | +| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| geo.city_name | City name. | keyword | +| geo.continent_name | Name of the continent. | keyword | +| geo.country_iso_code | Country ISO code. | keyword | +| geo.country_name | Country name. | keyword | +| geo.location | Longitude and latitude. | geo_point | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| http.request.bytes | Total size in bytes of the request (body and headers). | long | +| http.request.method | HTTP request method. Prior to ECS 1.6.0 the following guidance was provided: "The field value must be normalized to lowercase for querying." As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 | keyword | +| http.response.bytes | Total size in bytes of the response (body and headers). | long | +| http.response.status_code | HTTP response status code. | long | +| http.version | HTTP version. | keyword | +| input.type | Input type. | keyword | +| log.file.path | Log file path. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| log.offset | Log offset. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.protocol | L7 Network protocol name. ex. http, lumberjack, transport protocol. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| tls.version | Numeric part of the version parsed from the original string. | keyword | +| tls.version_protocol | Normalized lowercase protocol name parsed from original string. | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user_agent.device.name | Name of the device. | keyword | +| user_agent.name | Name of the user agent. | keyword | +| user_agent.original | Unparsed user_agent string. | keyword | +| user_agent.os.full | Operating system name, including the version or code name. | keyword | +| user_agent.os.name | Operating system name, without the version. | keyword | +| user_agent.os.version | Operating system version as a raw string. | keyword | +| user_agent.version | Version of the user agent. | keyword | + + +## WAF Logs + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| azure.frontdoor.category | Azue frontdoor category name. | keyword | +| azure.frontdoor.operation_name | Azure operation name. | keyword | +| azure.frontdoor.resource_id | Azure Resource ID. | keyword | +| azure.frontdoor.tracking_reference | The unique reference string that identifies a request served by AFD, also sent as X-Azure-Ref header to the client. Required for searching details in the access logs for a specific request. | keyword | +| azure.frontdoor.waf.details.data | Detail data. | keyword | +| azure.frontdoor.waf.details.msg | Detail msg. | keyword | +| azure.frontdoor.waf.policy | WAF policy name. | keyword | +| azure.frontdoor.waf.policy_mode | WAF policy mode. | keyword | +| azure.frontdoor.waf.time | The date and time when the AFD edge delivered requested contents to client (in UTC). | keyword | +| client.address | Some event client addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | +| client.port | Port of the client. | long | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host, resource, or service is located. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.id | Unique ID to describe the event. | keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | +| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| geo.city_name | City name. | keyword | +| geo.continent_name | Name of the continent. | keyword | +| geo.country_iso_code | Country ISO code. | keyword | +| geo.country_name | Country name. | keyword | +| geo.location | Longitude and latitude. | geo_point | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Input type. | keyword | +| log.file.path | Log file path. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| log.offset | Log offset. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.protocol | L7 Network protocol name. ex. http, lumberjack, transport protocol. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | diff --git a/packages/azure_frontdoor/img/azure-frontdoor-overview.png b/packages/azure_frontdoor/img/azure-frontdoor-overview.png new file mode 100644 index 0000000000000000000000000000000000000000..23463adb217449f55502e19f773756da48236887 GIT binary patch literal 284058 zcmbTeby!qg+crKl0+P}xDBS`>BT_2e9fC-A4PDZWgmg(scXxx7bPPjx3_bM6t={kF z^Ss|5zvH)$gV{68UVFv9)^(ldy3REr3UX3U(MZq$0Kn6CZ^e}W02Chp03j3=`SCw) z&azdHCpZTssW*Vq5we}f4~QnBvZ4S$MHKq&2c*Z(Pi)_6IsgEeUH|;S_1P4B1OOg# z--(N=fb{mkC?2F6U=(PEmFrQ96j|Tg$kLO~EhgwJx$bqZwHsY`0P}Cmc0Sj>Mv1F* zK_w2~Kj0m*Yrb4kPWU*m*0MFukU(xTRQv6=^@_f6t6@vd#bn1Z>i$wNYADrJ`uer_ zuOnw$3{p@-R|L;fU{+Bnc`+j4Ns)*{Na7m7YJc%rFFyF6V>`P8z>f3JG5$5FNInO} zFCV?gfeZYJ7G{oli-vKJ`|HbyKsW>He~xUss=C+gF%E{yiNDI5-s()5{Q8EPD0;=&QfV7Ud>9^z>9YKlm-t&a3CbKthj%Ztq=_h+l<*dm~wVLVmrqWM<^V)mzfD zq?Y+O+=GPN0$1ZyV;+cv(EO_p>mKVuC80?$GoL^8Q9zGKr{Kf9mx`)tk;Cum zS*@#LaTPnM2*;6Nb5y_jVM6EEW;1*pp3He8J}_j23Ge;Einmk~JD3kgk5gB{rX6L@ z3U)M(oJ4_MH&$K{G`aHu33juFb(y`mM|g8q#!En=-yM?u)r0`l}OM6Mp`FWApqiE|<7`@LoK> z#;89j#5$vmsFKWVNzpt~6X+IQTBf2b7KVP&K9P|WkTT(ib9jUaR42T`p4f}MvmHnU zkTFeVgU51MIRw?uUB#)}8@FvyHo5C*1|I;oEhwcR*M4n{7Ps7Fk`y0+_m2z_dD#eg zuMsn+(BBpEAt54C@$ev%L`V)-u&u0ouqXXJUcqDo@#;E(5aDao!=|ki5Y(4)VCT4( z52dP@iH8=MwbTf$O>fzy?xlffbzO2}^jEsU@Sd-=RA%?o&+<%ddETOw9lqhN(^pX- z+#Jm)$_u2`x()495WnA5Wm*@zZT~RrmTnqi`C$NW$!n_xPFF!Yfw-CV*K^5ET0S_4 zU}A-M+~ZJE=8q81uS%d-NEUj89@?|D?JIo_3@mWywVCKW*Qo9nJdCcvA4)Vl%}pu) zG|c#oMeoH>aAl5Wopl7py`+Q$^&3~(-&Sk?j2d=RNB0n12l2!@I5;RME{>geaKF#M z!-Nm3|E4kXMP4W(cPL?5$SR#bKZ6LR-sZEYt3=%>4U#vDII*HLSB^8>T?m^up7%*T zybWzhXNLmi;&K)GIGpURP8In^-Ku{t7b4N_*etJYI_iAu{rtluL7T&I4y6ZHS@Q+* zs-aQ&r*lT)=9Z5W$a5sTtgHlB_mHTVloUFI#-ojqRO( z6>y2fcuPl1OU20v{~;?2sx;{8=9aBJhgq>0x-k?T%SqbO(qd|66~9MEg4X2o>p5g6 zopn)q5Vm>1fUwoAqh5g{YY90$;Z}zu;OLgs!o9DS{r=(gB)NV60=I?QAiqcF?Hp`j z2g_i8Pc*L;8EfW{!s!;0p+ip7$A;m zuKSnvTZyc)U#=u`jy(Vxh-MQLuhzv7tt5uPi>ZQ(UJER+!I@T1uXI#EnA2kZ?Q_H?1`{KU0Ld2hKq;@g-17+rP}J8wUJ!K8!vRC|$vwsz3^x~8c)Nn>Z; z#GY|EH;WaApy1-l$_|4~DGMWGU{n-vk=weU_NI3_Hh6Va=^1`v|8$!~K+nmX?Bnw(o8xORwKVr@Y7$6J(O$m}3GDn69EQKik^=j; z9$KNeq0;Y-F_b4=B-WI14Ds#yk8y=SRtv|zmZ(hA87V1Ic&>B2c|{5o@uqt_O467| z`7_=9$6hS<-?i+D%W=RhE%b#)?Zv_Oda?cH2M^Cv)MY%o;T)22 zjdyDI zZf+1R`(ueDuvi&o=S=dkV|lNwh9aGAb%49bg@lAS+sewYz+f<^Dbq z*KDWKl#~=1bnyG6&TQ)DIwyfhGTB7e>>~4Vd`A$7H=Op%k0D+=w3fk>Y*pLN%+ex> zAtO6NdmDMS`T6;H6a@EQ?q1yS7@K1x%H<$t)Gyd7)a`~)*c*6wcL9{zzi@p~l159$ zWZHh*DQQZ}o(CE5J{L;38&0{Vxn=VSC`483Rs zB|H)anurk+W9p9REVWYAuMfA!1~ZQzBLFsz@HOx6fe{yf)x+tr-*V|8cJY>(!cc2H zWak*yPHvn??M#L_*aYVmpC!D76w?#Z z0_n7&xFf&6uM-)1T?So75Q$|8r1adsti&(xS&OG2sDrt0I6CAhRQiC+)o z-#>49jW>~TcdI@!O7qLmlK(*##)LooLjdKbS4>*-ORjwfm2ciUau6R@{R#Hu;)^FX z^7l9yH>)!rp=#J2kO!d$`6QDk>yh!>cd*%GjK#|X8>&0l6Jl`!7QY@bnJ8|(tALu7 z`iIc_r8dcveBGLVpa?g2H3yQ91mKd*VzUdImtDzIS4^N({+1xz4M>D3Lgim2h6DFe zdS=8A^%~8v#n93K=PXUcJN*Y9i_e;&(ebUfejJNGOE(Q;>p<4q`dZ|yB}%Gp zW19Pm?i&QH{ok-txA^b6#D77aBWr0Q9#m$(HW9CUvUnCrZWE9ZCIICTg5{NY!S(rh zE`uk+0`Sj4=OSzce_&p}pD1f~*73jN&N)tg#*GfoLDwmr*YmZF@?%}Z{6SR>2g)B% zYU=3a<%NocCHC%JVX~MwLDi?1|5LVy2=E&@R90*k(1Tpv;XI42aniO{;r*9CA9z$<>-KiDYfjJ zeC=W4eu%99s6@|-jRQd;U)P?Zb8%zWXSai~y-E}cYgP^Hoq*OQy=VCGnd+{2g&Uij zfsgp}Ga^bySC`oEui*Hn`PpH^A&hDK8>wpD*9FR-CYIne5WOGtRQWBT>e#2haMuOJ zEq=Jr=5|x>@KePY9CKFL-1Kyc>gww3+#1>8=l_nwKWBTd2?_uKi+7(nv+;ot%wl|Y zE`q=l3mySsc~5{HOssNUf*D_q#6yKlODw=#fw`x^P zBbm3AtsP3?SDYX7EugabCXU?hH0D+^Rkw$;zV-wwqDXKyemL!IBvgGXGHpAuu~;#z zn_Z;7K@aA()#P`$BdTb(gQP1;ih;bp;Eif#7KV*O5t*E3z0T#r@_4v?WWyZ=e;wxI419{;9%R&pAmu3i3U_~eP<}GSOSAmm_n1!V0W?uv$0d3%Zfw9zdcN1m0i7&Z1E8C zmIuPz>Q`NW!<{sg32U#0Xv$yos4df$`Nq&ysUTHE5$_OQ3lSvcCZn;* zMF+o1Obi|VZYpZ$ z8I(Gc1^nRRTq6_4`9|6#F?FVhc@{juv{l2j(e0Qr5=>&8{x%V4RzcVFX*T%osx*_E zL>zM*zj|Qusk*wlxRgY8Lj&=Gi%0NJrBg5hHSgkhR)Ac-|G25jMV35+&6}vor_|ut z*%uiSW3vX^u|udmJ-N`cGx0Yb%!^>KF}qqEzHxVzhMwR@FXbwX_msRK#GaR%fSP_L z1_m)z)d*%2O||X)eU;j(joaE_*2J~7wYZs6Udlylo1^w1%0tQe6QHmIEqcHpq@if2 zxfw*TvAavM-q`Kd?Hue=_SHnQ3{_A{^7GJ4-F}8Kgk_XkUQj+x&!!!nt*s>QZ_guH z=cNX?_pspfvU7r85?%83&vI>A2yf6%GPu8!1R=lG2D2{dG&naX}vy!`-aHKYR)aeIeu?x zb`82UD=X}7xC%OwNI>=ShjeZK-IUbk0S=tyF@N2yfVQyxuHy-J+l3q4(htkH1*QwJ z{ZVl(Y!k*k@0}`#<6GUrdLb5>!wjnFkD8Zd!puRUb9o{MMV&4XhS&usIX+4Ms2)e$ z4#@CnP6aR@*`-99qVi?ADf4xj1;HxH3|m46qza#<{<2L9`r}ZCSfAPA=b&Wng1q{& z=F8FPMGB>Y2^zNx{fC}`FD8MW#TuMqJog8O5EZYQL1XH&;?#G;gGNUcQ!g#lgd<{ zAKou&A>O#Iel*JoAGG1q#FUR9#oU+~0#u?B)$PiR)iEfC1aF~TNqNxaU_2kJ zqJu-&kW?Yt%66oo9&s?!(eM934G{&)^b;4wXnv3~a--J9BEsqwm2NPq_M_|9_ z;C(}r1+*im35S3pFsCn)hH8w`WHjABKL}-neu(7kk#$UGH#L#M!QJf(r9Rj~>OMl_ST9yUwM{Lb%#&q({09~Y#{({NXX^E_Q zH*0o1K}EK@530=~t+lKq+N0b?4(~I6kQUh*r-+AdG#x!#vo#ao`GFP(x6f7_+O1mH z!CTn8)VmItv)4onL{GsOBXO?~W&ohmctY*Gm?)Z_KgloRUn#Vc(234(+^oR4aRfJG z^QDpP=8_4xG>lMffYQGITouW9FA;N+e4s0I!Y$m!iJSNWW%YBVuAzHLRKV;~3q?M}wV;nqeN<`d;^uP6V}GbbLh>CAK@ZB>K{%(!WpaQ95n=c$a*3rA z%W7zL(5f_{IF0Z}dzN&G{qgzwUH}2kN81Sj+@nv9QBz z5nk<(T>^49w`<#hMfy2T4dx~)9#oDFny4evO^YQFoH%?IuOMppa=r%F*`~`(j34GT zT63MMj-)O2JxcW$yCeL}%!m~gZKVa2=2k$0*sq z0x@CP-X@CC!VJOS>w=~fJ};x~L(*Ca%lZrfFIQRW$at4!-%IJNgI(XCUWv%)K&akWx|$iHKhryH9uP4(i$4*4W1;-P(<;UDAr!zK~us$ zvY(gykZd4N2&!bL+$cfSxN$%4JLt-AMSZU1M4`{{`%}#O!{O2nlj%{lEle&TKXzN21-F;o z0w>I^afmlJ_{g=vg7&PAr0fxVx7|;%g~Ps<%aKDb)RwQ*eF9E@9MO_ugW20`GqFY7 zPZ5=};fgg~ zs8F>fk2@9@3CLph%LN^)53e45{TE|F|{Np9#INRUoDM@(R{qrg9K5xs0POb0g=H_H3Yn zzDuzzM*AEIdF!4Ja2 zNS*zKD&f9ogwx~h9RBu$O}wS9fJR(fkY#SOysIwdEa-bdiRIVK^jF&lRC=(WAvucQ5$l6y1*YmGoiP zThZ+uF7Ks&aPZ&MDCRWTQcy8`;^rjA@OI@@QH=Tok0I2Bwm6u4R_ypILVGQ)tpOds zTj1d}h}|3bbRMYtxOBZq4`(ob?qC=lw7;tno+LdX<|vxR-`6Vq`L9_k&gDr79SbK$7%v{!t24xD3?Y8))t#{Zq?`9leHQ_0NU&V_tEX3hM|fF5lqZzzdGs8OOwiSC=7 zQ%9_+4Yx7Rf$r_;2#-_iqB{-;3y0 z>{l(H{8|6~_n*}E@T^Yf5uT3=ZrEaQ+JOk0<^Oe~i{YN0joT`aDHln7wTt6Lh>wkp zOndZm}v zyPKij+Z#0}8#xODit{!Gin27()m_W;gkhw(+c|Q7cP&ERAw@1NIW>Jr_>3V6iY>z3 zC(|vXqeJ}ad8N9LPz$^BWxE0Ub9#eilkFyLCa9xZPO`loM29@EZIO!|b)PY(-TaHe z_(7HFl>j*%=ikHPPPIxcsT`HOOLs!_csG4(>r&{2V`2#m#r;^OihpCV_;LdG(n(QH z4}qVhpxDa4EUM{|f;OiF{DrA#2h~`70_4)3*eUv&4~BE#QTG{ep1*!YkGg+crMw$= z`s&^-iQl+aG3Gz)uKz@oOC)P1*U!$*mhZ@$qV1^hY+9QT_*?^aQ;#hyEc%*`ybJ!OQQL-NYN}Xs zsl#JFRovvST?Ek37-OF2;p;v~nF^02MU1(jeeV=fb-l$#$X(6J^E_`)Co;WZOQo&k1ETC)sDi8i&KdHChhgVD_mJJz z0g#H10gk1_3UpP&0y~nn$;z%I*}$K&zs{Xml2BGg$0Q$U_tpcEn~ZL(F0ZVC?t6e0 zR$JDOW5Bp!0o_f}KE6muV^5aZEyDi4h8k1F$U7hIcZl44r%2lD*Hm$EZax`+Or2ee z8%1s-rEUERQ?8f;0-zpa(z?6%@{aHbHd{dUwy1Dg;MHQ|IcQ&U*sY!nFMbdTE)%Lo z;tc(Ag^>&wVL0GL{4K4|PB9AAS2UbM6b;UC5Rpscgdz(IiSmZuWbl zaJ#Hjy_jL@mG;E`=8DbhDw?0A#-eGN!!&cf%UEm9sUuWFzgYh43l@i!(CDgoyqq&} z3;m#Wp1#mTc?pvT!0^)Qw4bNjZi3YnGER~z7NXBWG7 z@KS75^#ps!INeWM)Lfb#%kvG~K73H+{eVs?}()v}xFgjuO|)Frxw zZQ~49n85erC^7Qa!IYasL(o|Pd|pr^&btLx+W66sxygelNhQrb#W0 zB*j7*;n>=_D3#TU!!V;VBHzN%R8_doAM7A2IGrD`+T_qOmaHG4Ih2i)p&Fu};n0`Q zgY;;WPc_;q2)(b2o@4`iUOSv%ltSP4w%ut%{XI)i^>IUr_H--UYDjC3N;})a!VAui z`z}`_W}yqX-8P|}3qhol>ZIUNwz^cNAH7rX8nC&b_!H}d6%V&}!5##@`p4MJt~BF& zPi-9>x=aq6krH()F&{m^06|A-DJ%5&qOMFeY#s^L( zv7GV#^I(JWpr$5%{j*Cjoqx|?kZApur{uh|1EIzz2wiI-V%xk_LbM9!oWupOz&J0= zR1{WNtw0RJ$KnvG;PAVPcI3`TpjZos?_Rek=` z8sievh=Zf)`m;6XA2*I9hi%;09ogKi7VNA|o;mV%8TW^4)j9ZqcW73o6l<0U5(=rKrmJ$T2KFq>4W+I#;U5QSBWh z6vU~l-|qIr2o{Zgl_)!b+6E-n0j=L2t6$WR2Ppa*sy+waMfGXaClevep_BP|$D7{1u226qVLp+7c9# zZuck(Ihj8o=XK?mM)qW(rs*78D(wlPJWAAkozi%-^?xG(&UjBJLSfh!sBs(ZZ3E*o zeN3|+u_i6(Y?Umk25#<;qYf#`tyN0x&}a_v@K21v8Ur)xQvH41er;%L9L={GjEbWACRZn_TfzTfo`Rw!C#T26G74#fv9Hgv4Qoh0KS|C7zEN5L6X*YuX7cjDu zzs0_IB0ob2hyN5OT+vbcX6CUKuZ+*DDVP*?ZEmfIRmBKhjxa5gK~hQK{)$FGw_7l0amjPb23BGt?|*E6re;P76*fMen*s-RLseeiPXc zCtFV>E9ALbt)jVrtWUXTjZCF|8(NAU$oaE*{4*lvcpv=VgHFU%w=-F&NJL^=JB$)W zGpx&jm8)#>Mn@$xnUj?D6Q>HhI#;?oOVzuPlwee?R`U%`g; zM3|i|B->doSIoJKC#nzLk?A>6T7UP%m0uNJOms%mu9GklT8h4^S_0wLZwWJhhxnD$ z)GgBT%EKZ_Ih_^5VJLl%(E|cS{Q~JxvlhyaX{x#t!B$<5Hm&v@5|d91suzYjE3cq?@?$+aX0{i#Gq7RCfU4KKekky$1wGH92Y}a{N3A1eD(7y`0Ndv%tYk2>jJ}evB%|a zftlijWS`nMakYgL&N;-nJzr+?VTyE&YT4@SG_70Xlp2eFhP*v_6CyZK| za^v>3CiAQza(8TDcbqb^ks~!15f1FD^qCiCKN;(U8XSvM&81aHqB$7l`CJPUo?ZrGQ4+R=v71_ z6K<>~&Pnd`f#Lj1(WM3*cf;TB&swxIY0DYOOQXoy2>IFwI>EOIs-SRftjV*b_sZ+B zs0{r*5ynjep8~Y^nasP&gc%bb5nkMD?;~^yf7P~A`lSi@29rnz2AcO#6rZP?5RQae znnX}dnY&kLv|tu>%LCvo2e<=k!7DwK+Z2~&+uY=Q)9Y{St{dQP_O{ENU>Iv+S1f$ zBUh4UD&y@p55zYd2KiHBju&6ipI@|xw`2P+PN; zLw8(x;zECSlry{V(D!8_vFw(6ltTStoXhl~y8_n+u%RK8v#&objb)g>gym(gxM#$C zp{p51Y75%|Dlk4sN`fW@gSMiu_*s!gm&-H_rpn5$(OAY@IersE$Y^I4F5|3%v_ZrDV|11qJW zo8U#W8<~i3UY`RSWuFl-i+SnX&YByuZcOM9yuikN`hESAD&ZEiQ4gMHLtO8D{m`08 zVtfb>WxI40)$$YPVqi+az}APIXNc#HIo~FJo_dg#YUgw~0hxP@BVK~!@B;eUqQh%k z<7bVwdt;UWf~Cx2e~}MyqgR%IdR3c9_E3Vh#1|=)33lErr@c81^OR<%xaIa&oJrFO zmV1cm%oR;GP_zG^Dp`uMc*OwAYAHdW8C%cZwukEsQ0hb&O0dl}x2 z8P{7{JrmTjh)JwLu*tJnS()Io1-~!+_Hrni-yJhHRtcMYJBoE^6FAf9a1Yymb$*4o;+-koIWSnF?;p?|TtHwqDb6 z3QXF`Yo{2clA44vXZo#hwT@hpZ^@D6LY(PeCH}u9zXYjc7JY@LPZWC&H2xeaK--9KmdN-}*7EA+bDzd+YfapMh*-v*3M=Z`LR6?hoz= zHr9CLJtX6^t0CWPMI8Ivb41=0IWOC)q9-rnVsDNY#+7Fa1+{2;eH9=zorF*Kk|Yz3 zV=~g+6t_PWTEhzoB1%aVYUY!kn+x+8tqZ;~NGVJ5%-WHmdY%pG6SM#r@8QkHn)Z zxh`@Y&m1vFh3;RZFPMPo$|_sY^^A!8Yo{1r6hQsGM@9D;P&-1uy=lH3k)Cx^nCr_F zy~!sl8tbw#*mJPy^gey#q)D~6A+l^+b%g0B<9fzvqe8)n=*U(M zcdYwXvK@=qB`3f-uPDvMQnQ`83qfSBQt9o zyDrP?|L{GVhFs?w*M==VsDL9T^F*V2WH&Q~>7OtC+Y$_*ZwDFoqMuO~=Fz@(N3&^l zQ>YE^N!5l%NaKCvk&W2(ls7DT)N`Sc3VWgu474VZtBi6qU+HlPyQVx{dL?%)%v@3+ zX1Mr5IOFdsKPF0I0OWhWJ)&PO;ftW-INluDZ3p`Qi2_@5C1y zv)cj&3)#BNU=&=UZ6UO0pDzmV#Kh|wH0v=4|f8JiV9Fu z_Uei+e}kl$S47{JEDF~KIeb_;Adh0kM`=z$jG>y}?@UQQM+kpO!9pm1X~AA-W*Mk_ zN&0u2M+|IRW^j-2b$Y6t02E4Oh_V?FnZaiqr3(tsy zLv9_%RC6p7c@S~#jWik?u!H0_vW8r6y-|KOG&?N1o~E%%nXah|7ypCe(K)foQOT$v zXZaytf?K-Q%&^tPn>U}!8V(nyBJY|=qXpRv_s_)@Aw|2s>c)ACfq@jchh#5yN5m#W z`cxmDov)zPTW}s<@a~Qu1klCAEMSyvqrwJ-yCi|@N5}}f6}t2yu4L!wUy3Kb@5S|r zm2Am(*L!Ulc&7fE3;U@Bm%EN`^$iV$x}w@naNva^K{vOLq83OChrN+X+|M1kGn*?# z3quDHchS+um*yg!W5!EVcE#rfmB)P!M4Cx$)B#Qlt>Nwv8wG+LwuL2zLHf~n{5#i! zrv)~=ZSd9PUeCPwikayUyFb{;_*90nI&!OLHfy?;GKh;-x$^MGHxJ$$`@Y!+m15(J z!wotLIN$Af37(|P#Jv0zVr5N;rKs0j>dIGf2)Dpt;Eg{l1x?Jq$dr{GJf~k!V!P*G9Fy+-t0S6v+8XoKjPD#j2f) zIgqOrHciv-9MXUU?-OTP_PRoU&e(0$R`H%iN!ckBu5F6kyc6`ART3qu*VWC&)Xtft z?5VC4+SuhsF4o7Mc)C@-rd*a|@LI^tmiXn7hw-xl?}s7Su6Drtb60dPXxF8JjV@3v zZ*=C;*t605p}V!sv$XA=iQ(ql!wi5c?$msRaC`pX6)L4CVv-J2@?30;6si|yjhrHI zA`j&t$J$$C@w*6k%4>0zW(2)PncCTKHeJ=Er2A!hO?100)YDA6?S2cRUKgi9-PHw% zq_VWI>+61E0`9(hztHX@L)q%sZ6!vz3~%Dza!0|FN*sn8YlXnL@#C{dG_Vr~c+jlj%tARZ1H7JG>U=L|+cRUnDaUfqYe8AK)+t}R zmx{sL@GB7!h+L0w1+8arzuk5t9eu{!iGSJ+9_Hq)%^_#9(ME+Nv%tV1(onF3wr%H) z+_zo%Rm*7t!IO_qc}n}c-BfbqTY(?cZ>peMof^{3U2wvW`+rx_sV*_#)X4P*~4v`EQm`n~sG zN85pSW~rx*NGo)0)KQwFA&K#8*JhusuLPHP0;twv9y;ph2+O=n9$qd#HNDDPl$Kp@NA-PbyIX>SWy&b{x`xHYeI+wpygY0tRrZQuL0HP`?T z+hQw+mw~R!0n02Asn6z@_ux4Zq$5G~(3&v0Rl2Rc{PAs%>r+rJ8)8qCP{7616W&Y6 zE9h5-EKR$+^D0D5|TQ6l{NF4_LmV zrN=Ug#%7`D8zs~?77sx^m65`fdN&XLci>4C>MR$y+*e5r= z(xC4tSpJWt_r3gjG#=SLDberNZ!bvEjVF<{?RFK!E40U`ay!2ZN)=fe8oQlgGfJd| z-&k#3YS~G;q%epZF^LKYuC~VOs~W$jt?yq>rS2a84I}TqR*d- ziyI4R^*A~RF$%W$1f*0Puj@6(E(Hv!*JUl+3Jjjg0iGQDC^EQQvD909sMjz=w0jG7 zq$|~^##CQwzziF$$;w$zZSLYLdJcFZj9jDBc72xC|Mr3I{$!I+@b35>;jI!Qiqq90@=bv2E7qFxHm0<0z*8@U_!Z|&_W{v23^$DU zDSpRLE;5ewn1)u1!#i_vgxwbN7R#QR`g^rV`~Y~#sY6h@nl;(H8;Y;$fKUz(jZL_ zjEU^|3yk!`o%Ml+jQ~wrer=oKSxlW}f*yE>w?E`71lCDB3U9GM>oFqB`|?NKbT&G{ zb>6l>iaDikal5a3r&&y+(o57{ z>6vJF2->r*6mG3Eh;dc?jkl5!aR9ZGo;Or^QtU3lZgVSyP?-F^Pw^D`Fr0L5sr!to zz_1gT?G6`7S1n$wr~P`T-SzzeHbVxlpSrVJfmzsG{pzVmJE4tcwqbj>~Z6I@lyJ@XmZkXXtPQAlxa$W#ws~4S|$ECT)d53rQD$gFj z8R@P=Jih?^O3hfR1GGkeHAp_aJ1|bsT7wlFQs+t0=U!&jv-AKCi^573@A$a8ruSY~ zr!dMrof1QH?oeB~{4PX))kR>Om%Gy|LY^M>Oy1K~S;!*=U9DG;w zhFCgb-;ekejf;!0kD6@}eHjiw8|SvSo0MH=;oRYP-tT&|WP504-{-Wfmnqc(O*^P;Ro7oC3L zuwMoYepD&=7lnl-zrq}(_JzAQH{2wW9Tcu_WV~6azr=f#DrM)_5kBU$xciQSN9__T zNcGYW%_EIC9g~)KvV4cch4GxThfMvNB(HRsGSH=_z+jpT?m;i!?|K`rtduUgCb~LA z@Q`Vmn*|^DSQl7NKX1v@lbu_NHyeklUUbBW%-oh%Vac890-t8=6>efcoE+`2x1Jss zeE;s7SXY%4$F9dDm<^vOlU7UInohLgI5AYF7-QDLEfT@=>icA*WI1~C+$Ax4Xp zY?TYLBsm+Opdb`3yjxMe=faX{$$W$EZ}|pH*O9VwaP>zXC6&>thg-S?3bT_E|Nz7tk`$sg%=IQjW9Y$~D1Gu2;V+p`}C95_p&~cbFJHrNozz9XvNY9KfQI;8dfh4u5d^=dTueI@KCvF z36URhma`4qQ+(|DtjObVkUkE_DDiITG)S%<^r(2sDsCpLsMv&QKJIg&?(D)QCib14 z=7~#)H?rO(1G%S+iah>e0Tgv8+Ou^OVGL{Cl85Nggi{b_d~KMuO|+;yy5df8 zak1oX>a$1jYJYoyMqNR$vy;<+S&Y7-CX(I%Vd|^nqUhVNLApyirE38R>5x>B?nXko zyOC~0O6ib>rI+rK2I*S58>C@*$NRaT=lAj#ADEq;+5OJUxz2UYx#aE!TCNA@2oEbu zDx_3YB2{zkNUCCtpLD(3;FC3GYHHYikB))>Nnb@O!Qsow{2BKlx0tz}4sVKa*kOlt z6vvwZ8~O9jE{`gfH%Q{TUVJ-9M*jsydL zML2G4?c{5guw{$+5e?RUt8#dLs{?6m#rFYxHwtc)&dJ<>ecRH~QvG05L%^Aya^Sa8 zr`bV@dBrX(BB6H)RfLsnXD-WKs|Ip0tV#B6-Srx+I~ zP-kA+zJwvjO%$t(kf*1a<+1pAL?@I%=>t3YJ|(8h5<)GaDs# zI8kF|-3k7spvLSi_60?pZH1}CuG=%HY@eEEBBEmx_^F~*u)1XqS0fzvuDr`vtB^^V z6bG}sLPJ6X%5~Z#Q{?qpaq&I~I!(DsNCcL-wbEr)&H%qfcbuJYt$%ut-BuXYNLt-SH;pI`PuKm4(0=%*l-o*NeX8y9)Uj>3|{xe*vtjit}q?^+Qx5Z3Q>P_K&H+OqTLLS&yvt|Z*N6->|Eb;)?L=| zznyuW_k&M-}NAG8f+67ZKIj2+t@Utn8SFUMt4udjfXwuHp*J#nC( zmj=Ad+tOZ>Seo{RUoZ`$h4bV#PItri_5k(5b#d)Es_qBi?w(j%CPIuuxe!I3IOTZy zd-TkeT)=%PBgawQTJO`|n-W23>9O@6BM7&n)yJNEoKk=7*3FGN@%Bq7F2)|r8_1Tg zPfo8XsfWBjJ1XNEdR>7EPP`=gsbz4qHe_w0gTvzhtFj8RdtcQDqWb!)nv5&o^T$Q< zQyS?KsnnE|VWGz2^k{EqZSCUnRoyUQZW2rcLw<>pCE#{5MAa&dtDEnXxE;p*!@E+x zXl#PX-8m@_xT5e) z>@2AHQ3{CE*Uy$`{`w;>Q(T-P!iy)rX^MgA+1%icO3TQNM#`72mTqU)s$z3PyWJ|J zm^&@mtw~S76P2ez>$+!kyjq+9WT%UW64#+I?U})B-K)05dBoAD>F;yH9fEQv_-8k5 z)$O`Vr~R;S(?xV9W4&bz8eyL;!)Ag%;zyN5h1^zQH% zbQPi|w(8kaf8oWP2WF!(DL3VGa1aEsuI4e+iaLkcaM{cV21x0xz>nxWV**8{^~vpC zi-ISki+E|h-7WND7;lsK=UCH(lpJ)RqBhmoN*eGY=#5>7nvIek7|muJKMXF6p^Z6; zTHBS5qvdU%*8V_IUWCRta5lZ{5Q9)=e>8|I!`~@mu#E?xO212xpG*HCqD66w?xtXu z*Z}G>ESux%F3;Gj{_c7U@95?NWK-1DL)<|hWiMCS@_eeZ zsLZL8oa2&+JdRsfh&A$j>Lb}tkIi90FNr^!WU1V3WSqEqDBEif*5c1c zQ19KK=3)9tUGcjJYOlVBL88O-k~)<;ec%{vA?>-pHAXW94CiU4)YgaUEE`#fDL1-% zh?a!utgaq(mlG@!uSO*nf6v60U3gUW-G8P9L8S~f7L|@k`ezTbA$9jnkcIotG@$lM z(Ph35l-*91&$bDWf~{Y06dL&03-vlToDn3_3hN3J8=e|Y!LkY zT*>hfB+s7+wP=62Y*DKpx*iwLc^Es*Pb1#;)fWha`*@|T%8yC-Rz{I8_j;7`;F=cb zwVP&ssm&yi7BzZ=F@s-abg5?(z`U+;qn60dqU-r-MwW1_J~??_OjCK$eLOZTy zLR=c0xp_aWKMD?^K@pBWnCrVDfSLmo^?0d^#y<~JGx39sLPa02hq2lYE)<+ISZ!?K zM~FHh-I^-b!Jxon1U=WJ)W1e zpJ8nW8IzHk4ogwv8=2ixx3Y^2+LU~dH789|KEqMrI3tHfnbB&H#T`{m|E&LYY{k>j zl6n>aEYS_MX|(>fubF&(_oQU!g`h&c=h3a=$Nf*D6i{+L{B#%&E_$Z$MB)g72&xULv^bE+v`hxd#UFQ0rl~%t33dHbY6>N&|W=5YjmnTQOUp+9_q}!Zb*7IYc!q6|J^3RSLQrFI7 zaDeA)`Oe=4m4Riy!!G{Hf308%mlO57J#5CPQQO6x)b@2P#IL00&{X41G#n8OQ^O*xS+WR- z&()Iw$13(0scEfG{>ij_<67GEw_HXLlnbEZrBzen{BW>XbTnDYY%c`!w&rhd+frQ?1(LuF`e80IQf_!rHQ3#jd%cfena%iT zid`Zs*_~PS64WMNs5O}4)b8vVjt)!68jw=y`p~@)X`NZlHAt+3BR5e!v%JUN`}k-O z_ZNBa(wV|7p%1`OEs=CKgYB0uk6!Va`xrHeAeHS%JL~t7_P-812Ett+I1~t;M*_%a zdjiN+erqJ1*TJT6!jS(~N1LayC2eg8_V)H?SM@8qj@(N;X+J0sZjYKowrhV!_F?Sg z)ie{0f-2tW2`CAo)aB;ok<}&=000}D^2Q~_srBAF_LuOj27RTU?i~zXKjzMoH2^14 zJ|H(`Z!TwUgOkalN6pJKysL-OS;G|E?`?nE}k^RBdsj)3y; z`S_3F^x>j;^rzUebgzE;vkc?azvsCLoM-%QNVJ@T1NG3*Fdn&0T=w=hAq}kvWF)5XmN@&CKvQ>rMyDEPA(VgPRMn zF?NcEZZ!P;b1%fEOvW-6P_fa!U5x{<=m)>U2}M&}i5ameTy)|mHJ9jRuV~0M_V!N) z|DGtTMCS`)Avf>6Wb|epn@RUvub}v5&8Oo3m;q}7Dv&dMF$;={^B^~HmQjH77 z^zSjbRTWImRe{Flw1AikG+nshZ*xmLRrUep5JYj&vo|SnjB6G)mD$Q?T9)84iG$z6 z%4+V|mqBzY^NVn54)H>%5wf(p&xNum#yZX<+{0EYM1Bs2`Hw^CC1s!A2z33U4cDgG}Q69o;eL_3Nb z5ko&bd1|T#U3in$fDJSZ*bW!{+jq#Bq$!)43Xr1#57)Q#@?QA~t(um3ChzCcopfB)QqlcZt0fsI{J#19D;5)Viymq(kqcAPv5n zs3uZRjLT6AR1ws*o91qDS20h7`VXTGgG;9FPacX{jd zo<%W3pkVqk5AWqm`ruxytJwLwb^F^}&rMs+xC_|Lx3^|^+Hdx-fNaN}qlH>VS0?{& zsta+EajI%P1j$aZy4f#53V^|R>yJ9#su$JJA>qrE?x`s$|9E=lfQG0cvO9kHj}bCn z=6v7qH>Mdzdh4T0isWXaL35ur#{3gb-|a*0dmL~6gexhhi8!=$V#!uqP+g-+SK5%c z4n3TOE}PEhww`v>ZgH2RDXEUJ>~uVP8da9$BFFL}X#@Alm*&)xj<@U?HV)Dm0bJdF zj{|M(3BNa7m=4%BEKv2z$2oovd3>wUbJVKDv2BO#E0#T&HbJZJ?u!Hg^e&fS3UVXU zt2FxQk*zT%lK`)s_A<&NE_vgd7v39#=fJvo>TPdV)*B06 zdilx#06Jym6iWl1l+FTv-?Re$T8X%kVFv(5$HkvN`xFxM+O4Cn7Nm3^W2IMS04%y+ zcZ-dGrJZl5_|yfpli3eq#U6Mg8@Ws4>_fJap*lp2cmCxqu@p)d;>VLfG__%p&te{^$&?^VezJ+;)84dVdQYo+2X|bM0|rL4ISr4wdrj+- zfJBKgWADIVOT5fiO_6Atv7;@W8p5-1>f?kjvyF`;I{PnsJ@PFF*_tJYM7bijfe@c+ zTOBeXH=zP&dx<2~k}I`?(6*sf9YlFklRR@S9rdJ#B=3C7Pt%i=UjC$$_&VwlGNI~- zzJIOc0Wke0P~HX0$#)_`$4R%8;pI;j(cu{%c}jk050nw{ z+XDn$c)u$&mez=CFi)V>7pH8^?niGRT{)mHv;0UMqqlJOLxN9Td~Brr4%Kt#-~y={(Dek zXes--JHopEY{l}=R-?O!mp2pIL&B1a&X*UCmmmrTyQYMNo}Nek8WM18Xj`Go%3EBw z@am+7?~!$&!*PHQi+;dRSt*wahlViP5o^+iciT)<+2tK>S5+wkvDb7gEGpMS^swtZ zq{_w;A^rvlWKEeW^=T^^QI(|CfVC=2Sd?+4vc4)1L%@E3FncMZq+O(Fu~9QhzJ7Wd z4^U-8Zl8CzKBZiw1r^gpr*yJuu?q)`ic)Qs+$_q#HA2AfS6B+#b;e-9ilfJGGM6ek z8VJ-5oIrr^FYb*2_{pc*Ta{P50=GdO+SQtRF1anFx{4e~=856)Cr+f7*<;;qg%zZD-v`Qgg4IaFG?U>IM% z9|EfH$hyYwXUgr4z5X!;t)hh>aj_^)nNM{W*WcYW#0X5p*#l7YDg&B-ZFT>gSg63K{kjL3q)rvs<%% zd>mYJflkkm*76-)gB83{h&^edh3F=Oq@;c=%_TrX1LvJdmHVoz#*mPRjCGD~%wn4` zIU+Lh8~o-La3^lrX?=WAaIqNVSzy8z)JnF!XgIAQ%|BKFkbGn2lL!3#9m>${<%I<= z{~razM8n|fUQa1BwDTH03zfHGo@dM^ruiz$>M>rIJIs}Op-Bt1TbXkv^Vy#ZYS>vv zHyGEpw&;NiIU(C91YiPnx~N7!*1=^Za%0ruZ{krA1#SKG6x^xY+h$c1yrvZuxMkD! z@2!S)_2SJCiG)Wic(9;!tDPj?-9yO<`yAHzWptNCe9+n(9W#$0t~DQA;$QJv6Fmmg zuB~rJ2aP;MDCopV@yRr*-%%`l+xGc2>62HrgDJ`dw7#fV3-2=~z&s{Pk|u>R^o04~j5PAC@_@JmIH+jD>I- zB?o$>?;SS-!#~E*>ND-;Re_{+Rjp4x3xa}UHMf~`P;qTBVOonO#i}*IE|?C`kP4bZ z8_Siy%b*-9O9c{XmK!0T3}3d2AXA|Lski)+=}AHrmeqQd(*eX|+2J10m9YDJ@4FV+ zKvhn5^@B1Kc4HN#kx@1Y0|Nwrw#6%+F6ndFq=jQAtBrz!dt(<;?#K!_F8lRPhctUv zhMIf(rXQBv^Xlp(<8U$(6N@r-z0bN(TFjrc{~&58YnS`ZkvWNM{uHr@Xl~m6e7qi0 z1Qiy5JNjM1!(2JVgcD>~l*pE5OBK&6=RK0^W&Hsx0aN(kuHSU)}ETT{?}| zhEG#0Jq&HLX!9|t8qx@{I)&%o2I~38xJhpWmHh1*K1ar;n{zG-xt`rzIqz|9U{@%% z36D966Xe-ocQs!{=Hq2sO){i*WSa&s>MquyVrML-*DAi`+bB8SolZJ_x;`;S#kp|V z8?Se6qZglg1gGo#|Eq;!q0S#83gHn~OJ7(2cF*lg^$f$g<1^11q z>C!W9>lyq{=@B(~B`DM*yLYjy1C^87W##s4?3w1(F}{f74qR5pHHM>0^~%+Nt3Qqg z<=ES!`#Wpv0|BY0;YC+J@vA-EwS#>W;)ar^gaCjE9k@75Fq{v30P_dzW`Jz^Aq0fC z`^WNTi?bQ)-qVZH<7h2x&gUOaoPffavG*S9=-9F5FEe(QV0R0PVymY2UE@M9UH`Zn z(txg*2Wi7v)vkG;MF4D4U4M&NLuTV>-Yw!)LAbYHk>ZXy=9p>xzgF;=X1p83rQ0)t zBd3pxi1wG)LY}35!sqNOVLcK+F(A2|bbP!?7u>lqKk}>LZpb{^>8{`~A?;fX(xqw= ze=*Y=uwLY};NV41!>42Pk!)c-`?aBME2;nHNo9oI;$5WL*!ObI>N`xWRnmB?>Q?)* zXjba3^8y!0OuqEB+*}sUX&@}6LFPF2_8it=M)QW-nNYIDj$b4JQh{fGLbV&*AsKUV zXH~{35o1Jyu6r<}Kagi*DRot??>bvwDrlx8R3k3C-_a4164L+>>B(v{QFql(@W1Yy z-ZDE(NY2ev?0l^_E@ST;ZW=fTsHu68TQ+)>u;I1SY(@W=?%9&V?Lj<>V%FZpUpm$w zDAKunJr)Q(Z8t0S4)*(Tt~(-&cy97lhh0FEj=wR|fn=oz+86EO?QUrPuEQop03ViE zax->&tZ%|)_K$2MFWTU1YP|2n{NozTr{9&BSAo+{uj>xZ(a=T|mefSvP{7{fkzx?n zIZ?1@D@M1wAn76{C`mhFYNI2~z#(B^F1CXrM_bgSIqJrK3`kReNL~3)^=VSqIdc>}l3PWpm`723Ge<%Kli!avB#Bg!v`_`+@9Bho*o`n~MX_d&pa zl$zFGA^-(+v^paAr?(UEW!hPv^cB>#y+`&^3+AA(e+BTX*+x}F0V|Izq#@6L+c6&n zHFaV|cJXy=fVk6{o&x5QLuHqUBl(=l@Cy>J2z3iCpl#yv=ls96C?3Vt6pU;d7vgaT z;;jDNU2qp6+D@I(J2D}?+Q~T!s!H1$-2-Vj0Yil!US1D$Gy?d!_t<9qf;;hd$AqyF z+Ct zQyT+nw>?&N!^;x(AQ3n65#1=_y0vk7zf7^rD~uISwe-b3-*B|elcJop`~LfawY8<# z2~{JDAeNE=%*r-Oq3hW>Ze8wSRW$`99UqJ%_|6PN$9&Y$NhNDIeTIV8nHTWL5(QH< z)Z?_eNXPWi_y5H26;W$wYWbmSIi;nc&xB!4lShu!_Oip3>e+%~nQzj>EuRT}d)fMai z=#-@6Bv%>xpEI$DiM3kQJjwXSbTPFWi(N*2gHz{!l3TupRkjoni?lsWXZR;LUFJA| z-~J3Ij#{Fy!36AoM4m`@lAGIKauy~nL8U6Y6RtedTR9s6H=TW>lxW$0=vfIY2NXQ3 zNp8S3kyl8e1SWar2X{PJMB@f10fFv0Kfwm0xr4uo*?Oidt~bAE%+WG1>yJ`qkEIb! zQw%4zA;iq365C1qRD#R;b&D$6mfv9g#9T{euoAa&&sW(*lx0sgf{v-?(r^FC64Sr= zfb7wB^s0CgvLWna*b`72pZ9h=-Dz**_ta9j%QmRd-3qfb-Hn1g>(^TaA2^_kO{irL zr8(`sy5jTTQ8Uns?}QV#x13~F@G+ojK5cS3HjC;q zG}6<(uFjbwQ*|e0W@j#)HH92^8%Bz9TuE1uEFPvX$G>7_{!sA@%};5Vs+&hS`~%b` zd@G_uzCKDACe;19P^ziI6Brn2Kow@9s3+#3wjXpVMQ;BWlnT!JayHq`^7B|-T9_Pd zAM=2ql@R^ak3Uhwm%N{*65P`cJKh&YTGC`dTs88Ji4axsEnvCI7pA2N zxE!v+X8UG&PpBdy6yAokBkZP8um!Td5P_ZV&?KP3xlpW;PAml%N2zI?9>FLfpOhs+I7Pz_QQB304o!e_IXM^_FC>1f4uWJ05}!R-ZG@sAd|biJp88Cd7^|Y^nV+ZA(lUuDq15to&5}uylk6=w|MN*cIXLo_sGI}jU z;GyK0vS9 zBc3JusljMACObOf5+I05qN2Q}tU&PtNH)Ku7Cn3)TC!OzJ__DG<(l@@`#DTr?|Gds zLIJYuTn8++V-<cjCColW9>>47&)D!TX$PEl8vt)BlI6Qg1FA*5piZ(b6I@DJyICzKMy~EVW_6sKq zUaVNa6Z;be{#v1LfKn(&{`=XEjO~oi>eq6<;*qO{jNSA4k);g*9Px4^cJZBbu6ya2 zh{W5XpNj_*K_Q|&-+*UtTB(bqLNxZk1-awlVs68d!JYrJKrLB1u}qmDi?%o_)u))V&M7di2GGw6Mdxw65N38Ly!n)^T z>%5_~fj?1{X`UR=6vm{MR1o+XFgAJ{Xcq}M{}FI@zDyvY4hQrYwC30BKdvvXB{em% ziP*mvZBf7d@S%o1KxC61Xw|&kS#Y^{a$yV&W(ZFurS7#sY&_ZcDx5{sveD0 zhh9L|QT2J7n>|AurRh!v6&t&|yjP&E!Q)pjF_qXK64DgoQW}q6UB7n*6HYqPMYc7j zOG+4Slu0$kd+7YYxv3+wu{hn09U^%lHg38s8@(RFL3tudem zkLIZ$0gssaR)fOP#NXeCjJEbm+`DdaV;cfWrw)?to?j<54AUJ@~>LHWO@5p3O`Ym8a}_4 z)Li*eOzw}arDWs=J$sbqpOBH8N!rA9n@2jAYJd@bmP5(OT?w33j0+ILvmh@!+f{2h z4<^+51fvh`kgYHj3rfsiCnkv6d1Q4PyY;jYIa@n8bZTry6_y__X?lv=n(Z1;3ntg< zeZ}615$+sz5;+NtG^O4-4!2yD;2Qw)l6f0hoy1_RcZ$nN8DSMNKW?GWxpNgA>=@A_ zveb<6g__UoikJyg(fE={u8G0=3X^?#PFl!A{?F)90XH@O(Zz8KEX~XmOs~EoPnVSq zk*b_CeG20P61~x>sGh!SS)~*fm-Y26&*0RqY^beOL-v-Elmw!wLgVA(zZFTjs?+UJOrA4lz+YTZVijCsi zy9gdjmBr5|&ZAH_b-pepT2!zmC^zV{TyA~DiiA>uy&XX*)E9TLJ3r$2DDf=aCsN45 zwY_#Ow{}b5-kXvQF3Dgr%B#oqnLQ$%pO^uWu6E?LnDDik_9o zaZ*z?JV!@m=sgx{I<iVzR|xT!=a+F@nvKr8aKr1cqbj)qt)>!h=`1wmy?6~e|kH3#>BhD z3GcS7tSnpu(P-!kZy%p67k~ftyV>p@yo!L!%jmy>otAnYPMwm;!IIL_#6=$Q$s4QG zyNZKSt~#=Rq3e{?Y8FbOM-V2fetMn6C}o<%uW#>>0!KHW8G#`*GE5-pni6@K#3`x} zD;e&0t}6M%oGoTob^hEU8|!|gmU*ko>->$rhqcriqU!8NEM9-98!>(g{!_Sxr`q<% zx-`>g>5rV1rG%H8K{FY-p!eu+83*90QkQphMH0?mwbvdw{|q&lAH9&SOP;0WVo_B@ zDd?5ZT17VvH!NhLo#jLo*Kq@7jV;I9y2bqQ+qK3e-ShMRXo>fDl($v~+e_E_FabJCLF=8xuO@C9#ZY_DUBa+LzXc z#$Kt$KOl-c@Su$HFA zFik~h*8~GX=U^?qc~jaVjEegjP~ZYrm87{jA1!US%Fm>wfVBurR*S6BZ{`(q*enubE>t zKp_D5IX|A0bk*oHi zp8Rbui=xt%p}=<{7uX<7#Ds`N;xdLu+8pCtK2bv74=119J=8{mFt0^wa?_3-;VPiQ*Q)`E>`8~vWwfx{#zxEBS znm-0af6FkXi+i?N-#(7tsj*eRftTOdDQ+U*pIMbk4zIz>N?{*>)dTXgU`Qz%c*v)l zX#`@BhE9A)(%EK^S^TgTKS4w(Gg5)m<1x$1;9)Y5GnW&ZD}>TMXag{8KcZYDz4A3- z5dl3z>n+N}K~Ey*LoizX77_o>`0~W{kxjpyhUv|Q0gnx6LFy;3tzQG~<@ZUZ8jwRw zd=4Ypad-|e$DZ{R5MEqRb{mOnKtFJYvN_J=@k!+!yWz4y5T~J-7Hkx>ix@zy)S9gl zH%z3|PI&1$Sj;9BtQdW0adks4NI6&DenO>HHRj(4k$RR z9tP1Dj$KR|SMQq38Wjb;8bm8#FwRvxeRP3%mjjZo{vib~rR(df?)iD_8#tiF*N*9b znK<3_guk)5w!Iy?x5qq^E{uY)GoHNP7fob*eWdffYzqnTcKFT&81l##RF}72%FL8P zEJ_sZd!B{2EzLDsV>rq1CnIUW*{{7_>>Z$r9vpmM;~S$p>)n=@ZmHsKZ;eh%*8}vQ znTKNw%ggnVlhu;9WqCGD;V@|T7Je@l7LG{kZeiFRQ|=ZC1G*0^WWj$k^tVvU58Lt% zIh}4AQN^OEQPTBvw`+MO>$hLYpGJ~ffHYlXcbN3xvsKhKC&N?15(b{@i4yB@`qLkEmQ;PczH4TPLk zac`4kTfK&zKHetiJ);BJ-w|k62^FDMW}y{Vp6q@ofV@Jryh`OvYp>WcM9CA5SF?+L z63f-p{RdE;O~#&E>{fPFiiBi~o=T5wOO8tw$7J z+}gCJtz0h9C+C-=5W?g0fsW4rH$~C#{N#5`EX%`#-i`0Ph~D01O>~!7KjsBGDJ!r5 z^98BXqmj*IBnF<X0+?k1+_#n!4fbRF{qBys!OMWOIno6uCMaDC4zvEwI?ivn#8z;1=G5{xz7z#3oB+WG;WR*;rRYm% zN1!QZFn@2!t(!dVmqYSA7bT$d=juAQ79unHqY+ERWo?EiihG>aQUSq-@nvkg4BL4H zDFL;Mr_g?jf`Eq67q`hl>#;vA0Ju32T1r?@F4@5q%-U#n2L`jy{PHl4*U00qoBmEi zO2Jq|oF-wkEo8fOl9<_rbJBsr4|S|aBg-a5gER8q_ul@Hr}X9v(Kq}}E`B~zAjqL+ z{J6jh1DA*_CU1kAUH5BL6U$&RIT?(_)vjxIQDSE zt=HgW_F-4q%3RL2x!p?X2J6-*-ViD_m6C#M3KF0EqkgCYqk=3$_Z2Zrj3290vK<$l zU;KD6TSj$xt^ad>-|~yuK~~t!)XT!r)0uri@z;!E9h+A72DQjYI zdUbs*X`|P26s7ChS8oiZSfKS}ZX046xff+DJQl668UoO{ z3IcdCW;=v;cRgkZ^B((rCd*n^O-}vM4JR*A zMjF0bF7lgG3SnSl39p(gTb~csgPA?FG9HJvdvsGH!s#mRXLdJG?yT?cTb*3%I7qyE z$F-P@?rft+{^AM6UB=|RAyd%v=okp#OfTBL+&s;y*SR-Vq|`SsFher<>i2m`z%DCI zXrq9=lK+bR;j@?Mzy~%Kp#E8$N;z8J5&pQ?t$9e!AzHu1w&3bhBwX=v!PQTysIP;C z$9TqcDJxn~bY^Qf_Uzt0TTC4E(b!A)-7veA$?%fAuB(jJlC^|FG}X+g(4FmY-Ry+j z)G;Ni=2cie=L2%86Ib5qJ=1W1zdcu87BGJWtf`gR zjM$LkZPc6V7UTBY3U5cRbH^Fao?%Wr%F*4h42RbOE9zQNof9w)A2~M8LMaoqNmVQR zOu>{3x`I9jtxXp3Syvw~gctbT;hEGT!ekXPGd*JsBo4YqN(~oTbtDx)uf6XpbB^=Lxe-6)ezhQFo_iE;ej-}uir^FT;l|}BG zFh7SiHtM!Oi}4e=Px7L9elO12`cglc#&~^fpPc2-s>{`g7TazsM>{w@?&KDC^%qII zWc|eJj?>c0rK)Sgwcaz8+~{Qfq8;K%_d>Mw902??Zlk zq%P<9_V%{xvVyL2c007>T_vhgNP09IwmM-<$)o2KM1*=?YH{IufV5p{JUJbqQ)-kL zer<%?1!FCDhi9~|PuU7N&>{?QPvlVe6a-muzpb2lB_yPp$;a1g6UkB8J1^(5OP^oW zh&lNF{1+SZm-q%^O%A1=^TZ#hXxQDY(`Fe0ZbT-5+uQOFC}$1KW#xTFP~qS=nT=AT z*KatZ`U^1fXQrno_OU!U^YH=PXFYcN#~YiHqyd-d$ia|@`bNa(-Dq`NrG8eBh70Zb z{(2+AwFe9F=!WS2;by^(0M$92s$3EL7nm48GFl%_bgjLYU0Pz9X$GSQzJPH8_ z2R74zv^v9?m4*i2*~N9r6ml>;+Ih8gWXbDBC|g9c!(yHn zH%)S;9!-%<+uWk7LGXgAhXc-UoaJyJ16)>mzSFy9KA^2esmCB5Aisj4_LQ`rS1Wd6 z3UOLiVQg;*3@U3J`M@h8qSBBueN@ge~@op z6iRp+5@UbrcRPq>hPidJPpfH-OV;$uJ;lO^5@ z+SyV;i9sF@x)ZgIa3AHEG#)RA7?Z82A#z(aiibUk4}a76>6n~t1P)kNsHyrJl21F8 z-EWV)pKW*rcCkY)1Rs)i-Sgoi;d8$e7K^;--g0RTKwX{z_Y_@td~a5hnc#P$*&iyf z9+POQJeAw3d5JjwWB%dzN~&+~=%7E9Ln+zHREeKT>|QLd^@Zbj&FJnpT49#qkrXJ2(gLjlC<5}D!zjA(tr5Fski%BCh zkdqe`Y4aN(d?f6ClA2iGj4!RRlNYo)RsC8A4v0| zoHr^-MiqdfnF^tIw2bTt(fmTbL$$azF(=L_UNM5YG) zmfX2@<&Te#fUS3Wc6NBbx!F5obSTAK`V`6Q4v861V~k&Dfs4f96w6x*i-K_C@}FIy+YiiypoWriH?4Cst;Dij1tF z#T7QSQ@p}Mv$pnq%(KYPrIk}yNR5k<6@*pF1RF+I`reB3vX0LNSq$V9RLLq#Dtlkq z6|Y?23ORew!FU3`JO{DO2tuY7oQcRP9rw0LW;3lh%=jlVk*>+%-nif7)qxRQOkd1U z)Y_|YLZ8Q3jyz$!&OD`n8xdnOSVemYJGkU|KvfR#nI?d|Jd$@eR&~P9YNhnf?kLCC zwFV%Y${Khg%gc@m8!trK_uU_N55_llZ5%pxcPjh(=U?{TBXzkY&0e=1S8%nT$?=&B zw-wsE&hoPDhOYY*p#30-zP|8wJw$=Ba}%9Xa`yD!si2-;s=JIlincl`biZiT5;^P7 z7$)lbmDOUc>k43PL2U!(=g-$$wU={iE8SCj6s|lt3YF#k)*{Y-{2u9C#IrlLFQNp_5SUUJk0iwgWNO>hfksO9m^=99xFhH&YXxLZP*w>|Lgd*2bxpFY>c8mAIiB z-^oXVNDYi9{upc z@EhdaP9)KQKP-`4@~!P$)V4gp4Sp1W%ScR*@9w6h5b{+&`7WSs%7E>t<}w^uI9^e4 zyqm7sQ18(>y#o3VPw@CD6)^SyKZSE<2W?}DuKD+h>sIAw$6u5>fq+4DJh&6vF?BV% zeVzt5>}+i~PeV)0C_buUNUeQNi>~nG+!9LVR~SdsjmFkySv0?ihZoq^+-{u!?`P6+ zD7Xt2G=D8&p-^;Oso=GF z@kzG43z>?_e2Bb#X7mKJxbFsZMxdz(k(3(e=##}@Ij)(|JN}97<55qMO@!sIt*GM$ zmq?FZmzlTFnqjBQBZhYv(a9D1b}|9Cbd80DU5>sTz_Q4D*zNqe-Vy*o&CCugJUT}T zY@lH4*^!w6+u zABU+r^+#YzIT8iOt}DPLZln39%G$NzZB|%(hh{2t{u0LKwoZ7gqa<7Kp>EmodKnN`@WFx z)o`|yv2hM2GLFV)0kA!|=FkFf{OFi(fUC0oz`0z%`egybPI^9i^anE=BdH<@w(P(qPQX`xZBrpz|ZEZM;_;I#VKHF`ERIw4IKArLOL9WAzvWqNZv!j^C?~p^S7+<>BJ)#G7zb26^B7n@A=M_g^Qc|>CUN3R3 zD#ax?`3xWt{EhACGW^}mnO01`@WP?@+fVlaD67ev-qGozS&dr++SG~VW5+l3ed%ZR z>!j0%{ntO5zDL++${oTMf;Qn24XUULKSi9b4RbDq08(S19QiQ2FYPe~WFCYJ4Ov^( z3uTD7?F4ZXnJgQ6x0+(4FgletV%?!!0cuG#3XqKti-{zn4|{0Zsa^uXWX4&kf^^>_{%5 zBtMwQ(syR`t))gmVu`|u43V3I3$l&kMpArh4=)9!h8evr?313U|4}VZ(5+QW{hZrh zr`Em#xL#pq4I<6tPP;?*O>F2-5Q#*a!*UXfvAX;%;ghgV>j$w_hNHL9pdezdH6<{0 z=sy*$ew!M<|4cX@VlQaWFn13fKn^isgKsbPA`Dq}EaPP`%&5CVGgIT>B44RE+bY#R zBf;uZ6zg&cU&Cq9YC~y1k86GNk)rlgcwG2CYj7^6u1cd~1Yx43v*vs6gq^IH9(2v? zoE>bRQ+$rx+S>fBO;3oXYL6nIedpjZq&CEVPh}0Gq7(rndy;@=89>5RRdBneaJOs5 zubhE%c(@6y+0NuQcalW#<2lguf{yt#u8E995I-8or}MJW<>>M%$6R8L46HgD_II55 z?&R!E--wNLo+ZZU#aRX7v)*u*8jI=_Vv;&}8GlXGh=4SG1L3XgF+u`T?0=2l<^r#_ z8`=@qD+$lGbZ_Cx!@mcNvED$;V7=3*rtGbZLs}vK9tLxOfb8DK_5Kj5arYqaF zp^oI~9}~0|78ZtuhyN?~8!Z%bgHPY>LcRHH4k)UkBACpg?Ieb`Gs?g$B%(jQR_%)f zVk8foct9p^*erT~K&~F^PInLNENpDx89erXZxny}F8n*ttTtetoyFe8Xxb{6rx2lo z98LsD@ewLqjg|~R=^#gk*xPMSB7ds2%7 z2?-@MQfiSg-aou2HiXZRVBz4Ty+W};1S{-4Nu@X+K%_H_D-zhmD55pCogO`>s?gr= z(jJp@o_4ErNjAq3cj=eDeEXPy-RkvfaC)LnEOgt_rtxEqS%|1#Z)MkgTulr0C}!ty zjb5l>yow6(>Gem(9Qjauctz8}4KBZJHug9jNO+GwduZaP^>P$vc{lgB_T&*cp7`D7 zKN0<^QS%Fqe0t`Z$yvuFV_l7kp7GS(ywblna|Ax*YuXLbu}dHg9#}RBdbD^njn#Ks zjFL3Y12yu&S43G>kgkmlYa`7rLO%YaVP@pN@#d^b-J)+@%gVS7&@K%%@;|LBXf}gF zXJG8gSR|_SU{rtS@(;Q8Pq+|)&cm<a+;ntZ&dv{Vh zTA4CjmnBCrX?m(UrMHt6_AUEyNK^x9K*JE-Fvau>nQ4HMf2e21W@DE=7fG>$kWCC% zBPq_WLkPtq0>8BBhhBW^wkbjNp#KohMobd>wLq(N0=D>;aW80Wmn-ys(C&b6CcLG_ zAJjYk6=n<>8`o~})qu|E|zg*ob%s;WdW&vr-D_XDH$E^!{>j%^b*UkS zlv%AfqNNRb&P{Tv@gh~&W zH)HMe!seGr`DEMk*>T53>^wabYFM|~5mwiSH4vcD@2xI=q$*;1nO`sSQD}8mioBgZ7Z6-rTz}7~UedBpuUbpz3)N0r zlSb3>{gxJ*EN;5Tia|VJ+f_)gW;S6_QPH4_cV)3w=r0)i1A*T7uCwD^QhN*4|1Z2` z{08pL{;(OIT4`N9;`u!MR;xW$&`5L*ml>Or$}rCd8Gc0sf|T-gV*%ViG2@puS)EsT zF7s;PbKf_XW%s_NogKa#>o$5@24BBxqIIk3-C6BRe^3v68QuiQl3!Ym$$N@5yuqnT zIEh+ix1r;Y*0*hzD*85)Rd~Jfa`>xQd_;z3hY0^q$-$xMjY-&RN>^3N`^LaekShM? zBe1Hwiw-@VKm;Y_A9=HDBgJ;5eJPbqejOFY!$6h6V#Lrq;epW1MtA_l)?g;!D~>53 zxN-bqS|dwh9w3r%GE%+3x03`38j5lp0?nRJE3d>bO=b5N`&DE6`cvrRxMq0Pe0bbx zR?BHn?si}tJg*RqnRt>H?RwT1SK)LCeCD2CzI_z&;rxylPudm-X=-n+Hvh z`fGY0gvf#%S70tj&41iuvhRR7Xln~xeoV$r&(8+{&VKEE5kCvBQ!5*S#?HmvHA~X* zNud8EVcbe#g85z#?3LKfl+vxWvNJ(9RYsVDEhDpn*^uCZHIk4k-;eRIn>N|1?qHmm zlhOVoP%`l@0d1>9f~$V{H(ao6OGL0(B*<>#J}_3kh!N;Nw(3_z3^LDX#W@YcO4+M{ zBKDma14EsW&-K9WIrHN^zC|zx`zo|=p`9UoXTXrMwP2C{MxG^d1|Nb&{WmNw^WDzZ znXl`#OJ+trC%oPvKD&a7GaUd8LazNHIS6=U{{Z3U6ikBH8r0({mbr~}L@30bI8!<= zD|ZzusUW7jSQ$QxsHGFWiRPPf1O8cQvnESM;niY>WsGIdFw$#GV6W~>eQ1OT7Mbmatbwyv5s-Kd zcTtvW+ zD_}>+WaGg_4ntU2HJD^Go!Y*?1}fxXqv&q#2q=}ET3qlj>Rf#AdjjJQ@q3yBiQhOp ztb~zh$t|pylR@e_vbGUeYUai^*mY18i(ulah7#C-ciKYD>n*>?=CI8_dGG6A#XG-(E^o#8QR}fuT4UHPlBkL(ZpH%X1lsg~#w9 z8Wlv~*+OlG83Ki~K5l=l2q1LxR+iazB_zwOVsRt}C!4M$;~CS$^y$dXaVw0DISGk!Q9FrX3UyR5#*U*F$$Ke7}`V3A5lMuHatB4waolOnuN3*Ids z0SJfhRJXg5W;$`Hb}ThyqrXu;TJ~JWxS$EzEETU?c>Uly!wr>}0KHb}S`iN)97xMa z7<^@SZtOcwSm;Uqyz4raEH#c2u29H2Hi0walcc8RyeoQ<3uHA2s8<)nzd{FRX-DQR zD#zS?H%Wh%(5zZr_vK%0i>iJjmi-+~w7w1vY(cl08#(VF5qczf}k^|cyayvS!BEWkFH|>L%`Ro zzsB_$2XOb`mVw)SLxqYRj*?V5*M+^S{?n1Ip97Ks>dA2tJpOCJuh=P7i%phuo+B zQ@d{p9Y;z3r5a+~dzb&EBUqwfw^b>M=jxdO+gcuVB@`vT?%JYEmQc_f(ZldHO7VWH7?(6#Ii0WN=z;FwO+bhch_5Q=jJ?OBIiXUoMRF^ z95V_*Wn1%iXora*nYK7#skQhKOJJ8Ws^u*UbyYV(($R67K+Fl*WJi9*g4*tzg*;Mc zd?#{j#j2dMcN+$~#eVMngL~&bX0-H2yUOBbB={Wa=D(>vz)$(>H$W2~RRz<&*Ub8D zlI^AZiflnn_}z0zDyKJ%GvsIe<{@b(3mps@yS*BU%T7zep1Z*p!}Ch`(@kvTP<2xc z=7A3pXM}qVtI=%!)3e_;U2`iI9A71pjw@K18ol7>@|5G$M$^t_n?2BZScxOfgz&e4qmB=BEsFn8|l?(F=y;%frQX0rHA@DdG?{ow0G z(m~=;efBAPttWDt5Z^Z*z?UW z5Wmro=>a@8ot0X6plU`~^#qMs(g^m2P7I83+Vgdt=U=Hq^PBPp?4rf;{Om`=gHnpE z0|5!@V#*N(yj*lnNs{1xuANxP3_0}b3tMtjrE!zDsVxDbW#_!Fa!eEn>`&4ut= zBDdUtYYdp}uk!Zn>_D6N9K`O?ZQ6DfyRoJ(kGw6`preS`JvW(HL(6)WPy4q7q@xJ><1CnI)kp5H^S7qlt z%sc~&cqnc+zhx;L&(tOAIdF%Z-jaro?-O=w;N}%APcKWtTql$k)D!CJZn$J?35DfF zQca%?y~pg|y&&MstXZq_r|E=xyNL=d;?O(>=b__9OM9Z&+u2F|_Bfyd9z8z@BwuKL ziSO1zrtT|vp5JWkp!mHCe0~5^PGViK^FsaDtH6%nZS%e4$I7PXXJZ0o6!S`3kg$>( zcs<_{0q{o$z#&UBeB#4QrT^B`9$EhRs1~$lT74gIYbN&pt}#MF-|+b>mPUr1OnBBid5T%7ELE1-ohi`aSjdd$$n!{&ldiAno#G3tfCt@dDpSAhb`($LRXOkISL&bJf;>u!Zz3}<)a+cy*f6sp zM5y8PMoWoe^D+U`K!5_YXNfTwL<^L6sr5^|kC8;q6<&}W$6;!h@)km(2NVdLBvu#9 z&M@YEf#kIFn4qf#PZ3T*xiszBypJDX%IFp(C zXcfQ@C?Ei_yXX2K4cVz|VLIzgsC*loXaMkERtt*d2=Y0BaL5g6yMBs3VQ)_zK|{B~ zJ&^|jwOd)4zy984W8ob`3D*;=s+!(jz!tjvOA>JrGfl_J-pzU=gonq)fRK zZd5@|Q>n+agaW>^dKoR|*jN*IIe?UrM$F+*K z>-Vlt=u*ki_c*e*%$1w_`~KT<7xxusC0a};PVR=;P|I3pj=7ZXDUI;fSLy<0IZ-1W z#8rXfGv#I(J1hF(M^y8MJu)CthBu`Ozs;^D$=Z*Hw{^=pq~DPOO>R53w<53cT*IwJ z`dwZ&hZqf2uF|Q%otO`{#0hT6UCW|}wm!2vheRn9JSJYv^}*Ho;syYF=0`{6YIz;l znIQmcymq6dtGM<8X!GTkCv0A44tjDl=*je6xB6}@equIOEsh=epxyU?3GQ*G3X3v(7--uq%?(RRbxv0z!|N8fZ4rUZV9HOr1c zWMv+|T9+Go(zv9s61AH;a<90AMG$if%In+PPnv4IDw)euELz%jF#qnNehE@gP_FQN zVBq!5O|~+~;tY|&DOtA_h)!jE%P8}n>ErY9!-vGgtRS}|9|66_cKV<3M-Z4~EPZbE}KtXH6BMI@E;; zT52E>-=FV=LDFUU0vp=QO-tFZ87%s;soa+RghY6^OB>uT{fG9XW7J)N3WRG)i^h#n zI$FRs+eW-B(~rnavl~GtgN9Z|ui_eZ8k#(4eW{b1)YvQvq!0)U|}Zb_5U`0fDfI#M$VhP zx#*@odhPzVPsnVBs4i?itQQWOAJe9sufkQ$K{S~(3^$3OC%giaEp1i#K=|Cz^vXiu zdq8-MVu0oe0ze+4J}Xjw)vcQ~DqvDNogl_wdR~GODX{oxSsufURJ}+y8K$|b_}h0L z{y%W?-V(~Wm(m9Au&f$CNMoPr2NqmigZ`ovjdv5J3SVr7V&?!@Mt&9q+3Vf4Je^+)g? zzcMe&%Mx$v99t=_RWL{>sI!oV%9P&MwHcwX=czR>PsbLVquR7`d?WcRL$w8*fB%Ed z9|C=oQRj7Iu!>*6x^yjWd~x!puXrrS9^vy_=KU ztkbzQW8a^f(UB4sXj%K$fe69%tm;huv#{|iP%0=(lr&+Ns;&V`i!15di=;MEbT#vp z^^kFyUBAT1Sq`S0^31=YnRiNHRapVYQ&2*YZ(GAN>CZ{LPs3(DW(<+>)u^wDm0;fw zRA0A84qVN!ewrsAITLKbm&#H;2VR))*9&I5Kb=YlkQ@)JKsnB9HB=fVyeRq1Dic-= zvF;<|iF9=}z_LkgsX+q2Ol)?4`g)Sfry76|#F~-Q(SdU{0Oo7X4-N(dpSUE7=Voqi zQYXyn>+5%uGu+5&X~8x&oV(0_EzRe)u5zj4r4V(ighT0nt)|?J%768PUdVIPZ!O(> z9%LXGcu4WkSk8#h=UKhfJ1#jP?EB#mZIWWF)23{;6|$26;Vw1Ur)ouzxr2*)EL!b^5uy|=1+LU22$QmAX5lrs4>bR$ zbc*N-Y%z%pNHm;z5Ze+tEC8Oo1&wff{5*00EtgvH>Aq&vnD<`iSzs4wR!O!Nd7O3% z`qh2v=oa_X_tw#{N-BnTLUhmfT{zR4iu)nvpTZt3{Jy9QHV;INt0hBUhgUsJY-z){ z1O%w;x;`+M^`T0ap$0FWspWf(Tg2e|f94OEbddsep*@QZ&pQylx%Ifcavaykzz=oJ!dKrjaT;kqV;8@%6yvxPI!YGN zf0MLkS`6yft2HkZ@ttnrc);m>#2Kq*6GXFD$L3Yv0)IKT@)Fgwc^p~9$G4~@CyiLG zTQFbiWHIE6VOx{@3k_Sh0G!n`d78V^op?UEd8&>*5%A^!5c$Tn;2E-O*R!Pg)#S#G z@(P@fY`G08Mw7Bnf6Ps~RcqS#7vm7?HDYagv-u`Hu|cQ3jXl30>ofoshRBq31TMT` zfHE0~jczyvrX*i#+$+Q=z$qC61F*;Qjo8tD__RLW*Mk{XJI6B^E*W9uY$H=`ZxU;F z8rIqZoLUz_{QW&=e|W>?=C4ZUUesRsI4N;Ee0=^R&hOS~q-A7iD)Q%6{^rYeGgzJ} zW{*k$089lcbWA`5r^Dauyvtlks8uq=9`|gw{_m&=b2Uk0Sp+jb+9%(hNO~iZR-VW7 zfdi{tWyg~)*t;GYtY-<|`>)mM(C~=A3mp{*k~0Rql;@!gl8vJvAg61+8Y<^Y_^RVX znLT9*?uEn0&4nw3G2(iZt`E6n>Kgu~srO4y7bRh<-Fq*kM9?;oDnmVG$VX=3=F?e6 zuJF$y#AEY!a+iO0|Bw_qZL2T;K`<9UhQa3-J&rXi$CEm~>=)mGwr#R+A(4Wtbj8%? zA8Bg`L}nXuw{-%WoWD1UD5YeAr&C1|X4D}spabg7It8jnWAd^@IB+J2!c>=)BkLQttSSE+ z`3kIJQ(X%1{51^oFDFu-m&56d`(5xbav>WEQ5CQx{|JL%?v_{oFq_`+L+@$74X3)R z1SwR0bwfD5Q?CGs2_Zby*;t0+R7Jp^>QEBY@&1DW9RjsHvyE~}hjghybAPj>Wd!#J zw#9?lVO3Jnh)JV3BPFB}j;CfjlKUGdo@LlPrSORDQv{Q* zlaS0~8HUs2%6kuGuFv_1$eu>KS+kH%u>6(2M1{E()rARyhwC3*Y1-;>UmF&bNZ8xM zEm2GzdxAr-)rMJPi+iFEaD9i8coX@<%7+nfTmudV!SAs0NVs=`1GPagCD!UlBk1nj zl`UHdY8&9*^RIHa4O?Hmb4gmQ^#kmeAI4k8@0(JcRQ(8~qqM>#5-u9d^+*ic6;`2c z?V>~~zYfozVmtN2BQLCMI_Th>ZZy04R;~n^$IXP@5E1(<@WeRp#*h2%S^9R>p3e^= zm1zgA5t5bOe0JN(W2^Vx^6M(5c#Q@VU%aZ>d7;~k*v+)J{x9=2DGe3#~L!Yv`gHID6Nj;=n) z*pUi^cYe%*VQqVLXtc@tRv7CI-Z0KJ-?9atBMLc1E)T;bk{*E?`LAbRoQ%1 z_*TPA=?F%=PfD+6H52OV)F#k}|EN^j%w4Z1k7$wk(bZ7^+;(@(vJ!52+~U=XypZoZ zeoH8A9O^NumLrgvY&sB|sgHdVoEy?TB|&Zx<-9uR;|%)T`;zW%yy^?&10J>sn%m4S zQO9xj5RDnnJsJoLTr%AS-}}pTt(Oo%>yt~0dU9f-rM#h1^!AaWvpp4WlTuO*8p}D6 zH_WM|kaBb5hyTEnQ<6VS^pO0ZqoqX^&vg(dazY`CF-E@t4ZDJeOGeHAH38Wekh4w$ z`7Kh+Sqc-ToLVv$b7yD9Uq=kKL52qD`n*ZMseeD}SXx;XL7I#>nFaD@k8seQAS8ZV zfDWx%u!QC3ZhwkG}tx8upX> zbHwr;%}max)9d`NY(v{wrz4D^BPb1^*9by*Or>3YBOoWgjsVRtmsi^zO@2<*;{NJJ z)!b6@T1~b+306@zVsLJ#M1g#ANG6M={^PeQUv#4itPM-ah+tqNK6>!P4)@yA2yuqx zr-^pa_dwriYDl5!IYf1X{>;v+s0rg3>jZk(gAYo0ceqxq(F z^dk{Y6G&5d3TUYZ+bypV^x98}@>>~x`Y9Hd>MED8ly(r?6#6a=#} zT_!LxFWbrXW_$ZG3njxOiPdi7ZlY?)gT52zX9N$p10)D21?wjXpClpY<*G@=t8&ehD_JzP^fK-9%1I=2Z z-_-NVT3&KafF(~jA&>t!1u{tjLaHRVQstFhTS+n2%x0%@xXsbM&BMr1OQt=7G;FeGbOPUhA3ohJd)(k+fNJ0-QZ{#}u>kJ$) z*un+|3t-gVjJ3yF3ZJf=PMMvZ-I0dtA){nZm%ajdyu9BIkRdpX<6YM9DOoXIyqQ!F z^4>WN&uPcwo0l!lmpid^b%orI2~d=$_=a}-*{urs_?FYlO@=A{m+1iAhqyw@raJn6 zw%Y-all+m9;KW_ja2Kn7_jv1vf%)m%Xttr#7b*nU)9-TI%3Q=x+3c8Vpmq#I1x{db zKIKF1IS2@L^l!r@J)%F6tD6~>bOrfdUfG4rZgsr)5ygdRlS2}rCq+yi-hNwK`jz-C zL=VY?j2_dKi$W(i&naiJmQE0^7(}1cubMn~?}}SsvLcne6B-Z^2UVWpwsY7Al>Woj z1Mj)MP2;N;ZMVX>FGg9ZXkmp{P!it%EIWTZr+wEDUCXd<0+ZWU!ELoNa5psqQ+K3zkz5I?_vsgNt8nmfp+BAPC^A_;Yv#fRU8;WIF=S4u3Gb zdA2*076jOlOadmaHVe!6k$?AUwGGsuUKf(Xrk-dW4T-#SyKYu**i9gTnl{ix(;Et5 z(Tjj$)+jJewFhrF%;HuTCJ>(~>QPW+p95})1`+8j*L-nchhLBd#pPQ{4R`dYjpyP2 z;?Dowm(W2R2LNj;)%}`E#pSPFb&3w&BUcg`18Kl_a{g(QUt+sL*fpni{hK$eCjtg+ zNa7oF@am$?J~3WowPXF@jOx$gv=F^RjDo0hJ#WXQZ3)48U&i;}=3SUFE zC9RPfq=eb8CB2XNt0r-(oTYqrB!2A04z!1*IGJW7e)RWcZ9*oSEVWou9`&Nj6qr46^6eUs*BWfsGrg__b*8a?AMqTFS~<9;jGWHFW-H$76$ogN{(UUlE*$&kG~N9Ek{FBIe%q|8p6{g8Jmil;>#BSp(eAa+eL7%nnhZ z|H((3fT3=a;%5elg2E!}tup=74a_JF<=OSb(hXzp0;Jz^{xKm9B~zG}Uo$Qos>?Yc z6c_p?Va=XX-xPhwmBpYg;KW9nH4{2D0 zG1HQ*hk9g_^E1;~Y|S}D`hN0Tb~g;UC6vpDFw;zw?NST@Rb zt^z=Nx1e)g&&b%;303PgWO{l)vHopkQkwAwDc6I)ifS=*NVNg!_DvWCHT2+(3#Vky zi>;1|Jsi4<$mU;l3ZrnC_?R0?S1@-LewVg0!llyhgZl?D=*anc6eGE2uS>KYUy$tW z7d?YdgZOK(Qe`Kc7ry+B*1>PD(mTY3%z{aM_Up(%W44`INM3$^bf9-F3W-lW%*Th7 ztf?_YfO#OLf?jr#uN+K!O$$~l+1hZ;Wwx+M5sN>tDuF*(HHDItjT!nPOV{O-D?H<2 zYN&5Fk0p@v-sT7PS#MNRtJ9v`Mqfi+3ijJG{}C>C`V2>jxhX#PDki$72(iYSR1K;Q z!<&VFUK*%4`ma9X1~FO!`n@SfMma6utCh%JBfU-~E$DKiq(QPY(x|5}Wn^Y-5UC*4 zF}Li5@$a4!WGexBO>zl*!Ow0nw2@=Gs^A5q$W;>z1$iFKolmvVzmgjA?#{8V6!G+Z zW*k-v8}q*ggY&u`M>A;gmA@&~K(*(vzOAQ`-FEcHhsLvw?5iNG1*5)#d(^cUU}DJMrrMtIC-X_FlOb*EolNCCcDc0EDLi5ho@74Y?yh3GZAjo_}Y3zTP|j4uR>QVNdL9jU2lLAO!O zpP{?j5s)5Px%BU}1wa`ExmQ~lATfBzU|nVkMV*NEtL(yv#&5$G1CEV7FN|rJpK-6C zamBy|ndoI;T!&azr^l$K*MN1V%VwEkzuo9XIduZt%%|}#1!?%u*_ZYxXDI6+%hYU< zZR6#TIb-6?j*JqYXzl9!3b0_7@ohzeu`;mUPx|n4lzLz9qFH~+wf)e#E_e@iyzz6u zuFj`5;bC6`uuI}Kc3t(6bbmDm{M$V7In^^Nf9CiOIQmSpsSD13$+rDiY6X!>dy_|- zExRLoWM&i8^F+GOv<7F#u)_Zs1}kplFQ~Z7&4|VaeZx%RAJJXoUd@a&r_2>TSHx;{ zp|xledWTprbt@Jg`OXdSxO)p0B+!oo_bRwJBPP`wrKnZ$6axPK-lV--uezF3eoGHJ z0Yk)WM>x1$E46HnJJPwYBGQwEYWG%SO%|XjvzuO=v2clJ9M#(uY!vJc#wDsjT7SSC zC58Xq?QrK|Rp&ooGhkkYX}ota62~A#OEc4D7jd2*!>Ug=*F`9$y)|#y6J$he_i4r* z(ja~AQxn!{oDm&RN!_llE}DfeEFRu*KWg}o?%OlOb^f7m#Vy5Ns`D_$;o!*{R-jfW zT9Fdjjq0+zj``IKwuxjZYF_OH&lVNhahZWk0-thT4&+Zl+ql4J%bpU;rJRbbj?!ID zYDoGwff~WM4X>#rBRc0Qirdf7^s;lRC2C2>y~NjDsf;%_c93R+-s98zM9ym@sn}UI zP)5mT_+F;tTJn-vlFn?>UxbKC;e#`!O`rvvup0_p>Z2@)r`w`oo5%cV7WQMM`V_|S z{9iDor=v`xAIQ)O znav>S^|nkZfBS(TMa7Cggvl+tGCj?ztFI0~O3%<{=@6mx3)lUn2bZ8?;Y3uc8?7+m zLag2Ve*X`o8d_Yt+B+%!3Ksb|uxzby_UHAK2ncjIHxXu^OU@}NfXMCf{|^r~1rYuH zP9iB2B9=d+Qe4{gHIIa!(W9X!s00i3E+0R-U)5&IewsS5C7M^^p?5xd;O?$RK;~fc zh3qsLDGBkKf|QZ1!AJrxycPKyc=2uuS^GkafY<1YB@rty)^@66%i{Y!``i0V#N+;I zN{_*%Okq_*3A;*QwzD?cn5a${c-OEJvd*v^GO@QaQtu~z=xu~C%gwi1yb`nIZQJNT z=)bbqwQSqSVq2T-PlhnbZfl^Yj`N|tJblI87WVSP{rv)gb78;@IMs)uFDU=jI<~1j z?`!E-^WXmP_7=A19%`8K26`RIpNH65@H?Yp@AZB^&9W$yYS!^siImEC=LqjMYGOM? zcsHmWCQGXIs$jZ7lJ@AjC{zSt+58#HN&buV_oBpyp_7J4t)UI`{=4)9y%>%~`QUwK z+ECf-+)$^j);#c<8eZ^vvpFL z-jJJbzMMIf_xaQD2KQ5c5&)ZBAm~sy4HN_$Sv@;nTt_=758XL;Yyq?nsA2HEgj8uq0z8~bxVxx%CQ~d36LL_tPXKW!j z8tPr8uH^y?bw#%TSFjrSi1~m} zoymuBu1N`pzNggy8oHhDYK^6aH87pJ6LCIo4v)Y1VYmHKeKze=J(MFWUn$k!uCFtN zp4daZYH(prII+xcr*_U;?r@3m2jeMdP;s|oBSx+GyPHZ%px9=9^16E4{22<)GwL6d z1la{afN0T@f0a_=-h^uOYYpO=?F|4VkO!DSvaaY@*wt;4#+EoJVe$L-u~c&$y4F^& z>DgK7BR3A<8w_;L{Y??F`L6Pz$IbNITI6B!ul<88sn6d#7A(aC2SJK}Cd<5>-B7SCstEQu(Nvs|6yHeuooY0*3KP zXn*qB@~#NR()VWUG^ ztB9l_y*#qHm^#!xUo7Og7J~+R$NC<`+~NIUfBU2Hn#F28h9eAilTSisHWfn$c2tg8 zAZJp{bh%AWB|n-)rABe~Ix&YOR|VFTqf$uJ3G{PrP<~ylgIGmch+ir+wUEExL2A7_ z&3N`wmJ4ZT0LkK3@(RDWa!B2E7Z2j?o4B5IfzH3+!75Qop8#;`z5^D% zjE0YA;~nsKQfm&Q_K%A~jbyYBRK$T7wb2#z5=56C$3sxaHb~htC2SYxM_oGx0+qL~ zgqXjILt)+%`erl+V<>fpK9)REsOh>j|U>oLrIr>)I zb-_`ODH2{3sWd&6IHH>rSUru3Um*_x_x|xwf}vTpMB(-TkBO=GN0c?$Dq#Ky;aM#@ z^0`KIP-2TEdK~QmUePx-+C7JWl-T)gfiK~S(fgxV z`3viv|80CgDpHtB&&w!BtA}_lG!PFiBy^%x3irbTN2}PHZbL&VRK_ZIvXfH=E0<%rhl*U~?UI)3p ztjNf!;U@zjt>&;tv7EbmM^k+!nS8y5^oSQ&)yNML$<>2qI0q|ven;*?p5IMS3zXGYllXv*C2`~%*FYb_J1!;{E2u?q*K zV4oa>>nAfoBOb*_{7pwvDm_y~*E4`^_x3jY*ScP6&ZV7mb{tA>2I%YG;Thovx`Ebh+E=R4{nW~+>E>lCXb3@mEezIB#YV)9;M z2)f0O$SNWr%hh7`&}+5(bNI%Yiw-Pke;k7arHtL4Qz3*dnsg_=0NIyBNwT%P%Cwzm zaClloUYEo?|FY0Ty6I+0e3im6bh68UmE3ZaEjEh!RY! zNKHo7AJg^m-I5P+vW$tGiZMO65W*zZi{-u7)x^|^OtPTV1E44pdTwP{fp>|~#Ph4cb z*FJp6;p-%*0GOK&Pt*C;G}Z`boCm0$NN>C`P&{^C$Z-*&&Dd)fQkr+;Vld;G4XxRK zOB<*?iefBp&(4$RvF&jZ8X)i-X%fasen>!bFeIi8thfKqd-H!jfIQe^&QrTcQ4l7pZJs2|qUuaU&ja5zXLuG}k0!8}{kO;oszt z8PBBX{c|}xB=6VGWxVrIJFm)FxFCjG=S=tekj8nyBjHReZiS1(~NvH?Bd=| zjff*}A|%XqNZ|Qe7*71E+NTHdi{B81Rs-Ja9L&YyyoIOiy?xAv6H@0e3WOXh=oBaP zt8LanT*z+Jz6(7c`l!O9@KK;l@^dvv^fTl6s)9s!k3&6;R-w^}FzJWH!vX5o`%_B4ck`VUG}|a) zzn4zyv4?0QY$Vzl&1-Rcc(^ZKV4vRf&D6I9~L$I=dO{HKivs9SzKK2kM!NX!{aT zw%5oGyoj!z&BMA9c9;GqT18r}uny(Qb$srrop@I5@gLjoZs4LJjn*D;`PqyqhA{E$ z-$JS4%m3^x9NoWB=O#j5W>w<+6wR~MH*dUR=u)Faj z(%T~;Lxvuq>{5dZctCPL%R;fZXLfv-mXbDDiWWe{BM$ik=Jz*AeYfLDWN;v|Fm9w^ zKJCXX?A3-Bs!b2AktlO3=GOli$JQ1c%JI;@hUA13TXk$$-Kd|5m|xEUIP4ySS0?!Ri%ROVrMa(qub=C^f%+(^+GQ#YCtC@^O z-bRoiFl>l2dP%nM3XhJ!=1LB#18G}HjbqUC|B=!yZvG8p`E+8k+I>Z{h|7OSB0l%6 z{KKcQY6z0~7gbU2zvJS~f;bO57Do_Hti=xsU}I-%Vu<&9%r1U+e##*}vhu9vc)LB; z2YH5~9W%HoabBveV`hZMo<^J}BaxJXFbH3+?q-t>1Atqn4v zE~5aJG)9X%3`D?_7W!7aQEuZPly;ImAB<+X*D#`Z5e%yF0+NPEm2}LTc(LKLrwKO6 zGRWeB#3+$M*7iSUI>(4ybeb1P!ww#}Amm2{XfNk_N3-+%@ZTtQQ zfku@PvtS*?v&;4!ew*d$kV%>se>pYQ_z3E$aBtyQW@`}a$oM-U?EW6JH40St5uu?O z-g^~n@{o9ffdqO#PmVw#RqMWM3e9_u8M!K}uU6XJRmF5p=HkpLv$RGU4kO^1*~tOs zpPw?`S8ZF}jZ6eLbD>=_g*BPM?u$y9!Y~!CHu-D(t;$==KV;MsJqiyN>Nii`?`WHq zA@YC|po+1lr)HT~cP04fQN5bI!?%606B{|EER;uae#dW%$;j06h1N~M0fdwi{s(Z= zpz)Q>Xy`-gPNinz5_l`C25Ijy$9_^BbE(IirQc}CkFcMlCJQ>*WBxbt8iWDlDB^y2m>t%0pPizM0i%oB^8m;Lo`@$-!5 zRz>XboALg*r}%#cs@HA2V;RgFx&QaNV9IHB4+NXa)@d^d1+;l*O!Rd?Jj_rh)x1{)5Kw z!{^Rz5YU8}x2-JHxRD~A-$kTZPElf98QdQi>Hv!W8ga6r}0>yXZX|WrKB4nGNh({TF*#g zV_GWz@u=_eof^~vW&ONd870b=>*7ZTy7lONU9 z#SvaeLU^*t1=b;rT=^RR;Mc3-wPtDgKWzO~RGdxQwT=dW?(VLQJN#Gf=X=Lk8>@EMWsL5suA1|h^K7@8Lf!Os<4m6FTK;s4ls`kH z0Sj14CXL!)KRnc#KI0xeCr-Uw!E&nwaw(ePN6#fnZncqBtm-a$Ly01ZU^>kWsq1f8 zvbEn9&~uc{3>a6(yv7{%>)Ai?~!d{xi=& z#)VDx2#<4XRSIUz3+AQiJIf(acfZc?P0fxM2>y3N)WZJk_i3e(0d{8$Qmw(sMw}%1<0Ti?-6#BTqgK>v}wNBT~cOnr@9 z-CSf$@bjy_@lA=nOT9O0b$wHv5Hy)q8CgxVo?E+1s7!6CKrFk~?C;@#K3pBcORbX9 zmnCtsS!JzMf)je#p0(TWX6fCjv1aRB# z&kcTJggu0$3I+)~f5ZxWOCw&o<{vK6dZM#=TlaTe*C2)X!iI+(PFwAeq$DV!oZ|W^ zDaLjNGLRxa$0wnCeZ=52AkU+!yoICsMTZ+{$e}E395pue^Xm!1=qOKJIP(^#muP^L zs!rAEdx$k;vmd;0Pr6eC^Kc#9U#p*Eqb_p3@H%lX8oG@=PPHDy#G|)+OSoyBykOG84-hHs4Mxm=iU# z3SJ40;@+8d5g%Y=p23H|89lr6u^f$n-mlG_be~5L+7{M++bo8ZaDt53>p1cEUo(&Z zcGXF{WdUr+O}&09`183VBmb&}A6fd!a{s=H6UjWqWPCE1h{bqoQoXf6FX&KJ|G1T>Ha|_}tHwB-(*=J_Ed;dkwxbxK{nq z4jW?R`usX{UD_9`6qFiU(`EV=mhvkE5D5z5GO4_3>yXx`s`sv(z~a7C&8#SHf0iyX ziDT9g?@aS}Lum5sYC~nbVh%!19f%q1LZ_s^T_oBzX_2%)?BzB|a~}#ippq&GZd|Q~ zmc1Q`PTsDwSiRHWS#IDiSbeSC%oF%owjY0 z+0ZQ(InuLt{#OjU@UhV<$+}N!;C)dT{sJd4GE&=CRjCOP_60wU)YDQZAN|wcz#ie8#}V459*E zPtL7H2DMsZXR*pSeu9+AVMz>m=wv{SuU8m`S9$@;?Qf^w)+c7%)@ zUN_knU{*i_j-Ql8-g0>}ca|+gCc1XMkj-&(ZH=}eS=wGmIav!T?cwA#SldleVHUGO zC8|v&@#0GFvjBNe%c(mPTg$92Q%ZB_a0$ZVsVEzX>-W1RNrKHV%j=)&>8NYHdmNKe z=WTh_K*5%Bx3hh#FfSZgj%^XN(Y{24Jp#iMsK8vZKy6aI;OAOUNgGj)IAS|0W$LjV zW)dX2$EE7@iVTez_n0vLHyCIQmK;l&p=G%a?)b$UF=}SCzMOa5sXp&Sf~K^*ZZJmD zQp<|G7)f*gZZX(FlA0hIO2lW_Zix-GiEYI=XmQ0y$wmIi0OD#>qE#JXnv7SMql1MH zXG;^{$i$AzwE_EWc+iH7qaTrPN(0Hul4)o9i2&Ev@G-aIP3xZZuu+%zGS;&pq*$_n zb-c*K1B}XN66AqW)XD3CYtZCi^g@LXeM8KEuatNo+nfj{DVJ>h_pjMn(1U3Dt3)5>oDE{l!3VsGSVB zODFCj)Slv|lDD^Frtpoorr=JKb@I^g`ll1d6)I0KorKBsjP>#NJs`2(%5C@2#nM22 z7e<;w>o|HX@rOZ2KZ29Jd+|1M_P@Y#ReA~8J}O*D6h1M}lu(zA1oe@mIws(@F3VRd z3WdPsaai>sDfUs7x)y3)X#0LeMQwI`jIK#7rR%;K?6@oy6$+0gvQ1!iq7dOh^zHs^ z$t3_tujGP^Bpr5(0h@Ucx;?hg&Gs~C3z)0!uehhHb&nBy+S|Z`>W+L$6DkMK8Y|p% z|Nov^txx}A91pXy(POsij`Y0~c(*9b!+LE|C88OObwt&YXIm4eDbEjicTmYdSUl|s zVBOwuSmoX}T;+Bdzz-%7Mry!=UQ`t>LoT=5xrlIMy$)vD(c^SG00-eZd0XyiH4Ejp zzjn=eaoatDc)a}NoLY4JN9q7Q@s;Jk$echeTzp83*lclYz>9axD~A$_hnObEfg`G^ zaxQCkOWQA3%%c1}*B5c-h#v9CcU8^o=^>O+4~-5>Be5w+OJ+;{=*OwK`0J74k2Z>v z9&A;hiE1UankI%=%0;)hHWVc^v$~O%o*koMHM`a6=Ty@?mq0jT-%8>IANFjSugW1( z-*|2h(@uI_K1y9N$zOeHIhu9umGHHIj%J}lgk(+09@=0b{>Nj2XLc@j@&jwO)`j2u z0^#)stQF}di|2QCjyaNUT~t8HQEf4a8htmbouV{&u~nUw%`iQn@u*BXYy1tXhUkO1vBjAPX)Ct5a3(ljr2ig@iw z1ZCIA_m1Bwba-tejRX>MqHUqww6}_Z0^5g42GZVad91&>*K$ z8b!l}m{tab!3|Mkm6S0$DiAi?3VpR?^h`%>lJsb2eW^7&^6(hcwj2%JMGsVH?}t%; zSJp7#Rq^=r=27v;xwJdj)NuRUp+l}2tdKU5NNZBollExp1q=h5*-7s*Yjtu#jy6v3 z?9Be#4<2bNkxwX0JWw`^O_N36*@?{Xw_6cHqrk2Zb8eZ_{hEtRoBi^dZj-S5d1gA2 zqZ{{R0Mq=}MMW16SB?yXn>BZw%#%Tae@=Bb^pjVVNkV(WoZCE$$W&BPvJqGIg7fW& z{Gp2*b$*xQ&(F`8!$S2FaEKd$KOWCgk7Ef@*fdfNxg3v*FR+NON#d@@ED4=fm2)m? zg<(c-+ibX<>Cp5uYR*PN#p1cmeBi4WDb08qyLdio8edb@v#V#ijpY2xgDgXHV7yNN z2tj-j7P48~ZxJ`+*W){JsYiKs4wmG>-91G!x9@P55=S4s&w3eKpJxs(vw`#X9`+gR zx%Z9udzF~9GCT>f_!TMbN2od)t`BHtRfCBD*(1uk8tG@>i8f)=P4w6JrA{V3q=sg1 zJ931vyvV!Sk4vp9@Q6H;JRC~MT`5k{#r&CeMIQ>y)HbT$M|5oP?s?{j|8A-W@pAb~ zsft4x>1&q>s+>g%@A^FHJ96h~({Gc{XG_P4)}Z+HK(;SFMni~c$CZ;h>K~+AMaKyE zzxed4yIPsB3c!WbiEuBLKcTL;eS-1)n`!Y2@b4+2T0X5$yYx9el({k?ri~)q;ZjP` z42DOH6Z9zK+vnQVfPVBKl%8Of)Pn?-v&%*CI&PDFz~GcVx0N5?m2>PHwfdA}q#k(f zWq{oRe|bfHvzMHI9I9OScyW>cuE2jYDm>P=dr|5UDt0;o0zzru6FrKA9oX95jO#bb z1VVKRIE{G5S4pFlyEx}w2EQ`~W3G~RV87D~$k;+=hR@g+DiHRn|> zdwkpuxonQlt2$0;_xfQ^U|&OBed<7}-n%~P@-K~9QH}|bwze(*BVA1_v+fTFG!&Gb zk&PFO9`~CMLU#`r;GUjWDg{k8Jk0+?JV6K0*JZH!j0@2fT3nIkUi10m)tZg zssj_O3+MkcRuZHn$&#t9lyPB}Na!Xe65E2+q8nS12&lGu*9YG(Y*_|S*sW4`wMr}O zXXnJKYNa8Rx&3G}rP%p(`~YVIl41&L|L-p3<_C>Q>*Mm*KbM}=K@WzC_009oS6AB- zNm`is{ciUrC{dTIg0NUzJ`JCX%Z%(0OmLZ$R>I1O?O`E{!nL4Vm-6zDL}bEkB}^R2t` z^tNB3T}^Bx240|b%sjA+1IFk(XUZh~Kf)iTujGDfO0R4-o>0Yc5lMaP>)U;FY8o){ zsoNV@7XmNB?Vc-$0Z5Yl+ZM9Oiv>jnqnE|&8;qAJOi6=m{-Q(In0Z>A2y~k(@sThB z=N#SiUco5NB^xG-e!@?OTVI2N?7y#A9{ z^Ic|El2M- zi9Ul%`=KAkr%_s|Jkov6Pfs#q6^XxUoCOX?T$cj*xu>AV#VJTc2M8 zCRp>ba3mAI|9|89XD%EOk2xLo16}v4F*Sa#@(%-Fl*O2ER}TLD1piwKK|*d=;T$|A zb+Vo@6VTK>XL%Z+Wv=sVYJlZFAa)bFPneYz_kYt$Z@?y+|5b#j#aPc-=i$Rr&++A~ zXJJ2E>0IBi&#wA-$;Pa0Ss0O|=00>%Kkg5zNhXHF=2G4lHsasi zkO|`bNn67v##{0XEPmt7Ph?SDq~OFay5-{t3}{i0+W;J+jK_PLv$LTVWwaa*!9gnL zmzn86wH&w;i5)sV%Eg~@=%khm@CLL2ld_1m)-^uk{c66=C|e)8<2)iyX*hSz7>Djy zOH3~Q;^m($Ncx=X(Wh=0+DWVpDA2VrQPR3B*rq*Fr4J^cRL;ve&^#3_GemBeT9nbR z>p<72y@S4MBpBAow$Aoy@<00UMw&F8g{7%7x#8PGzLueiTG^-C`nsZC*lapwQfgHQ z5knTySWabhoCn3aqo8z#gQ6qlra2?U;q7EUp61(vom=Rzhk54NIzdhMb+rdOy_iLV z_1IQWH&k~G@3O&CXa$*QbPO+=#0FnVqKG&_7+)@gx3(xdPQP*R@Nkc+2P%+$Xz-oT zK?a5=F|U`iI5WIg_I)49MMB$FkcB33NZcke&K(e;wrK5X!AHDYozT=I4;7&a7#3?F zT5>N23Mzty9GR~r>DD<%4EsS&_NLYT4XJxl2M(fRqfMIbH;ULmsz4}xRf8Xxld~8&TI~ZIH=&eF zh=DeXk)c@hD}1bqEQg0HwQ84_s9+e_LB{~7`2QE!pSmTArmcW5<4RAvKvB}lHB7l_ zIa&BMR9}VM!Og3CycCZTjes^lWZxYL-*XA={oEny-^a!~GBX|Vor`Ok+BYmz5YXuV zq;b?|VU0#$7lFObdoHQG?s|1en8?um4NlKL~Ud9`$ z95&YVyFgq8$K<;9&#nU<%XI?|d`nuW&cWeN2)#K#8xOpNoElud{+eWA6@rktD16XR ze#7I{OCvy#{nRPKWq2RuQAIR(K%i-zT!S(L%qVMzf@%NU^A$}R*4@+rZfK)&~u=A(5K<8Ss$OF5*Uy%SIh)LoBR8z-F z0D(7G4jmK<7_d(sZ9 zR-rEswy{V+GNyWSdk)qNNnGc&Roj-FE^buA^YLkML!qb(1fUC_;R>cD$8V-{gSke9 zE!aI6pWf2pR_i(bn1M3v)%f7PFSGR*Ak&S|^|a(;mwe)%bz_Mwvc0mYar;$B#kZy! zJ4eBZcGIR7g|BGoyYB&&4mY+y&dEdy*Cc!yMWaf51$Ma9~(=`TlbH8{RqYw+W-$ zbPv*p5l|-Xh+WLqNRbS^>NJ;OOEq(2GKfMR|D-gEPNC%Ydv!MfNXMFm2zg*jL~hnz zUJt`LLm!#_3*)s%yPTo2vNFSjO`R5NaXvcuQLDimCnWSX6+1^RyHHlySn>R`fS=Iq zZFE>vR4Y^PL^YAyrZt*3#`^ktS$TQj=e@ucyDkhpy;06!k8K}^vy5cRi^GDG_`k)R z)%F~7qxF@Q*%vcW0JiIMc9yNxsMN3|7-py zKEAB{&SEnA+zJb`r`EiYZd})+DSV*VAhT)2aH3@xu*w{Nu>plDJmD+uB!t&7ecxS$ zaT14$N-&-JI8H+vc)zv_*$#Zb`?C>Lt_-Y%_4W_R01f=C= zp+y^VG_4QJ@&3&R^|-RXdQ}F#-85DliBt+~_!sOb4zGL(9Jol@nR&(9OIntd19lCwZ%>uS_cwj#7A|xn@rfq$mzT4=E`yJeGp_tM2 z+b66r5W{-{m-_8d5TV;fpB3$=&Eqv)NVFF&T zaE5L8rd)}`r=ooLqzuHW>=)I6S?}ogr{V+01Cq4W48$~Lva7WbxfSG}O!%^wo2DR- zTIl(F-!REi%?Z^A>VNHeotjRh*^*9V;DIgT9WNoyY%^~WGJk)_#s4t~0PEKW9J-;v z*Ih-_%uShfY_Q{bK)BHt$e@ococu(FphewGJCxI|DRdfD{$yHk@9PQy%w|A90Lzkm zxp)W{I#y?4`IxPeTGi3k1{)Yi7!(Af+|gYg_tz8w)zx+~et{}h=n4N(%(p7|Tf8ny zA*cC(4f_t+`vck?311Y}XsmXNE4RDQfecKdH>MCPYrB)AWB_@5n5xbOOo6{*=efAJ zKi5e8lCc?T7*vja&a9-eNUViQ;lQOoy9y*dVL4&_B)MUg2ICYzK3gnQ}C}n`82V+WZ?J<87BSNTU+7 zUGURNXP2GPkFqT7MTyf60dpiE58 z+>8Zc>o?0L&c`R87b?UIMm4WGxF?ZMEX;TM zmW7~|H7x#Eo>JHya;KV^%tgn7A$Z1KizoH>Ma^)ieP7T}BaJW&z+_vJ8J41;-C$60 zOZZP{+jyib8cG{tJ1eAy?ADq4IC3XAJghx!@h-GPtcj-m3svZO_brWZOtWw=UW)CL@}j_Os!bz2zvVvShy5xJO^qGQJ+ zmwOi^PV_f&`n|Ryix==vO9zS3J1XU9P=otxrvlXWmuNVb_ubQ?0SJ^KR(?0{1CT=c zF0V{Z&PD2-pT>}wKAQ4@|IJ)tVLmh=gHVb|K93^@3DU9qrR9Z-XNbkWx&Wo#&;Y@7 zM(`<$mUAp!P~_sko3FbAbA&%1jF#PTJyc}}QrW63o4p87G7-0|Iy1YS^j|~&O{?7uYx*l@48`N*dzh}ixpwTRA$v~Mhuh6NL5@}f=pEvhvNq-`) zVFX_>ZcV~ChH;9D28inzRv&h4_*-?-xc3tG_QuWmtwt?Rgi(e zYzQoW*;F9@Xe%3(i|p99eurr|Y1%6|2m4@g`GJt+?X@^F4htJ4eqr=)1{!5Io(Qu| zUrJPY4e*<%Ah`_N$J7HN0jKlyj^0#SM|Pm6id^6FdV8~WVvC?N>zT1S#?4P&o!wp@hn469SL51)43+l0^r3)EPd zLto;<+#gOQkmgGlmlw;)?@OF}*jk#>oounp3ocYBoQrS69>#6Kh7_sA(Df5?rnQue zkliaO1M;-ux|ex{h$68H|_LStN3|I(#DsmzE)l4-dLn=Q?Bu(=N7b8RV|w$GXF- zXox4C7~704p5S!}whbO5@OJ5@7rYpuuv4yhKc3hhyzT4^2^(Z(Q)ZX+h6&UKLaFl5 z)xg^Uh4;_&;_f!I-hnJ+a-V0jq$n{00t4fc@MCF4!e^D_^#T?bEvY%o5QDSE>8`hT zOv>#Oq@EHycb}!;GLjOVLT0JPwLm|@shz!bne=kh8N@xc5si%tEML*R^tK&nuV%#k zA)Sea1;W30UOkx?l$WRTyD7@arRk9b!ptY^C7LBzukUr>O#StJviIx#(&K>~`|<)p z=erc+#rYTUv$q)n0_9UvONwrz@jD)e$LG=#x?G6kc!jM+P!!@{VjYMsYx~)Zjm-iM z=xxy#gNR`?2@NbL=x80A8$M*N^u(cC;AO^zq(z$^pjxt!?~CSq1}*P?Brv)Sk%;MS z`XN$>B8TLd71V`_V*yMa7AjK3iAWYuZ#c8=GK$8R1{-g z-Oy#KX8_U1Z%%V)ZNuy^o;jnLVMpvL!8MjHSTl#$dD}pxhh}k;>+~oLdsmmKc}iJ;>bOlPG+N2KMAr0Kbn#t6TfWtK$<;)qB%acrBsu$P zlxPqnCM+>tfd4YjGw~h4DUpn9Az}Ep89_I52|cg~_K~2&+ABXj|60IPg57ZyhwgCT zECCV*C&dM3trvs+NqWu3UQ&27=IYA-XdU# z;~=*eFxx9k;$r2$uw!LXC6JpwnR!(w5U*j=KD>@8ncc%)4v7$>gI0Jh6l9!vEeDV= z?aMQxrH>;5<)I3b$eH=-VDNV{5nqQJTdlNae?H%yton%kV12piLZHj7mCrQqlN9#| zv(HoFQMOr0J0cq$^MmRoK+3D|I``8Fghes=yFUuxU&SsTC`7xMVqfH1{dRh0aCjer zS?wAUR#Ih!L=#b1nbbV;j&aufSEELztVTtRN?!m5Sdv+27Q~JWKx%E-d{ng<5HJpvtPzLhQ9Y|oTn zzP#+hbD>?urr73xq^+hdR(zF<)>?e&K@CH`Y1)P0L2I0Pi=a1kmBxhM_@foO=7MKM zYKeMJg)M*N{Ofv$%$G>ee$nn<009-K>_K?BUh3KGnGls6NYRVV86E%OHx3hHja4au zq>Ljt6DEgN7z#NZCO%)Xr8@5M=O5Gf-*V*Msy@(f4%=vic99in(3vUZB&zFZM%WO# z5g2#j-afIiwj^y|`Y)V6W_QDClvhgd=O;pkSz()I=tAtmmY|>-IWCwyDF_J8vmIHu zO-EZ;o8vRA%vu_y@DgF>K=i5E&!XHd%0mP*Amr!^m3ir$(TuYjHyhSgqOm)w-X#PF zN)f_-#x4U-_8K?#=D9NO&FYe?b?hB1Ti#SKBJ01v08}^Fv>5^PlMQx$BO&ORSHz#q zc^)6*B%PeU;pD!%0^IDJpcw z!}OK$t@F)wwa0Xeqz82v>3w@>@VZ~r)`jm$z{RpMSKv5F>izS)z6FrWsI9|_pwFzT zvmAueA>EuR&weL?9&o?PzCN5G1V0G>jl<@-&syf(YN3Ye+8dYc>gb>T>7XSmqq53b zccz<-J^Ugfd@R7KT^oH*P-Nju!)Dbna^ z|LYAIlh}cv?7m=#>G~nF`7)@LZp4M))f%$96t6qJ8CQ1M8azsNLedVH`JKmA)v(4)>hcA^-}3{ z)depkG_*zz$|+_74^EnuYyGTB0XH1gdyBrkQ{Y>s6x2B(pnN%?l>bKh%paQ^{)HW= zL2mkAaI8t${b(_r!TN!yJ>y*%q9f}e)EaSJL!*b> z0L8c%9YJ;D#w*FK^p?JR?gOB)-L)d9M!qJ6PsJ6^$hQVSz*_uA4PcOm-(L{|if`hn zAiyJ_W2Oh(4RLhr5x z)1z8RaE#QkmFUya^;<^bE8DgdGri?)vD(ngC4rO8zp6F6sFB|L8J^9pDrR@*!P_#j z(?K`Xo^YU6VMZMNOa2i*bnyFUxp|www^1W=6P8$FmNDx=Yd=1e9z*_f4?a9`)oQ^V zIT2fc+*vaoKWYWK1NhB=T?^z(fNpbef7^8!O8gGmiQT~K$2QH;%M)@MiQo(+6l8N9 z{eDIi$H|&ijMy(^2IrP^YNH_qLSa967UdU>oK1h1AfQ`C#_R@5^-EIwmv<*DqlVdU zZVvLiYy}#x)-okjki|i=oy%aHqcyC<_+0EMX}Q%i@&w9sM~5Elg_C?UdT2B(fX*nQ zZCzZGD5S;163*T4tKg+PtX8~BVEp^zT~4Ugl=*Gm9rf(~z__(NS)fezm*%FkPhh5jd8>T>VQ@hXySDm@-t^P> zh-j>Zq!!dJ)Rb8T0x>a?|6k=AM@M$|T|Bg%61|0;zXqKa^HPKV1y0VTF{}NVe#9kP zN!ira>>Y;;_dX6kRw*_}W4A`yy)!gEBm;#=#S33Wa8dtTZuN_~ULH^s1z&&lFyT2g zwG;j8qyq3X_D)#i7qfxv2km1*!ZiWB5Gxpmgf-)TH$2yehgklf?@c|J@`bOpltu+f z)Q%7*`)TlLwIba3XRiZgR%DH-3KP3Ry+ND9*v?Jr94p6JRczub(~+BLY#GmIpKBTT z-~eEgEqItsSmms*W?!<5=)}sN_h4q&Z9_EkHx@g#P0nTK=Vk}< zHEdJ~$QI{>&nSGq8`4Yv7%9V}$pn_LiSu3-s?iJpN>9^}ac5IqSLAKt=yg@U^EjO@ zCATd!-$`tjLMU_X2Vori%doO{z#<<;J?w-I&Z=Jh?Wm6#K?;YC@co5H1{sOW?9-2!L~%aAiCB^6!^HwZkjW7MIf+|dq&loASn_7R zuRSA)y__Zcl}sBO*kGh@Znq~%}U z{27$3-$zbmRn>ughDEtRfBMnD-2VXo096*L9DqDAffClwKD;rts0Y`ejQq&A#Qx=5 zT%{;F@ZRc zQxvdG`FS8+L#(8U-f;BD>4AU1eV(oe`%|hR&|{*y|M~Pm4XzX;aWCgF<^9u>tKnqG$w)8qY zkw^D;x)%`GzZ`M(8*8*ahgOzRHwmJT6hJ7m9&)?z2+~7R!R5U27dfvij6!zf3q3x#-dVs5$jsaEZ3NGk${i^pEh>?OP@5Sm7Vsrp5BmR z1Ib_`CCK7FWx%jry88cxQlC874OLGj0kjpt3rq{v_~CW5?T`H9aV$f}!6*-UrwZqxxXR~Kg0E>i4g(&*g78NquWfi%9{ba>8q*O?cwU8J(Q{x(cct<8jPPa~QZ(W;g@ zXebH?K)+I?ewtdJl0NxAcUQL(VbA>GA*P<=!|%J~{|sNgG4C8NJj8A_SZlyAf1Wm| zt*Jw988q7ldc=B5!l*N1$2H_`Y8D0i?CNCwlsVObi`MkMFMtq(T3ng(l~zXFFHO-u zOO$in>V8YcN64Pyu(ng%X1d4wTjmXRm&10ja0*__NT2W42jAjKNq3~6E$G=qYXz9t za>q%-))K-hWEB&f=tjPgR0v8sG09UloYI)!v+jyFa^XQ?pb3%<7hraup+Ivj?AlNG zhOn}H3lE)M5Z{za;*OVo0}ADn}QDPM2~Bs&?S5ASh4sZJHh z{76HJaZ4EqtN-N7QnK(0yg>l=0yCbGPD>zzy+A`UE=|dnhrs5ra}@G)j|d{ik8Ry+ zkLt8%G9q^^!9TkE6t$Hg_P<16NQsrPdSl1Z=xXF2&y^{DE>$}LZi(PiKEFv@owGt2}iv+r+&w7RKgr{Qm|Q-oK@uor<$DAr7vnSypDsinGT>4r z30=!JqYeWPPbngT3wTMjT1;itFP2heL^M5OEW8f zlUAO_*4Bg%$?$(pgNT9;BI8osa33v@rsn1Xcj%P9gw_QjNe_lahs#)fgC!)&oLZfh zfyc--JHEfYEi7p!{ijL+_tQ(doc^91zmfk{j)jL`$|-&t+A5@TILK}hqjY@xRZv<= z*NJ0NSSpk5CzOK+10^y#+P8@WgN_J0Nfd=19t3nMvn`>GN*FiAu&oT7L%$s&Jl>v) zXPx1u7^vwoPAzfnVgG=~-Pff&z}AU7vv}4@V>W*hT-?>>&s_{5hHt*dUMajrmcgm8l8p&7Zpl07>UDYQCH@v4xkUctxpRqlLFC%w z+>EG6Rr%V__ZdudDF0c^RfpBL?FU^7oK!E#Im7F}_(S!`D*q(zSMk?NtEf?jT+&0k z5DqpdVM6F+-?#ZY8cvy>Ps!CIVu=X7D_>={);i%lH?qTNxX{4A!$y0-Qa5hg{oiwh z6PlZ<2_o41p3ZkZV^V97tDQ%FFUL6c1ahSrzQO{8b8@=-89U$eHuWA%H;h__YVYoQ z1tyWiUogKv!^qVh$GCUi)_7;x+mtA&P&x@~7I{-dN4%dL|5A|%-O%9LE_ZrXncE0P zvhbQRMv;u@ByjV#hxHCzjEAM=5B+pg2Tchr%rye3P?U|-k#Xs|=J9ef3xDJJ{<^$k z$<>hSZqvcA3>SyJ@2Om7i{96F( zHT)GwkWKT|hKUOYVU%o$QRjia%yayd)Mu9?p$DXEq!^6Hqs zk0iCR+UsEi_ZeZmc|H)Qu-^kDGBCTx?8y59UkFAB=2Y93^;>7$>vN%*PFxxC?_8Yh z-WVn>p<9NK3fqcIn=89951ViWZLX{9TzHxE=Ad2g`J5V=*@1gQwjL;y9xs&rx4+qy z)W3sprx#3Z{!oKn!>Bs;g5mNJ6`UD^@kVx%q(2dV4h{3SlW$^GAn1oS) z{5(9t`cr~J_WdWJ;u!Pd^OCrfOiXc?BX0e=**5}LYrEDPE(xLiiMJim8`)pF@jfHg z=ZJu0jDQIEfhHc4MK?VL z-}LFjOmQ;f#8G#%jFIYJZOD*BW(e-%()!T8HgI^rqUv%UV6DVmho1>c7w9fZQDfIW zsYU(Y&c)r{D+-0r1TAAplq3$)Hk*vCU(%)$wN)<#t&xKI`|kdejCTYs&q2+vHqCWH zIdoC_GQ)*HFbBD|7?J$ommGDg^PBIwO^h{>o5+28qPeYTPM15fsK^~^6;Kpt*_&2EpVskM@+L3jyI$KiW1|@MvyiKzQ$~OA!Zz`Uqr1n`&GJUj zFZMIc>8WtvNQTsHq80l2V?_>^pAEU&{d#pT!_ApSKETE<)i@1KeuHgjhrZec6hHPT zX$x|N2_w7A<~`i|<}Ld**{$r4(w{#;sJ}e&6Gy!Ut2|ijTx6b06Tg7Z-}g)|E-?>z zs(#jA3;Adc;8M1YIoeLn&-84Ao$H9#Mr@sTO zthX4uUw9J{Hj}`E2SA&k%yU7jl@S~{>OFG7s{+j*ec`A-ZpwMpb$EDJ)+&CTv-$%v zmQk49eH^+%^AN9XCIEm^H(`WE_)5f$`)b`BwRyYK%o357)V`o1fv}Aan{qlFI&F#6P4Y?~O@pVqjg?6d_VfAr(D6`NE&Eq=F+tf77QH7lX!GGN;)b&wbxJ(6;t7?ZouD zm=%#d-U=Zzcip;i;BU$rJrQ?K^7e6R&;`te~4s2}U3Ayw}XZ$cKb3VEI}i?ilOC{Qqhu zuEnXZ#NhvvlJ4MRfObf$)k`4l8sVjV*#nezSq{ntv*s*0qa`=GNUi_2UyW&}dOkdO zcsd=B4K~rJKAS>{#hLPU*gQqs5xq2b} zxmDoAPuTT%O%|X>Dy-;xrZ{wB56p3hl2^G`ZJMl#Z#BwMz z-Q!95!{`Q5SN2$01%2n~1D4#l^p)DuYE6E;RyF12Um3Fjk(bgNY*LXrB0QMS>ey%g zNp!ubYG1c|fWc+J48^VSRx>c3B1yPHkua<`>%*UeoE{my+ZJ%66@Earobf~Wni2yg zELH@W=v+#de!}TAZ`GeE1LDugQT1=Y|OvR(lP+&5%PbPaFP4(Bx`xyFm|vw7C#T)@EM|iq@UsleT}$ zFWKL2_Oc+I(5a^vy4jDP&-G~(p@+kad!n5}7Rg}+;BO|6^~h{E0NuH@n#2bl>F}b; zV|SzMVf{V-`fT84Ik|X{eA}yq>T!vTYX87MY*JXK3|b4F&k5BuCl)!vEF7WTiRzW~ z(RVSBSArNPYO4a5OY~LbN!b@cah5&b|XqmF+|PNb!#e&mi2YSVN*4mRg?+uFP_hdu<2lN(hjO8*8WBL9SS{5dRUH#ef7MBw3?I_^O!$*W7vo&Dfq2rPwt1)raj z1fM3whrE|MP>_wEe85DV`rWb$@yFb1vGrJBHolz@+QkhC@Ea-POsJ)OoEIJes<{%$ ze@uI?J?AlfSb;;ZX%oab&N0dowTYa^p9our`C=i8tT=jQt)0(kUF7i&m%hR8uub`d zid%31WAU*v!!EygxILi!(0dmQg%{iOE>Ci1Sl{G=aw z-@>MAUT|?X9yu%CH=N4+uFTYhUzj{ag(a!hEee%u1}^6bUm70x#`d0DJk5!ok*r7! zC{H@g&U_a6ID%HN>f?@yw$=4_u2LYGz6AmC<1j84osG#({fF4lMt10?Gs{KIumZnx zX&rsoAjFTD_6C7T&piFaSRor^72=8qmz+d+BJKJ)C$6 ziz;46b3izQ-nZ#Hoe2K--@$@ktYAzIGDASrA&_sWBg`;dy$Xb7ujhuX& zwgB)qScbXPw{6mrPNIY~^dO&C8Nwx^=fBSwSHZTwexp~F1%`<=Krzu%n;h92h%MIPr0%kH&4qvA+xEQU|9Qp; zx_?SmF+C6JpZrt+!!-l|o$xfrvWnR>f)3d2O@;!C)1_c(0XT zyp+tg9|{Vo9G`7@r|QAAD%zpLvVPb3@U@f{1j(VaHcOp3a4iXYzsB|atBMI4NxzN% z*O+oB=I6KSHu3*)byh)fbzz&u-QC@TLvZ&X!JXh5+}+*X-Q9w_TW|>ujk`4NF#Y{A z7c;{}R{>phZo2n5d%w@K7V)a*kgE&tFuc#?G{56w-MQ6A2SvJ^71p0`?FV2qUW-&# zH(O7>*zVgO*fqbJqOK(V=dheme^B|Ep+_rI;6-m+6eVs#OMnpwBsH}C)}5o0B@`n{>Q z64N#Q1GlUWd|2?tmF^GoR~-)xlw+SCm^Kdk)+hcKGIsStVe6O$XUuug8jyZvT z=D#ACcC)dg;TG8ySm!SC)Q}1=kW|N;5(e^l!k;KLX^|h0!6Pwoom_N-AG9#kdPc2M zG{ssKBZki0QZ**C7?&*mFw+(<72fxN6ORwFDPQO4Dw^9_d}~TjB18$d8}_>Se22bU zZ+X>&jkLB9{n_6_sLWH8RJ##UXt2>beq7<&hYVA4EPGDP>YNa7-OEZs>D!&IPQD*$ zEz3orvZ$c=fsgH;&4FumjmmG5@(u|D27?$f@D zlAMJ%vw(_m#MbEToHzoRcwKjdH{qzv#;Q7Seom?|?^vxB5{?ncfTMxdzsB||@SkoRz*j41S%{dV&jMeCl18dHl3jB^OFbrW zmmCCc-owO%^6f(z9UxcBu^l=^wFZ7J9FI<>Jao@BEj#cf&&I#b3MYsG$^#|P2A(# zi8e~c3UW(`Y|O za9>5%livrP7p|v3JF1}x;E*xJx1Ql0Oq`P&5GX#`-p^i1-Zlw~4Y%0`QV9{ghM_dS z--(|U)O}r6pZFZZafYflAkAFVB(r@y!e)Gaa7d0BW|}LJk4@2~Ux}UM_DQeiD$dWY zu&Xow6~^o)@jRFx8;502S~KPnXU^BrF&CifxH(cduN-^7>ar8RWqe(+VXK&DBMv3N ztGPHZj(WHWUyx&~pEjozB`5dt6_=oTX3;$hlv&iEg8ZnIm^+m z$(;V4K9szP-^U+^EV5tL#?nqq+q7V!7|=i6+Wpw3M?qc1rRKA_g~^}gdE-K6V^zQ( z$<~y+xki#ooQ%a9IoBkF#AiRd1u|e?#yN9NYDNMa{hSCE(Z`6+|4X!5x*7O2PuRdk zO6PVU>VLi0_CcWu2Qd8hx|3f>iI6XW*5)ZS-gTi53{8ZTDb%y0Wl-SeKZJE3T z*hu_Uk5GNySIT~qM(1C}%8RJe=lIR9mrRy}+>sH#3FUubT^kTtief}_hsJz}csg$V zKe5(hZ{7LtQ!{=PsO{Q;yB_rqNb*7C8fBYvGDz%g9qT`9eQU2IDGrQu&GAwt7ZpLv zBXd%!sFJ5waY0;Ka>%PH;p6T641->q;yv1*Mo3m4n)_#Dq!hK!o(RP`Ki^-(-og zd%D`^4MKDzvb_f?p#93g@H@~1wT$9bD1U`EZK&%5BkWc;IvJSA*e zE1yS7>Z_g|(RfC&itNo(<>LFgtlH_0qYG>3*kBWdqVGA6*tS z@?=N%+UAot(0TpXajW2B4sGd4ms&$=aT!>gB@`pw=qfx-1FZ2xgx!*u+MDE|AGZsZ zk$-8`Xm>f5oOdbz`i@F`i!;L0m?1g)H z3%7zwnf2W$*lffQ-AEJfV20c?i%c-19duVm2vY;+N#O=lmnTnXTv3j%(_HIjD;n15xZVT4$ZsZfmHx%8TKr;zGY0*7P_| zS!~d32oDmKZH_a?#6FG>;lbs>EwBA6R^ci8$e9O*v-ZUtWbrjpkH4fg*Oi}{0pV81-1WzzLyga`~r?swsjm1E0UUw1YlZA zsQC$PP}*N%hnIEteF@!Wfv`}f@sK-jV zw@0M3@!co&-dR(TB`6r;1SUS*8O#~Q(7jO!Wyi@EQs*UBzCL|T(=HFISEB|l1|(W< zY5@J~s1Tgfay3$o(sP>!7I@)+VtCxHLDZiKzN>na;)L5F%9aDU3LgRaEN0K4<9g9d zTw>6KhGIBWf&NgY0qlvj%ZEY$6=kI;`f76-_#&vLh8nWVSIKyNe4%n6GlETs>UaW( zK}f2$Y|k`xFK<-~dr&CD^_@V0M(y9ykS=-oYzHPDKC~il2#*!rOgd8V^?wn+{?px7t5go93`g>OA*`2U+@BY_=3&m1P z@mE1ppF!3>zPEXSJh&xEjYNT_c~s0;W3B{rOT-ZuU_R`76$g1Hz58z=l{SGgD6Vhh zGCpanmwCUJUscz3{ZzU=+6i>ohfbq)VB=n>*!TZK(lD`|FFZv;u7VtZG}uGJoG4*N zOlPw36g(8*K7nxcDft5n=BUH2tP%7e^dHUv%l(_Nh)D6v-_^6 zGu(ot(Q{Mx?vI@5yQ!~YSmO!}H4)-`ijmFxOsniggRjkuC8Hzr*Og>rfPnmky6;L;(A<`63Xhi_p1!(3%_CaxzsPRMrZab!3O+T3xw6m%KKRH|6(a zyk0pmsrgsJ<4rC2BeV}zd6o(n!xeO$hw#p&lU}X($7Hh;7Aq)4#vp$ktRgNmkjiLP zQ*>pwLh;~6c*=e-oA$iX*^}z(7q0Z%V%!S~QR^^(&^#C1cZx40v}@P-DL6tVT4Z{c zM&Nmb(Sr>@{RapNu}Z{;oi^PF?AAB%o|Wt5L9&=<%Vh6ZiWA+zhAVhnH90*mwHYq{ zszxWZntbAZc}urpA-OMq67MxXU%I<&F!P3ouHg4TpFdYc%PNpC4I=f);Bxw^riMeh z3yc?D93avJ4CvW9F{M1Va9B*y6=C%*y%18Eygq?*QG;h{1%RXxpUxEs*2%#qez}vk z6Bc(4f>|s=@Mb`Bs1g4}20^$`6^}QT@F{nC&fM_1jeDVIG3=6U^ahv5!ov{3OLStgPv?@zR9Y}5yz=evD^uz!Z(;NE>LNJ}OXffEX$pgDj`Z!2jKSQ#lPr-FZ2rp$V{ ze|nDCZxK2OQ6Z1EYQo1f-PuZw;DgZf}%|Q1juTs6uqeZ^{3Xa|6--_o;h6 zcZ~kf$&u?H_R7%K0Z|<@LLKaXHS&D$-odz_RQi#Wjx2_c57ufoIqn8my`+r`l!mE= z@!hMQsae^&b*!kK#0H4s^j3wJHT1_?BtE~-3&*0WD*|M>jU zlujT-h{XSmK6+ikSs_28eOiE925sY@fE&FSk$qn@CG^Uiq~`ni+rvtS!{Ghv;E+1j zZ;9po$HwwK=gLkg-QXeU4^5J=?wsu*gyMvze@ z%UYzoAr~ML34zK!_U>NoCi*ncRpI#pkO3q8Pqg&4{tE5GVS!lWUMmjK^c4|YdMTV= zu)CRs)nM2W6xr? zPOgX=;bRJnL=jWcAS&Xrptx!MKK}gbX6kEAYg}i5q7D)lLit#3yv}(QA(gU_4!>9k zNxhs)EA^EJ935X)+k`sEp!(C3ekTroEZrbG1J5e6<0NJn9P#%L>lCy&y@_2?9}h{yGR?H(P zAV5ruxXwCAvwD)U6;Wx??^5P6EDduB1GN7MlX4sJJ!r(jx9<&?zOE-(n_V`nd1goQ zH15yBEkR-fH!@HA^E{8pzsTW&?a_Q<#|ZdDSfqOjxjB9-hjRn^g5I+QFKehdf3;_6 zDuK_^x`m-tGbwUu>$A(MdOf;>SLup~%nMf=E(Ff%DuQ5coVpeoDk4`I8@>Rs4hvf0;%ht6*S31l%U1)(mq?hV0e(ypt>uj{-Ycz-JNW)*(D^^1D zdGSAs9@D=9`RZfVW^R0qQ9+;w){PWJCYDMBA2Ygp+tQ^x_%pCPi%&q=kR+&c@!iKa ztH;z$#ur1OS{6=nJW68N#vtsVYsKW0+nwSg@Eom?4Kk_%EW4?8JyD^hn{6FDzB zl3w22vcW9G+d?l(YPJ&|3x3T%TvGD_3%I_Nz&tVsE0-gq3ep8J35)i^&ZA8M} zFN{Kl%Uf)$Jt~<4rXzQ--)?R?XgY1RRZz1GR_MDu(3s3-+Jg2UgF=f-J5f`iZQ-Wl zBn?I+r0oquxUb$n5mIvO25wLpwr;m=;1}x| z?)p7#vj<$9_=C>VQTVk==duL{R+l2l^7H1n=WV{34JX#$0}?c`e$zYl=(%OQlGl>@ z_r|k{I-w4DE^n)NZ~Q{Wybg9QEU6^5+INag9zb^N>m>Cd<#lH9A`w@=sNkD{>WF{3 z5)3|gdhB0XkFChxjt1IqLK#Km_lz2wrW}2xQgsI!h0i_;xg>WRJ6{tY2YDC5|3345L7BR*@s44yuh~!j@y^jn z1>bEOP-7)P!twofhLPa#u}x9#<~>k0tILgMk4qoa_N|-rIcA&J1cd@Q>|{xq3O^tnz<=_W|AcwEA_Vk4i{4 zM7*=}fkeO;g5S*#t($)Lgys(#y{Gd&*0%}7{Esu~iq$*tnli^@%BI+;8YuJZzL=f2 zR%4(%ewF_#5okW&bx)yn)d!)|1(`t>t&99?+N$gO_vJ)o5Z{!7e#sTqVIx!ax3yVdMaP(Az`h`S2XuoxBG04i*L57uWmkyfI`vtNFXq@dwV=_xMrOXtNd zIy^VzX=?zT5+vZi8L$kbc`u-)5l07RX~dk+O2Pe2H3qd7iSFHzcaw3M`)#uP3Ee>& z)$Lj#Mb&zF*T+Qb*X)htN{*gNi=!0fgHAh!*YAwxOcd!tD81tyzT55%Xq5kiA`HG5 zW0CCW-g!IE^+W%$o7S^&;Ft@m_xMNYOVdBumK<{_`$u#+QX98g6jwLk9NLqF*7@Gh z-IZ`WZGvb@!{I955!%KI9y(A9&DW_d#;V9&tf zh@8PNWvCoM99y*4)bn{zeazBNC&?niRtkwm7qDyb6;N1kSd`VX)wh7h zSG7Z(B3gjdl-?fp+n2_5u&oDJ*<*RKWuQ#&9YZQ{Xa1w&<-UUIkzO7uVpP`sfy-J=l{eO zgl5scra(0N_eVrtU>XAO#QL~maX}zQ=~(ciZ41^bfJ(wW#u^wEf3T%L)&I@l^O;b~?= z8zqt}*9Kx=yLWi5gWC1B=aTya6fQ)R9iIZ^vHEeo3Wpx-{w!AtIzP=)L9n8;oPFr< zA!7(Zz<=3+h6>k+ml0g_7tr2WA!8e4I0ZJ|Rm&wlDIQ2L*kmDa2&xP1tcDZI{UTS9Hxm3dd|RWFMCp<#?`BwxCRzL-6}%B2 zKWCrj9d3aoG6w%4WyeXkBgd}+al5Z>uk78RZZ=#Gh0%9Z}UU_8VPh`M~cNcH6Kng!?5_Iqxg)iqlj<-21mppPEh|6`ru;%{Wh z*v^wZvBI_ zs7xO5#e%!1yhzFk^>1Bm{?XWjAl4 z4mS$lv6gwZQYNZj)2n$31LJBFB@*#9QQ=c~CfV6aB`0y^WpR3FMeo&V$ zzlVih4?TY*Vy=Vy*CWlMfkK$70z3(&5|mdr^@B^_MN$Q0a+|8{s=5g0|LKJG)=43; z`xcSg3WGE`TD6M?lo~zgTco)qPkgG^WX2>f7=yj7m`R2PRG}{g&7L<%F&QYo{>^(z ze#OxqOl}xmoJj*dPeF%q0^q%gy(qI-#GzJUzLRX|A3J2ZWqb0Uyg7pIBtzmuJWdBt z5RmW6%G$9rb#_?Tsbn;K2xD>i%_}gsGdZPZxY2U+OG`nZf9H8(AZ}yeA zxFpHhIdxpJ1y-(D69sKBs*L zai3M`yo|w6<*N12@*VDLnMqA3MWXr9FHI2^A!e+ESjyXvI?7;Gky>S>*U3^&ILM6- zTpGY1vG+&z{rW7sft_dc6S-f>0ilzGXjX6&4+Gc-T0aMy8r|epH*$_;M7hGio>gDdn_!dUp4HngKbka$jaQd7Wqc z3Bw)*LKlUM;^vs!6$ul!xz6ji@2pNMRPM{ z7h5W>@(jG{BdY-Ri5b!+W0(D|N36rv*M{*UI?(K`ERq}Bh;TexS{;;#$NKqI5WV;U zD6rU>^Ut%>^Uv`?A3IV2#Q0ai@n5fBWGy{01CQky#B74IQ7IW#&Y(aT9m??J@__51 zT7{vbvUeSz5$E11vSm`MN<7ClGKzSKw!^vzx+aqkmEXbo$*(Fx$9NfyEg_w%Lj(N9o z2gN{j@Ikxq_Y)RHm5GnpADnAw3I1)M%B{J_FLEg#fr>HzS7jxWjOfI^y9h?L=}V)x z;tF}gcxCippbFh6wT)xBmVgBy;o$z3!re9>!+b1e6%2#OjC%&HWDSAQ=Y&cQWvzNjSA*J3$C0Ah&)*`AaDlvVyg4^vzOwC!1Zmo8g3`i&_ zCJvT(AbOcj?NMxBaore}9y6}5?`|n)2K+rox&|XW@iZzrga=A{kscbY4zBH8?B^Z- zCmcltS37h8MoMYt?b$D@J0hXcDq@Y1#pc@TRhis=8xoEFW>`(_vXZ z&7;?W@ySzv`Ja0K(Rmz8(P2UWp^%^D>@Y$cWjAgAiF{o^pD=R`=&eQ7cqP&b9nyljV$yJ|_!Z1~-Oe130#3nQD|a@v$Cn2#+M~Jsz2~8-85f_d#!b+~fo&U#o(b!?>woQ`anbb0T~Fy!)@nw4VpIr} zO%9GRQ|!NHD|&lfF+8&jVKDjRdMU!r-syE=cWL%0;EkWXwjX+YN*na~gK-IXMFhE# zd~eX7_4LQx>jIsuNWO9B=jSAM8msax1M=eq`?{j)q{J&+Zba1onU~{ATaT*U;vpM1 zT(aPuZcQ@gS5^tzBzP!X+Mn8+XxuIatc#YX_`u(EkoG&Q$eq-^!$cEv=Cxe+1tpdV zVf9*LQa+EN1K*T9kEqphw;-Fy?*+vRJe#ZpzxiFDKy?c(y}!UwCfd8fdo+pu!WC+B zA#_q*yct7wx_5UeK3-vIf;PYu-Pm_#S^?H|9~LIT;XqvFi8lMc)hB2kP`rqDXs zirB^{GUdR*o*~O6yre!Qap^~28Fa(-+1emU*jjgG*YDgm`jfF0<4IZrA`f-9r(4zC zg~D9rjm+7QE3p$Y8JANo4a8D&1`)Z+mpfW0Z%^9S46e zfVlq9g0-6DZ7ZTYK6%|=07tKDdxz%^(w*l?;jz;dKk-q8u^q>0ySGpC{(k_G(VpKx z^|m&kB?Z*HES2wx{{8!r`jH(wCdoIw(CXkVqf)XLcNp~#w;Uk|Yk!uSP9c{ZUcO?C zjI!8boT-#m$OYm3VkK z4=O zW0x?VainTf>)pkkX|mqhHIAO`&=Fp#w5<5)OpSjn(b+%P5AcM3zcubHDSDaDi^8*^*Q>6-q4jn zu*%P=9{Me*w5dB@=;=Krlv{lKc<-vTa+M<%pj4?~ zjBxw@)0FuO9pg?2qTU*fShF{vx07_hygew3BbV-1K91J|UI@HS#g#ttXWHS(C7#r5 z^>P0xzQ{cPGP&n3wjc!Zs&U>k!8?nkVVqrGY{Evb4+JcMZgj^VAd78RK�=2e0X! z(P6O`Ur3(l0{IqXgFrRazcoWck{dU{6+#WT?=b>&L`~KG_EKU$c(0zx+!WmCDCHn+G#2WW6yRyv=UojH>s!eAP;)84cN1`HhJ>^G2_1;q!F{u2N^#Y`IpgKt%%${ETH2Ab;GlodI}dtz|~3oO{Ky0`xb&*{fND)`s9pz!B4RP=7<_ckXaU~ z488l?jl62?93^KMrp#|bDe&2I22ZM-#BVU|6tt1Q&dJFx-H3$h30Hm!A$Bmpu>DxG zZ1;jokNX6XFs3hb;(}SwDSUN#Z%K7vox@37{rROHzx0A=qu#xn4XLl_EBdcB;pPwj z6r4+c8Gc;x#NBgJC|5~1x)@g+Ttferl)oc-dOtI3_Pvas6ZS@W?404I{<@TJ(6<*| zQOp+~>}n-9Ki)))9)wnCnHL?^yPH5&R0n2)o>_+RZ!EuF^I2U=lhB)J7VPVL@7Soy zaKrU^1%upBW4u`kue)Z&|Ed-|-+e{abh(l7wjot^$R%pG!*s}T6+5h3&qglUD42c*UldiyadHB%|iN3p216R6lm{EFH_IIF5x7lUMPmcflLFIq1I%M1r%F3&1IT5tmT{-BP2A;1BD0z} za4a;#^B0;AL*2@Zw;aK{G3UA$EsV=f`EsXmkPs{Jxfe2rSGbg6(##f{jiE$fSD+^< z+nDX>>Yxf#$XU1+L=Tk*7ih92Z1LC6&p__7gSv%}VkI$%C?y2&mLc(fP;9W!R9rGn zo^JpVoAX}q!dOTp_RdhrydUh*vLEOq76_xx2RCiB7`ayEITY)nu(ajD(|cZ562@vq z9aj9PhQBc8*G(KYymy@23;Wii*851zs#L6;IAw*pF{7UBMVMBi&g$P$-u$1bdhc)Z z=kM1s(b^eTU1yJ#ieiFqR=+oYK79>nuLae>f~FzIBqBCGV0MyxRsQ}7hlpjoT(}q- zL)7ENnqhHAQq$4?(i@dStGA{0q8+ZdImhv#dGMsl%0wmgTQOa|cg}RG3y$w^29p1r z{R79`7CmX}RflW9>Q|$4uKl6bYuyJdNW{i4`+|F_u>G2lMa#44VRT(_N=C-DbWw5r z+Hje?naQja$S1X5XTe%@6l2p0EA71~az~M>UOy(PTiS~m;qw8$Z&d)t7%xEwP5l6m z!+VW9dP2GJmMDnX0$Rt&;3MnBHuuhkprm*;M}pi>!wMG$54xd~apsKhNAZ<=eyHH& z%lYFVj}fVM7M48Z`%KO3347wOlO1#!=cL4kmN7EfUi7Yzd4z*LZ_J=TFg_Me@|)y? zwxm1p2@cJ%SZB=is^Ou0{mAvZ9-f}^$fenl?6!Y@Lp*$H@xos1187-9oNkVfTQY(N zw^w5mi#0QSeV>;%mGN4R2lf4Nm*_)*2zi4J#~g4;og%w#YYvCc!f5##5f@3wGJoj? zvWUL|YxZ1Etm_9mJ`{_}AJ$8rS!j;AuLE0Tw$!3}n~*L2ZWwch7OR&>cN;eh&#puO zEpnE^j$orRm1(PO!L^ky&j){MpLOv`na=1I07B5$4Vj1JTZVI{zvJoxpiU9WU;(*N~N`*p_rEM!?SaDlek6#+VJ@|)070K6d{5BM53?9q=7}o zZiqK8L1nPxQJPcL{)RgaXwI_)Q0`@gt-GwITOy}_y~)w0ZGK#~@fG?%@~rp1QX%h* zzs$g9R!g?e5L2HLm}@Ew?6Kf;{4ixWNUhx z16!yxzIJ{BSnMlB*uHrx0y%vtB@Tql7Ry{OuD9>%+{uJl!h77_uQ`8XzvXyeuLUkG znLfI=A#~^=bbTx@-E7wT999DgQ0dmro?gbYrvb*tZpyzl;F#gLKr-phKvAqCi(&(A zxUM1i78P(3_!*LT+^Fo{?2+GNYo8kJxb$ppX$)b9k`+Wc-T!Q=_u1#{z8gN{Tp|Yz zt_6DqsYR;8<9mc63E&`pGhW=K3eNP}zx2$Ug(6Q6-_n+IXs9OPx<0@@LkuNSXWXMk z$RTe3PVdXp{;e1RGm4&jj^nqGd)&s!2U2I#eN&_rx({?#KG0v4}W~(S`~lQ03g!oVN{6 zt4P88CAN+bhvic+MK@5@x3-Pw>qsn1FW5#BDei$gTo#8!SLL?AS!>QF%a3~XQj8qU z$V3bU<>C8am(1V9KN+Sn6NYcyb~k%~nI#I9^jFpsy&S@7tPTRRMtYAP6VTtYp5>Le zGr2x44?DBqG00Kf)2N#OJGZm;NpyNx75jy|bdD{)j<4iV#D^0Voc9H@ev}5QVnK1% ze_QBz=5$FJv^{DRrh>MPMW+=WZ4sgQ>elk~0#sj@B?(s!toPPB_~zRhlEpC_nRrPV z8bj9TCD8^pz`3%C1wQe1W$xJMCwz}|(U-EO^tWI<#%Q8>#lW-i5MkAR$*H>?X6ocr zt?d7s+!`PM5q@~9Y{}t7hJ{$*eOkQ(e3ogyCQLZ2Gx6v4*pc3WPcC>n|IuzzN4{TI zFQQEFSyHk=C~{nYoJvf|qb(euIeskU-WseR;pO9J!x%FZwMqDG*_HS^nww1|lbcAS%Q`7(<=IfyJ0U=m25qn9k$^E? zk=BF;yo1v(BE-aX;>YU+U?p#)m~8||coFe!*7$J00Kg{nos@_>H-J(66$D?mq$gQl>QB*58b;ejyrlhxxYN9SV~@ z-k?&tJzzZBFy9+k4m-HgHnHL|lkiwzvdaL;!iPgoZI~wS zY&sUk)y!J6+*Z%|cP+01n_5U`>cH>yuR{Ws)Jvsc>IWeDMgqZj$3)X%i%W!(vt@5z zlRsW#@LFpp`VZYY4xRIpUOXkdUuS;_!$<*RX!qH+)ZGAZutLlL| z0-Z#1ecqn4B4^VlWUBUnT?1~75TN_@yevUFpk;q>{K*2^xV_Rv|X74yvgU4`6Is7FBxU72E@bz zVE>)%(XVWYuP0>OU(syvvd)iJkV?EMeMq#fNG!D&sHt?fuxQEeh!&P6 z#iIc8toQR?UnsoQy-Vh=whnW(EF#= zi8>-`ReN#H@NkC1H(;{$l+$*f2ga*E5%~vwr03*q!u|8lv~!K5%<-ifW?vrTSeqszehM1Ye(4l|9C(um_1>C?d4a(E0&ueZwQY3ShYnV;$K zL}D(ha5`+XV}N#sGd6~rjR#yY6D6L{3z9CG*d0dKLk4NFedUO9u|x?57y-wC|2VYLUhN!F6TmT)25OHXZ4r=#$g zyJz*G76tHUhp7K8%(n}SWm3oVCCNBD@=yw*w`xO@TmZ?9WBGz76s#2CH}_yJO2Qw9 z)d{V?DfbY}HLLr!Zq|FnBbI+BWM>mIWa7JZ1y|--T^aF>ddi{oBTw6oPfm!*ZD`RZ zXW*eWtwE4h_Ww=|LW6oud6@T~5^Z#bHl4{_OLB8YiZQp6crx>uva!IaY`*I|jFtH}Rs4 zgMqzn`aHf<^E**SR2B@7s}s|7z$XE>lL@+*LS%DhAv{FmqFX|8Gck z(iNsgi4^LT()e8!P{6VhJtQ8$CsaemuRgz;v8@bvapcZ~QO7uo(=Lo@y zL;Gr;UIb<*jua;g%*kFlPb5*fOw2Dv8->5YI*jB`XvGIKUN($B?Tbz`J^-gYL2anp z%uo$0=OSN`*F&DmQHjBttoM8L89y}#yhv?!f8?^)bB9dSSW>v^(o`fDZ zT^c%kEQuR-WH(sj{+$4CLw|PrR7O{tpSsJ$r<#ZxL6B(YhhCN_(kZTxNihc~Ihas1 z*IprEaL8sZm?Q3w>~+M1o}&(?}V(#ZXl-tN5U|RK4o4{X@m86XmPvomi3h zM__XQglykyeQyza{Rd{3#oNXz#F|Pq9z+LT)KX;$lpssv4_*h}Da%Ts$c$kd-~?Vg z#m=9>HCOEAbx78nPfR3>Pq;p9ML%mI4|b-o_z#4=5@X=O{Kdn5!DD&Z=MbKyXA(N4 zanZtsOtjr_PsrwX+9P=1DFv%tA8-nuuuKqcOf>%Qni zkGu-zr}NI;P9KEZH&V#-*(O^b)WV3Az*SVeu zh}2;Q$Ez2&c4T;413&P2cmuc}ppwGSNNiF8xyvbvw zyS+s;87d{3@<5ij0f&`4&<>C4SVT$~t1d7)!uujw$yPTkWa}JFu2r~Qg3i}ckiCs1 z*hyRHfI2hbDCx#WMh5OROs+QA)_V&|suht(B?u46QmUbkB*tZo!0-kP|2AB(}oAcw_zgSQ#M zc8gGUY~(TG?^C(EU#NXfn+~JcUM^Y{XJQV7Scs?()msD6!@+y{>Fsw z%2L|QC`0l14420y(y0w>=)OV1joiqLzoC629CI;Mygt<#RyP%|NDw9INx2t9xaWRP z@(BxQ{?|ck$E(7-srfS)SNdwA1+jdUq!VNg%(v@*O(i(+ccFz^Km9==3l={HW!0Tk zIohSTOwoTx{y?0q^kGer4biyE5l+=9!CIh>W<nNiu4;ZoC1Co}LQ655ZcQFa_$Ud&Na&~hyIDxlzu-eW>7 zLEi{O$z0t-fAy=I0f&;=Dukk|J>E6$%n-rda``&YmMSavy&drE0r&v#E4eOo5@AAl zx>pr&1zMK#q`bGZ4^nMK%?B7-GXjnvkE_j2-uikjTyqZaKmuCOO$-Yrj}J;&ib93% zMmKR1hhZCmlbu|bvAu&ck;yOz#U(I>j|Q6FRBzW!XWruytwu_)#FUW+ZOe<~tpm>R z?huzumN|^4krlMO?j*c2Pb-Q8uJuD}sG=V_xPzmd*i&@gtInue%Z>s`3AzACUjDK- z*D_$LKuL<$k7|?YGi;;8J}mnm5E;_F^1iCy-~~hv4$b!l4`tH=I(&Yh&lq$^6_P{# zl|?95GnEC)*Oh>FXywBpXmoMJ?!Uo5X<*8O;7Qz6tN$^jqX+G<*%t=EBih-Hu+!Bf zi}#~h3&AkU{kN;$Q4vFcW^$k*D+8V~*lZwoFjy}~4;skH1Ch~Hfv_Wukhb4kXFHG8 z?-FF!h~2-$aB3h5&PbWxw2H9vH}O+a6|9_rQ!6c@74+s7_~?4DZRNzyafF=^e`IKf z`#pw$724x|Y#?(UM8=o}!p>r_Z8TRMeaue@41CC5d;~+1__5KGeeOAzuWJ{gfel!D zLTJ|0tB)ihvL;ykct0e^E-ntUP@Zpz=;ki$>-K*@Pa(5d{$b+jZ1)SGdyEE~aZ1wg zJ+I;yDiG7JD4Yy&Spo0otKSy^(F4q|Fi^-tdM4-`Q!Md+ zvGtD8k#*s}U~H#j+qP{R9VZ=hY}>YtPRF**j_rzVd+PnqoteAtnr~?>Q%CmkklfC1G1Nwv(eC;^>z07q(P) z&6*KrTM!HV&H*Xq%wW)~qOxu^SN&)`&<;o7djZl_4Hu!>y5eHR1YzdW1S#rC9Sp56?+M(fg)Q z-@?kE!y7Vl-Zx%55*do6YJpw@di_r!#V2>MBuyll3ADTS`NExdf*Xxn0F9{;4u3R| z5H~vULgg>SojXM)W_(wXUK+kR%{}>AyO;g~2*lv$!^<{<1s`Vvq|-w=g2At&U2I6D-VVJn^rsLEcS1)x+1~ ze7CW)pK2wNDVKMbYisDrVYE?ss47UBv+-=xmScZ$28g&j(Q0;m?*kIPY)QG{I4)}W zAy3mb3@wQhCa_`gbCctb25So+PXwhoSWsw-P;Rm^byI31LU#|66ELrdcO?4W2-8>M zu^3%;1vbX+(NKAM(Nww2O7f^lVitr`ejuv+##if*aY|w-VhbcoCw(q_l!ujyM5=fx znc$i#b#hZEYOOVDH!P>1$bIxUPvGnRBYvrQdBZy6#9ClnaNBcE8)+@9YSLUcIUzoM*Yw`6nR{#{S z186UtmJX++i(Q-?cm0)fk!ZzEzvA(9L=ZD(O;TTS+edfPxs@uPvim<*{^uSt zkIvmoQ4r`45orz#Kp&*n z+4-2P2#?gwwCWA}V^&FgXY!WV>ahMYS+U0pEB*wdPxT&e{}zJKRT8Dq65*-}@7VJz z*}VTQpk70Al%;u@@VI+Uruu%F;Ethf!{&XE!}fkAp~eYi^+QLy6B=?Fxsy=G!G~1p z1=Sbw#FUBOf_zQ7Sp;m2g!6*HzRsdHBu5f3O|@^GAFI zr4Z*%C)hJRlLgP|iKrZ};vZ}+jtcZv7SeSVZOFkMLsIG|k@_=27>dXP_bEXY8}BdV z1e+~^;`PKN4ZUXkj~ED#qNS57?4Vr}GMnm8W?en*dCnkoL@)g6)6v~CP#1)?Ledo_ zI;=#_!y%&$LyKnr7DOb#qEb(26UMpn8^C+Dy&Xp{6{^NLykAZll#7=ieyyFD@;bA} z9G!gKa(i-ozM$aQmSEmbY#H^mD{*4g5QN=)ud5QJjeD>qt@|AI^ zL04v97HkSolZu@C5Z_~sAzog8gG0}pTRsA~r^={q+Od)PQU2{yp$Qi(--!cGNu`)< z?b@XozC|~G0~1NJTjoc@a%po3q=j4&_8cL*k$UkFxt&kMY0zm`bgyKhGw$eI1P_VU1yiwb+^gZe9wA{JTAgN5R<#|bNv)c=%_1^Z~~ ziNH2y)_#l~s6(|-(8B^T%kMy)J5Sluuv zU`1t*i&)q%)RQsYm6Z&ezh-uNfeSMbM09T@6lt}WC-6yD8yLzEwte;Xf2WOBarxJh z!M(!{Lt};a3#XAO1pcMlvW9Z z4DN2wrjvivGdUMdtmu~X>c7zwlhgu1+70bH{CT9VHhEjdQ7+lLw{^7^G<5IYL)f7 zkP=jh!$7h~KGMS}-k*&W!U2M7pFsv>hZcAl0%AZ71dMJ_NCF1MLO_uIQ^DE&KMUX# z0TgDNv)t=Yc_a1I8*hvBi!l!pFaRCk-DDAf{NPqKBqO-cmIxiZb6h{zM0#|v+kcz| zF0A=PcXIb_kJ1cyF>d{Ku?o;j^+p; z^FFuiij~yR1$+5ohD?Ds>d%PQE#ULn#MhG$PHje>; zTD~BPtm3KOz$)zVH~eOn^-aeEHey@<;bi~rR)+*dvwvySF$0AuITAtgCCT$*B^ql# z-eFzjR`Ay2Y?61KPwfxFXml2e)0<3Jho-#X*Ed3J#V@2IYi|_tdIRkIK}vK}PJe`n zJw6h7YH{B!p0Tmlzi?@h1tEVH)Zy>@98YllAr1RrG)@^~+;E5yB*oO;P$IjzY9MnR zuHSCiVgLonclV&VWi_?G`*t3dZkEmy=1zpu41+$B_zyOl@yGw@V7uPU{p1RYeU7K8 zwHPcL1O;NrBKl9n2XgMrzc?ujyA@@lWGI(R|Bl9^c0z~c`MoGzNn9pvm7TNfdWC~x zWrbtI`nOdO)f!%o$YJr;U+W?>wjvcT0YYTR0~tudn$RH+H1Wt8wv;^t#*~(dnurOv z`=|}NW<#SH#8A8|Q5g0`GwWy`#*>XNevfA6`=`^~IJI0Nq$)(5unq}zg_h4!v#_DxvfP_{ zKt{u`)l#$g;2~wygxE4L54YuaLkzmabLeJ*d-gZO5ua~AA9R7Z z;VyBcHHY1Du7ENyL^+MO3%>l#)+w2^sqPdu9QvMvG}X`Sf%q=hns7FMi(?(6SOfHyuue%rt%wFVcIIf=kKv*X^f=P z5n5^2#dVqK753s?R$6q5Q)$OhB;*N?4!HF-b4fj|8$aF}Sqfd|l+RNd!2#P?_xY_@ z+0HwE7ZP8|T>Sz6KczYD1u&+LmmoB)6qJ&Bkw#mb5SHKb(Cae3mO)>hS!%6r|5WqV zC6nKVl4VLO&)CrV*tbG&4_1Sa2m9q>)R%2&q~=ZeuvsS8FS3O_=GurORO%%x)~n^# zz%sdV(DDS};9tAdQ{|Vk`5&?WiozOgB+}7qmij;CCLGP=B^i^{Jv(uw9S==clyaQ# zIesp}{}XMuxdi5rBYlv&$sV+}WSDXSMX_>No!S!#uK^>fp_G9%LBahXWKD?R1U5c2 zSrl4V-28TUFCXPBfdekDJV$+`vh*;i^2im!SGJWt!Sa9MS@zW6mD_Ci8mmg94%^3e z9F-4w^fwP$`A85Cwen#)h{>{tV1GjbV>@3D8YxLdL8Kgjh53g6|F;bPue!|5uMD<2 z#!;BK5EC%c1i&-gADaHRCqWg^Yyum1j<<{J$~56-_=Kj8^ep+m)o6cCP<)u#k2%4o zjO~c*f0z;CqE8;Al!|-G8_MdnFW?%S%yDBp8T9 zvO1s{STKS4aq;*&IkfGf53tCx)HEYEzN2ShWfV>EyX8=8vVy(1bNqGe<%BBZ3!h7D ztkZjCqvwET#(ijv6nmVILTNl5Ou(`+_dM`uIN_?{n)0uTRFIe&Ug{_iTp^Pp{MEedqEx&Xp2;k zoxu_fh3JXar*@aFCuf7_$)-zaDg|kPKvZK<&GD|r;rVszoWz~Ci}WDyE%5?J7{Fl5 z_huve;1xA@N-u70j|CRCQgAI8v{H+A(}`}LCidn9-OknH6|~63la;b|py!~CbZ%Ci zver32e!=iZX0@A@0J&VQV94*9wGD0F44yA>oS5MEjH0?Lrs=oRfWNTk`uoPvxZ$}3KbphQ5Ry>*v7k6!pf7Se1JGaY9^ljWwbOeb&*3Xk8IMX!JyKS|4xQQfMI%t#4wr z8T)h%eiCrXB6o7Sr`Ct;KJ_bt_NXQs-Pry_bR`}*$>eA#UN8W>*3EcIpj~<*uWQwe z@}DG#8nfKV0DA@>R6*}@*unegneKOTZM{!{dL)AeT%rbU_=0zq5hr(ImejuC38Fb@ ztUsCWd!p{!A07e%xTGa+y`@q0vm`l=6S90Ih91*v{pgTqyKr_Y9CKBw&RTj^zZ}$kG888(gdd&8IM0*$R2Ts3RB%VK8$#A?^eWH z^k=t`ap&)z}8KZ{)sPv(1$x&LJ-YwZ1Bf9|~LhGdB1cx&D5NQj0@FDpX zuMYv?-8)bdmPY5x*$`eHl)RvgwEME>6ywsuqH$wn%Akg~AVI}NH+f15oxTN6cWM|5 z?uPKB3vhfT)|%OJSG`k1`5RV69ILY?d94R2;|3?`3(B44#r*K*iI6-cW76b5B)d=* zOqJfi&5{UG8ZCQL1X;1oN!U9=e^q>~9XIrRX~g;T&(0@ol@)8#3||BbXYR|F^Ejzp z_;TNhz(NsrLyP&{x7H6LEI2)LZ*xn`Kz$pBmYbT>AT` z3gD5Z2&ov6TudZF`u5_=Pgf5nYMy`e4v zUi@Vt_j=GmQ83<*uf0$k;zFKo1kDyLug#D8zq=2Q-1iQbWpngO##g}<_yyIvAc+J& zAGr}wjvvY z3AmS6e$eV@&!!qGRdo_wZ+}C-NJF<^d)QyeN~(SoIs%ndjqd&^I~{Gvh-9sp-$w&s zLpB%Ej6>;6*NCa~{5{>~ST#s)`%6z}z~_@@B2f2g_Mqo?zMzqnV1mbE)QBSB5P!d% z?f&=c{8t2GgxK|kA4wUgwR009N24|O2c`0XjWfSsuNmFCw4PV9vttd1{?L7P_4SBU z+*k0ShYrGKzDgL7X&0*I!33(b_}ed4KFYuN+gVOwQt9a@OjU2bHkV!&+mHWyt#4g7 zss|+ayx(2_^IDEmN}7TJ_L^6QO^#E(Yro2fkI$^J4B&xJ%+qeiJN?bjK9}>YU94!{ZOhS{|}x-`eCxtXmnjWDX4SJ}lIV>AxiW z2|=F4Ja^>yRNQ(L4wSBoyR3s3&Y!ZJJ&XDS!eO}oNq1f20V3>BC_2upEqPzyT6|77 z3X|~a5b^@291wvHBiPi08G_%VeU&>QMP|_KmD>cgxkMM5T)Gv|eUP~akNwOqaN+~G zFi=H+XGp;FJOd1oFTdXf*{F@s6aLoyi{1?ce#>#Z5T^2b4_e7G>J*F=}nldeZnq z*1YN8X~ygkyU9ueYrX{a*}W0lJNUmeyR#Hp?HG7A`5;_#!g6NHZ#Rt}0jEScgI6=v zAqzxiPlGOvNmB>J@u!l6lQx&DCU1O-QP(2@Ca{e&rR^!HXo5dX?zAO2VUcwg2YA}z zX^5I>Ix{G0PA$H{PoJPk=nXL67B>bRMnPgYa_gRBiCgGlr{@fXQ|`&|E4g+}?org5 z>=_h7s#vQ^?AM1Wj%#6=qzRfwg65Z(Hb#M}2zec5*Jrh9Z|znezL9)PU{*m)^$kozq_%`an|Mxb2

R8s4`{S5j*SG_Hj+}o8UhPaGV9b zuR|{-;akIZNYbv1NE0R?3spyjY^}^~x-}RgFC`VQhivSA?ChG={~c6VkClXdhi69W zAmMW(A=+}B=m@@5hMO-H$KxZ|)x)B?B4N_Jbs)ZhGr!`l7bb2LOzMndGZr>QV_bXN z_JJbfi6RGS#zg#yBF$e{Y~+cyyqPQJ_g;-!yMGg>oe|p^-Q+H1&BPB*M$f4neFdQA zu^{)G<*h0kGj9JX|LxZD#76Xheev@61trOiYfEVJGim7VgKh{O2vzdA(7h5UHYj(}-lMH3Y_l9{FFJH>?&SIqy#S+&-(>&W?qw zwm&Rm;q`#Bj;uU$78dVLezOi!vl3D1>x;?breFWUwKdq@?;ZL; zkd=_=4PaWBl*z)(3{x*YAPs2!0V>}MPQa~VzAnn(LvC{8$3ic2@sNHMM zqnOtop>VDhYQO@;8!48`!bQjMVL<0)?GIAO4h!4PPPDfuGaN7pw?$_NZHOAZN?-^Q z&gW^8tY}8`a%NF?CYB#Y$v~&h3k76$GIeE=`Paa>08K_l*R6fY6{Fk9LR_#SR3Ch2 zVY5EIAY#6n@%U=0>4HaL(gqzwWbTk=`>F%(Py

p}y4-^=I`a;5=HL%goJ0-B$+bb}4>!(rP zwZ)>&p#36z-PCJ1OuQ%Ue^i?h!%Gk2cj}d}*y{cQ=?K4onbo>X?w0R~Bu5&E z>hNa<5!2^9&zK(+s!^P5BI1sO%ZZ-@{E*8xSREu%W|M-+RQosq0m6SmS=nM!XvUo3 zR2B1!YYRsY>W$>5j$QdweEpCiNNJ)pFUUV%4>H6q8Tjy+2F!6xAk#0;_!jpr9-9s^b;)m!~K z5?>UaFIL3}y~j)&>W{}9`;LPlM9QRm>n{BXtIH)Eun})~2@))eNajX_aS6aPIWbLa z*-H*G(qzUm!bEp&+%<)KnW)6D@!}aB!8{D`;M~$kN0E=v$qz}lW&F0n!X zJ`_8C6Sl>WjrCe{scO|&ME%PIFfW-FoC3W@3GWU6+=JOju-Z;rcS1c*y&^Pi{=zLr;=uC|*hNBi(JC`@^-n(Y$_M zlae@?&oiAo4|=u3`i@qx$e(rQF5aU4K`}7p8rl|w0rx6XOG5pr9CLC(I)sJUe+n-w zzy31BLZ|;B?EIF)J{K4^@fj@i>c22 zB_?*YqMUU$<7^WRsY5?9mPJVxB%YOei}sT~P@Q)_O8#O&^-%;7tORFF#^VeoAne5B zpSH9F_t>l-EqRCF`u*d}=*Jk1k#`3qDkS4*po%ry#Sv13DOzHKjleu@ng}soqw{g7 zNzvBc$ehJFj)(%RkL}0huvP047+1N4T_w(RKS_)p*-AlocJBWCw}%kBT(oGd9(PXJ zlJRw_9e)o6vfMleHfyItN{YS>p}40c`xUjENew!DXe7(-)PI7#!h{>g=Xt!6f|X0* z{bsVdpNRA$l}*X_Ni)#VG9W81IF5Az941DNC`OyQJ= z1~CW@4kxF$Z3KQ}Dg4wL9MX!FA-sjy{pR5OLE;XqvdpZjpns=APF@g($bXUXlE4Qs zGvv}#br`S{_+U&DzMoXxewza&^C5?_=&ZdT+g4a8OyZ*Dk6M)K?aF<7~5mp(>(RuoBX;vO{Z)SgY18Ha&Br zy!wpzf=)T8Z8QAuX#3>p3=C2-;~8|21fzM}o=}Is{&2f}{Gcm_xYg%tVKGRi4LHZk z!gllt>k^_cN=`<%&ju0nJfnBEGtgyuE}Chj2bI?nzaNv4CC?WsAPSng>T8HX)2pl^ z<7!pW?(WJ-96(0}vOW+uqW{~D@jn}cGui*Qh5XOLe|w75jT>n9%AXCPY>=xXv@OPpMj}E!r?YVEPSqYmC^+ci?y_Yn4wEc-7c=@2Lc@zDfou0lx^9f3KdE2U{V7NDS zU7y6rmBOVHxg_6codEDL!&8wvqu2LER|A9&p-wp*e~M)+OnDfG7ZP^#?%odnG6`${ z3m@?QVR6`LG`|T{(yi~){1Gi9Hyx_c6W`Vv2$!YrD>T#}1}8Fv3e{x4d~M;#>$|z# zAwJr!70c88H*wq{h#t=%l^@i7hjLLlJX?AZLTSa-OAArW9*cF^PIUba1CX?H+L|@zd;(?? zy+^F>fcmgHek43=D;6MF>do3y@?J0#tKu-`YX(xxk4ipw8bgdZxr8EaA)L^h#~_OR zEhrgG=v$p`jDIHbds=m<^hYoi%Jlj3%Oj;nmbX#4EpQGH!KOo!*DC%hjsW%QNT2KRGNL(7m5&wEujbLYe`jGa9$9?LCaP}vPy7B}$t>j926L9dbsbXYBR_TJ40Us% z#Aq`5E{B>-pMU51;E|GJVXcqhqoA>vPXs!M0?|GUGeikafCzK)-bbSkxjUf%j8r#% zG%39wrCKR?*T%Rw(EWR*4cD_aLZ3-N2Zz#a%`k+9T0?Lxet2qk;ZgNt9LE&SHTa4& zCf8roXZpP`LSNwW{by_mGOmMB-C#tX96_C@%vK~W)XWC5aRIVZEW}qE{R2Gu&9?hC zY>&&uNBp-yx1j30;z>p-q4%ZT15tU1Fr(za2%5u-+WSvCb(B;KgAhH8@R*`ldlb3_ zU!kbAxZE&jW*33rwkjzS_4vov`&aMQ1>|!Ft}vISS$E_R|ff>l< zK~29hVZhKj%Y(Ga6Gg>MI!5=YY$Ic6q?_Rr?vGrPS`I0oOXvZ&{ZjjD4$xNVD@GJ6 zKP#lkZUync0)NNAq(u|YL_nXuDSP^X9R6IWGxI$wxt7Ax@4F1xFbT7=j7aRoWNhAXhAiXlA}M|sNx_xJpfTXSLN?#o_3DP*9eex^Hhrnq3# zEMn9NL=Egk^DED!XLQG_5SM68B|!UCyIo}^DD4bg`X9B3>=kXquxT`--QlNI+(pmC zWX?&C&hyk46Hu_cNx?Pg=h>qRLZQ7)`&vVVTWE2L8XLdrgBl? zGp6{5R3FPG*7+HjepJasCz2+X2W^nrotYY7j&Cu&tMK+ycw&RyR#)%$4bgKw|3;Qn zOWl5U{?39$Mdb~0%%AcDic*pL zOnW62Ff}l4E-H9no{!1K@|2~WRj4|xaY$AAQ0-uN{Qfi_XL6g=$n62)1qzQreHYl= zoGJX^rX8|k9xg$8dS87#OPj+kD|rdO zZgKzHV8lvVW)^B~tF)NQWHELrzvu)r|I|`PQV&Y!~RV5$le%WM)7D?IP#J$*0|j zK~BJ{93B{r;xroC_t`-2`*SAl)BF1tCL!O>1IBy3!a;Hci1le7RPNobB~88DWLk&< z!M*q&_5tae8K335K0tR4@N0Lfydjj-38GN?8UxV!b_}}lt_2>bUVtth%!KpX(bD1e zf-c zSP6i*|Kup5_k&2~Z<5gxO?wC7WTY92KMCSt{b+gFdYR7BKN0kWDpvVK8D1OT;UqzE z5H2b>+xC%8X-65K*U8C&?S|s3;FVhCG;7(fd9lMZUAFawW{)b5Dk+!@jw9kn{3StX z;#U33)7_Qn8(ICZv(Vty;Y8zpP~NRpLCe*$r)KmDStCT2a!~J;Rz5vXVxF%DIq+#& z9kJBVA8#);neip?@J<{<=;Gd3A~orh5)g*mNURfwX*>dRo}(2WyF4#>P?l zQGiV?UvyCvgYtw1jIwG*i~u+z{J#|g^Y%Zc*DnYVbIG;klXj983l!#5St%+(?7ux3 zvwm_&jT7rHaWv=$mj4Bxdp+oq8Wp8ajYVxkhtZcjnm3ibN*cZ3x%1$~)Ba9C+Fqx- zS=1T;8nX?YcteKeGE=#Q1h^h5Zj8@_5KMRcN>Y7ueU1*s_b0va<{aw@)^w54=9?l6 zwBU?CumgGQKp7BXie87=wD0-}s(eW0w+JjfJ}I8w?^~}WkKU^P<+=05JoLmRUTLAE z-}_PTFPkhL58tE{No5bjU(Paq-GLe6jQ+ z_0ch7I!+PrU0Ve ztoYUDv}^2H8n5uRzr35No%zO%eL&3_vS!^Hko2XPkQc0C%j$Ke5TT`c&ew>h?J4SDY1!nLU$rn*5TskZ4WfM7IFn2>?A2DHPZ^daHwKQ1C7C@CKoRkIA zqZ-*4flS=`w^+sJ#Kmohd=`@Pi-n?g_}|46O(vh>g{rE14&ayfQ-Cd{-I7!e+| zu`MvOtAr8OTm*^Eq={@O_8V6#hq~GT$ ztAtbJqcw=S*&Z$jq!J$9FLyrJimnY1IZo~Epkmz(dGA@bGh1U0!N1%!K-j=uj=u-@ z$RL?WFtTR+EOdeA3|@B^x5Cy|B0)6!7TdK5aOil^N)5K4bX^f-M8x98#&CuVY55o_ zb8}uKA|6mwoanIfWEz3IFDkcJO6OwRA%7+hKy3lLA}b8rnG8Y z6aoAGkujW*_L#wHfBiUHbdoNP#=ezf@U{Tg7oT6XmvsG$s*wxj zAWcs*Ia|c8AN@g2ang|#RvB*8imhD#MRG&6iU=iO;PUyRlZM4{Rj5#?dYAWvdh+B$ zFt92=w0&!Jw{gT}C4dh4u{pzNa`;3qNxBsS3_$}1Mv^BHdV%@;@+oui!+vaI`S>%6 za{t*&EX)4HConA-^KcPr`vRv9n_ZyLj^%v#yXU`GU+};&|D-8N`{K&}C-_`RBw93A zw5R_ax!XaApxGjZ`&V=zihnG*>E;CtsM?J%<>2KO@Uvl*G2$UDpL(3SIrldHIMqUZ z{}c*TKT$p%2t1OuVuR@_y_ESBlkQgHt%ye0~uzBeDGWC95qzl{)1+B!RHhEAK52;dbxH5f`Bu43UPz_)i6*)T0q+gouzRtvZ$~;yQtYz zdCKad?;4>rC8fI^MRWa&;3T}}jrOgwh8gc*h(az=y&jFFJ@h7#Q)Yi)2)}PP0IhKQ zNY`BDqPjDxU>3se^V15!T`<1s&R%{a%*x=d*Y_GhvwE>lXA8#B zoye?x9B8&eaumUB^mc7M8?$dF@!dG!??D%dWXM`so86A-y6jA7-bHeNR6ECNj{5s* zYBhcLk~3=Tebx%FNXBloi;*tiNe_R{8y;gpODEh0dkh<2E>A~lW}^y&7U}^j)+FPP zUAjrSKe8$d60!`BXJ4B$!}x&Ze`zO7(-o$c2@@85I;h{6q_CCdwn81UTmkt=OY1RRW|jP#AS0g}nq{4qCC}@Ny`%s^_=M{W@se%mZ5QW7Jdgb`rF@$)6}*|Lqfd30?Z*x3M$Qx)rB z`mAY(8KESxBowJT3lwFINRxBMpbkAaqJZ`yi#>9j@cP3k zF2GpUm?ervs@VOAOjhLHI^ex+OBfvz#mPtbrN>(0gh=jETyK4z?X*h##%!1ctKgVEcRM9e6#&FtB37 zU3MQlBhTHF92fh@fN3(yiEi>=7IypU*SWh3OPCN!bvZ20v+a6RBk7BA+Q>QA4GUPc zPfCAM*g6v)#{?O8dtG%-=k_T(3!urRljc59>CHo*O8b|~s}Hg+2GvZClEllIJw3UQ zjEDjpG=!k!k@#CYzoOl#EvId>`0^Qt7RavycwcL{?jlz5&WBTrFSUE=hhVe9l20 zGvn-F{-?Dq2c9=0?6$B?+fHJo@_;S$P?dR1IIYd~&#=Ec0dd#g1gH7_5PJ{h`&Ejp ziXUI8VlQ)H&?GQ%`se;X;ZM}wbv9A$+pKlrPy8{udaj8#cATFVL(PF|d23LG;7`CT z%$`Yen@e+6b;$J0)KK$;t{a)E3a2?0J1Q!?rPDSk<}7?r1f+{cgtl;a`2V_?iT!_9 z{-fEp>A|>7KnX-3?2%SODA&H0V2q*ylZ8U6-?)q1eIT;B-v0{;UVqK~dUdbAk2I|B zG8@!qNs{E1HjPiG+f9)rt^(82GXC?9E&zT>K0~zHLY5qBO;7k*- z8aQO!vn~+vDMAn=Oo*}H-0^qu(}HVe&acW_9Hn=*7i?_V#W`2FrXgppSCQ25+aA3$}2Y}D3*{$_29GDab-mkIsr zZPf?6TXEF-O=ZD$V4j|#C54=X&$xlq^8orA(odFhsIry$&a$x3`h!FK4nex8b=Res zkRTYz{FVo`+u{s>&r0_E#o>?{d&2LHpL?t*Toea93@}I=^n}q^Z873i%v=VFmrCy5 zby6PQJ#u^Pmb{jakDyD6CCi^Rjs_Q+_J*y@hOY7nfy;aSsUZm=UIaba6y!vlj7;CEdacf;5|!o5LL#a^SJ*O?yU`vt(aQy~>J%bqaCX%R~;2qRUQyo=je zg|HD~NiTLSK#qNXGHPoloG%6#|O^+@Qj-VFPP@Tm711AWX+WW&M>Rr`Oj&9vRXT~tq5)C084>KXdfm9 zpHE+H0;vFKn(cvFn{8qdWi04^Gbjh&UAmEhuF85<>y&cRa5(RXh*+-v&Bq=qi zn&BWv)~GOT0;fIVXMHT{ApYsVu|PAD;egS3K6ZJ@4<=Lc>ym4dw1&5-;vsg5vhn@M zv+Kxxh>8GbeICf?)CCxXCo%0Fs67lkk})QV%d4l2QTY?=6Uoa++8g6Q;R8u!fK&=S zT%ZboI=Ep<)rQ`{ABMi<(~O$7B%^T`jRV*vm1`6y>~(p)wR2ND)WHs#r9r8 z`~JG6*mrm|74J51JwoVgLV9ue`F~fybb_Vam>*a534*IJ+luHzXo9M&ixCPMq?|H= zt3QTIa@IxC(YHrrJ4`bqL^Wch}VSInXPq=zdGFh1=lL9H5($kd`I6+bnWqeJsW0BZz?3r%CE`Sn$~OC|Kqap%;yy$x|wO$;QXU;v?_ z|F^k`oBw~An~o*_kA?s2PjP_DAb%M!51{DFv^TJ_7wOD4US#J}Ysjn%ydtE!5bIy8 zn$Ra_1E-DHUBl8z`4=PmxVuPcuFa#|J!6YHQo&&spF5eDNx@`I0ncLl8WVw5y$rR&X5D!ydP(rRKTPjdz|eayV%*JBio%i57xqAxYJ^zD$SL4i zSJYD{UZg@N=%neLIAz+7M3KrZ^h3qP;1$9|ttY~{_lx50sw*AUb|J8WMhe%P#i1EP zPY?^1?!I7}FuU*1#743!FEBYyj10r%JW0IjUo2$)r14Pl{efT`Q@(hLGQ!+hHA?L! zM2&fc$(yDTo8B+l@3x@t5u*6!0&0b5g<;r2i$GvdKK5Bh;`fc010+`jWW^qCS+)4_ znkjP=CyCW5t#&c}m~K5zxtR~3p_#2=#mdUu8%b&8V#3PrcdZ=q|3%q523Hoh>zlFd zj&0kv*|F`UW81c!j&0jcdUtHw9Vb1z-&5zzoT>RR|8J?C+N<&*^;>H_&wX9@^saWr zK9^|959G})L>$2{x=6LDe*nR*tV3d)2<^UAg^1x1#iM?|^c*NrFgK!XyHM=me%2O@ z1zDh!jNfw`U{F^`@(rqnQj(rE&2dq+Y(Y<2x!PW~sVvGFe6=T?hrLw^2m*IWh!`2Z zU5c#+WG{oidRAnRm36t>%>d1RX|DeF zne&|uky?dR!Vlu7SW;~Z5tUq2I5qg5&t8q-Sl!`vM zFXC?@jM}gm8Dxp#Zw(v7a#TaC#bTzjJQ$4H<94rEm_9hS-TJ4!-a(Z;1mPs5wc7)c zhT3-gy6OOrI#9wGa2Z>;qDh6J#5yS4Y^Hp=kXBn1GKNp)_KV%7=V5MT@FdCT9)j+q zF5j!3wDE(N`hJ5U%NvF)XX8zA<)Ibe|HtMN-Wi1%wxs%K(*E5b`bHV@U`00mx|)%165r@Zi`^v1Qz9Td5R2Q7VarluCp|4s)0&4DmP6tH zKD$`4HIvBHh)r&>D^(#dc4IT7d6&7eA@L+OlgB6ZMP+4IKBOJ$#pk}m+bNVMdhT!$ zM-r;(DvWT0ZVHdFcK*yMjL)-Cc(({tB<16)8_@AVaqvTzJotWaIci1z!&B=^`CF>o zNgKhYOC!8{J92kAW#guQo>ZL}ZnfxTvOGj^iPbe%NtJCVYCpRax5kU=5*L+0(Axc^ zBDBq<%tLrp@~_3`jo#fUap|{&Te~ZIjrw8Fy&Gxb74g(WBHFxf2WCov00wj?2IaQpL56uL4hj?s#M8ssS=FCo?Rh@|lpfTir|1tV9IJC^v+ zy`I&B+G;3W>vi9z%|K(eKZ3TNmLWz0!)R3G_eg3s7$s9oHF57MCRPq+iXm}KTO1bO zY9r2t6T#3@3ZVhbe8*wUZIyVfqt*AU$>&QRjgVj|&S0gwEqSY6cl_FM!w^j_kRWj= zjd1A3Fqy=0EYX@7vJ+Nh{z0>*sHE%O`r#TOSo2NZii5VnA4eJ%ueCa_f~(-PkD3O? zrFpy@1W|J7B$d7t;!cq0xVHQOwljhm|DZ3Hi_YSB6i3rm3qWKv#t2tcB}U>dYWyS0X#%Q51Y%ed zR@i{Q!aIV3rEYY^ml3}Gx{SgI%8!}~C>3YcDE{$#5v6v0D77MW#x-trq3?#(EDE>O zfmY(8nW^~CqlognkGV3qb}E>2b%t0skd%~B`yHe1Cclwce#}Y+D4x*DUJpp1#2hGB z4BEH^p0=`rZuhh*-nS##rdwbb*?=p!+|_3UgVq>urWB zY-J0Gm9A$jT$K5!tq13N20z9y+$LPs^hjk)cK z45(EbW&cO_qqok4Z_8Z!QGb)KZTrS!M-UXV>EYZ7R)&E!t!|ehJ^tic5)bJ*C^LRm zVzt>1U6sn7%75$7L}c4uj`!&KDoT|eHR8mH3-oQG(s`IEHTm@ELlAHRhyV_-oA(f^?t_hxr zO+T?%%W@0$Un^5;BPmYoeAZ@SoKJ@+vJWzNHLcX#Me;h*e4p{I1}^RnX7YjgKb^+U z-k+t&*|;f{?-50oFra8${E~QNJ}i%L#iiD}R5fG=ycEE9$gYflU&RmwK9Mx>SK&6R z-qFljJK|BtIK=Ry= zDwsB~-_4k)uiKkz|1c#_mh|QM|NLMM-o9A6x+(=}(~U63I|~aMQ7xZ^P|(9IMrSQl zwK7_L7P#f0iQKsJDr3iy8n6^|+)5xpksu?vDLL%y+^|@<5u0wr2Fl_ztk}{A#^@wG z+7pj_f0jCWi?DOE(_G;Mk)rX;4GHf|7fxL+o$`u;5+)Fx-Oq%`Et{5I9Tp+ zOeSCucP^Cpte+gwg^G>qGbZC_e3>^M)%7}b(NJ_S|Z1k)c8`#E7LIj!3G zI9(8yIkM@rciIy>_$frWa;OFbN8y3ke9mOP9Q4L+3o@DDaQxslWySBtg-1gWL)3_u zJVQMc(RdwmUZft7S?qk6w9p8ng?}OeNoBYZ*oCq!=t`R=)kL&`JgP73yz!idx8VXQ zyDxyNiOb*;M`Y0S?Cttiq+xd4sY#VDE}szl%6`(hzn(pwq~vDieV*K0UgUh3CjegM z7pB=6ZPFQ+uzDNZ*ro>a=!r1-Ve?8P1V3;VrNk-dxZG*1e^AeS88xn^G5K? zo`-5*uP?sMw=7nZRnt?xyr%y9g1No8eFLWbR|vqB#q1n`JHq_5TQzJjT*qQQx6z-@ z4d|?qh(`uwV!sDJ6nWDGInzrcM>gIZ#$fbO z5y?T?bW7)t2vxAvEiFhz-K)&06|=yGLSOkKInL}0*T%h;mcsroDrv?qFg3w>Xr_;Q zde-Q?hK=k&7um$@X8bx5F7+s#ku>u#12^!w{gNMkF}oecxz zgTG(M-=wEd&7DOPbrC%5@ZWaB)9^x-@#DUhiI=y!!PZ|eBFXo(w-qCFNdk93qF%4p z>6{Gtk(9(JAk>fgz2QAyF*}|zEQ=gF#Z97c8s%hB?YKm-2ohr7uY42izNJXDW_O!KmA1y_agF<-q>?&Xt5!!W?+>B%%+JpMH znIr~$Z8Jjm{av7BAPJ}ab5V8TH)%&4d3flAQGZBFQjNG3^|xF!vA12kpoB4qgbf+S zt`yV}#%^mnrL)fqEn%`9t5b}uc{(_85=}ES9NgWh^ zpIQwT1G;Y;rv;BRI zpViCJ%R52CuQS$8Y}IbUX#J;Cov(#6zD4{sh`FS2*6L-;`LhP795injV6h_Hcq}z! zUz0&d7RD+MW>-`&iG&!g_s2gY`hf4)@9eMs*$c{9a8!^8Ifj(T$ZfQ?GH3iO=>j5?;h5t`AM6ee!I6*t3twce&v1S(j-o3YZo zl!~=!*(WB-$`SG9GPapW$_HP}{=+oDJd6Gx_JIG)IXZ!f-T$__{LkP6Xw?e*&p~Yi zdPViwFR~N0mmahG`#MN24QX^K0!86X@F%D7k~oV7!V}jQ9B2XN|hGcT__?LT_`=TZC5Q-84th#zP0I@7og;@~}qwO7P)b zwheXa;6=Sej0r?&<*?dav@kYvLl!QDlKQdv0Jzx5lF6Oe-uS+J)NwF_NEFJ1 zutOHI=*|U64pDUO2&Cr4?}fKN{&FzXbUsUxq|)F=ovS z!Gglzef~ICq;Dht0Yc=_e9cp~9nDC+Cr={hkHqm*A^r6!M>Izx6e8lVJIUs|mRQWy z2VC$DK2+Ye{>)_^>I$vNd9Z}-A*f+~hkf&<8K&bU&mnlbC1+u5hp&H9$AJmpIZ zQo;m*r`|mi@l&27pL|K!v~f`CLGbx`h)f|=EKFfz`rfo%!-@0PhXMK< zp1*_=AsW08XrI$Dq|gItAe9l|!aTI=VhPqWr%FbE)}rmt5Ct77MVH?`H4e^b7M4CR++fbyoL?1oU zxC(#y0*YBn8~R#Us2Bj7cyvr+D#JO#sw!1VLeZ!$ay|ig&WSV%tV%w6$K7K=2;SHV zT3m(_cWWJ_LnFz|4>O`XlS)=4Q3#yTSJjJdaXRacP_#`3f(Td976N0IzKepXYUsWaHXt^0i*T1@mS{)ZfR7Wr-W? zQ0G~{KeXBP^#SZm-SS1r$QIxP3e?8S_ zBGYLm45)5n1M}pC_&`dp&P^UP)#ak^vcckK3 zR}B|&PT!=r&~8~|`}p*CsgwZ1gyq5GM8d(6P$XwQSFSx;e|VD#-?mpH=7Q5p-WPtD z5lsXhsa;ClyIe2xl)4`F0Qv9|) z2IxNA{JjO;JQ{5rg4((E4QBy)(89w=TLQK&DNs=ps@A|@PI@ou|L~mNy;1~G>v%h7 zZg|#>+E`kUTaxX(F!-`&CWw%0SMIk8omOVf?YV^Ld$NZh_=b_wgjKd+>&;H)} z-;u|*;8xWHp}dmOxxpn9)Y{-~OIY{5D1Ix9Mb10Zv57RRuOP{EWykG#u%P8xeoFc3 zF&*7~19rhQpqrkb5T&X#tT96kd%cLBalH-8_<^-&+~Tm1%Bh!u?4~>@V`jPIN5iix zx{Izr!}p?~dXEnzd6ub{5mm6F@^$}uoP0ezTms%VkL~>5w5B&5uhS2wgp|f7WU=p(UXz7tjy-&79n%jc8P;_L$_I|@N_k3;i=sjNY zE#4cryM0aw*S04(cM2M!uE|2Oq!Ak@L}UqToLTZui})MI^t$7gjV&9%fh&02)aPsz{Bpv*)Ed zClV%Stjk}f_tDa=d!#r{!+?Ou%AwF6?%1|7nSpz=F?_U?@6c;pj3uY7pKWpu&}L2;P;N0=vM^EuhcMEOX%8XeT9s| z8*B1Ey*OuHbWXcWvlFy&5@%iNT0Rkr9*wABH<>oGUfs8=HC8p>knx5R&7*Jryom`)W*0v*FHciYJ^x>?jrRZ|*j5_$5g zykaYeo!!C32`jQij{SsA%#=E}dVK6`!4AGG;>p=snPbkeGW5VB3mT=9E>Kl>-hgL) z+fd-Xf2K7vk8ZGQg~Bg~1VtmV;x9bcOfW$9=toi^RKDxUa*11&{wZVgHeD*LR$ zO3?w=lrbfCB-@f1vg)CO+!+xkXBi zQ7A&U=2QMjwZr!lG7CqYkdjY)2|>Y150N{kt8YNq*Wy(~nD1*Z+lVC7@WWx|Y5Yl! zYHm$yg`q0RzT_M-j%{|Qzaq9T69a0IM^IwHgh5J37CPF9_G3#I<+n2=#j-^#WoZeS zGi;Ukw+5(5oWNe_wF!?>AJBy1)P8{dVf9T%qmg52Z&*?vKq4@?7a&7iX+qKQf#(*c zLyQbeKn2vs9X-b}stnlhgS}61P#q zvQ#3O;zDS7BDAFwbY-9wuso%APW$}he@jqlhH}37M#D!*;A^$=Em+M#y`Ir;NhZdc zTPr>V&V~&{V(KjQnW6-W?R9#64Rg#p2P2skqdX(V}~Bu?zy{~bX<5H522=f zp~y|5Ic#MiOU4_7oVjAM_P^n92je~OqJnV;=iH@hfc(;v(yaR}OpjLlU)g>b2ry|y zSz@j@vs*cbx+XTNlcPe2TXgK_K~aZ3EO1@5`y^7e1Ex6af4Tfo%E0O3l)K7%hL;4g zfPZog!S5}gWP~Rh`5=rMRQvB5F;amacEfxP<+X6-ZnZ!+i9{bQFjBu3j9j425B6e8 zfwu?yayuUW@K0Mp5g5>Xjmod$Mh%>EgUNyfSk5}|d*3RVp|p5HGz97;2yrsZwU&9F z&pjXbXd)LbRv-f-`O6e$#+I^+#Xt@~rx$)DeEaMFE7`vUEPB$aiJc$tdC&yL_Y3~> z$7*(AUZsLu>*U%JFr@Ek<`4~zCkS;%LfoR6O_c0BLEIkjRNtOGF#U@(7SykXgGNC9 zwdz9yUMUuRV5g%GnfIP2CP@F=PwE7PK`y4Ne;4g*H^F9QUo7M)0ShAT&_ik-KuGjI z`%i&~;At=8)^;5P^K3Vd?+2H3$H_EGxgsS!H4l67jhPwq7B#4RZE@>e7S5mL;njCs z)#!eZY98F#6=*F3!@k6ro@j_epxA;|GPo_KK-}gmV@KI5R!q|k6YWlbcs?w$f0eBDm1KYqV%O;uzjngiBB!Z`9C; zL^J)J#AP^dq0}-wKM&5^L2LUo5F7T{9}|DiY~P-A?crmd$z-ifo}8*<;qTDj5bq;0 z<+K~5-g_uXsP2UwmEm)O*@tZLH-au?sn>mb$KXF}J0x#(Lda>M(6TSM-Rmry>ydlM zP&n(jBr%jL#O;CF-{ee7j0kvU=o3wwx1km8pB4-m@%b&Fq3YU(0A*sX#CEzXtriT@Y^Dy+Z_LBNRbSzT%whHOXTj=e@Y)Eo zJ2}XW{2_o8yay5WJlS^D9|aZB`G&qF;-)8^2ZwCA^yT%Ow#T`vgMrXwzXSf6;~-q^ zPZGauwBtdVS>@3|*T$wFe z(uMKV_kL9OgLdXgU~${fE9{g3BI72~E8(d#6w=eWbN9w-Kp^_|jfn1URdYFHIL3q} z=or$FUfK2q_|&%Oe2fE_EbY~(F&A?&4(^hoQ3g&4_+jm{xfqAsc8VhBnTOte6)L%CL+Ji>H~XLe&)e}_&mrC04J+t zQeUhgG1Xm9s4$h;AS=K`vifqcfxLQx%#vm0Q-o{%16Rx(O<{ZEqXxu7M1FsKBKC*! zTR`r!?uf0wnjJlfrUVtewQs|)WmL+WTE6FSXGbWPHDJKsWwg+W@J8$YrZH$3xY5w4Uj5_I&obDhY+hQ z=cLcWc8+4HYO>v1C3?a(Y!~yepfaNU< z^e)DH$(7C&m=}I&-Co#l7o1{Mc|8LmPesG6`aq3II6n{Wx(VpzvZ<4{u5^GG7a(dw znm@;1WW^VDH)oF-q0yBL@LL#*PF$}T=EpNis2`yde#tGR^B^5#sOu!9);dy9IkKq9 zQiFf;F$Ok9@|~jz<7El$Dk2j1BV~uaV29M}ghAF|YHyP#hi5Y0LF<~Zn#7A_$-=S_ z*x8rTZrTe|;XIrq%n21uQbwt$cTMi*g#-(0?`M_}u`vLiqcX&`5n}dcx}4|S5v;X} z@Z2|k&1Bq+U;Zuo4BL4V=`9~$cQ@~&$Y(A8zpRh{0JQm&@ho`F2LC@lBtIxA#!5PW z65QQ2+KmFskR=AP@~gLMcKB+M&=d7@$t5K-l^Pz3&M zkgj@RfxIPqA?!r@=NAKlV%>)pM*`4aFKv{81>1K-FLUOyAWZRKo_?a7*RoO6fhS;O zfs?a~N_7N4V2pnZW8g%^{uFp;p#MH@x!)T`ch`6@|DPKQ(^fR+#y(9T4d}-O!_Clm zyZ|~$pyePix{oR7=5PnI%S7KBf;ynYr4JNk(QhMwd3qe9NrD6%>|X%ymgDGj?qvEU z=AkIF_2QFoNS&R9bk%?J;>kQOLjE(qk_O3P6he0SZ7bdLR~KbWK2x{==sFL`MJPKA z6UPSu^E$G*hLX@nanTvG^0y6SzR{aE=DRApQtijh0IQDqwn?@@))uH@;k{_;hg=Wy0cnf4pj# zOgrJ6JAvNSXG4pJ@x&$)x+O&RCB9kRW^CzCy1|?y0gI4nJ5gYaWoAmVMxDg=An%_w zTW^rv1)@X*q2NR4-mfb0cA%Yd%{U=NAl#o1>7x}6S*UIlxceox0A_FJcQCwvKNcP? z2zv+sm!UIL94uz23TfeNgHKBZSz8sC*J})e`1ZP%3^pu1wskgHXW_X6I zX~0!Dhj7`HQ70)jJiFz-kp>@GC^#Vzn8Dvt0Szq`HzbPSa8U4+SSV>e zg41tmPsy`8zmNg~xVX=)Bp)S5rG`%h;S0=R^x9Ea@Pr_|_Ldh6m5{SSmt))mlIA?eWZ#xaW1RK>m+-1OvWa_-03bqvR2EPl>#_bJW^-tIS1KORo3S?0fv(Fdlh_k{oi|ld`f!ljA+b_W*i!CHY@o;m%pl$kM;#m zlUrMo_yLuKr0qm>Z9mB<4W{-PC`$L5l2SyU-604pw7PMPZ7Rdm>4Q`i-gq-Y_-{bQ zPs~h(Z5XaqlAn@Q2PP!)BS&<9FjiKBE6H=>mYn6|CuGdGR9N!HCZIb|P`>bkwhe@? zOJ4BK;+zqP^t6M+#zT=u$D%Olj=#Yrs7Do*@t(@yry#j}2z-~+BhkT7 zta4GtUu8aMpvDU@r`Gtu9Bs)$p9G~p#RejgN){`brLktd_MGHXTWv7bCaQAEYn4puSbgEg|v|Z}=itvauyNj)^>Y zBYOx+op-}n9~mO2F(L$)ZhQDXJ1*Gifz76~U}pnkDuc8Ca3#M_Z}!%f6g+j*bdA*g zsXw?@0NTS7i{zY9oh2jg3Tir}-Zv;*ud zas=df1!6+q`#@DbGN)W}K?L9A1u#l#BU|}HI=a8$mu7CS`e`b&TOp$0^AbZ)CTCV-2^W^^%%OJBVFg6_D>@}MXUg3>vfZDh%xly<{Qe)3uiVy`;N!dygTeyE>-B>|QxR%uh~=z!B1O5{{&cFQ ziGEz2gj@_x!1}%l-tGt*|A(n|MIAF|y25iio1M!Wd&^KJ4Je>JTI2CP`PYEbB;^W2 z7{e3}w8m%7pK)Wm)evD9>{6DWky~Hdw`pAW0g5BDW(g4^!9`!32!C1!%uYjid9!Fj zOp}{rX40EiHj$_&7xn)rNV-;_wS~%-2Ok&x9ATmmsa(&{v3j6fE!#%;l?V=8mZA}U z23+jo{pqKHxD{WG3rL&V~YXz3z1tmI;qtn+{&o!6tHbBaIFK^;UhH_c-Kjly zdhNX6Rz4SElvzK8)8L{mf%zeG&SI-)z9i8%105o(fHRMj4!OCag0Y>2{4}o#(>CO^ zlyQGmtU_}^A*(rSS(pb$(g-Tl3A2Ml-UAZ9Ku*D)#tl1S$B-mYy!HC_qUR6ok$63E z{!0`ijA0d0X|CiKM0SS(K2#pD3Ujq9LF# z186ROgcj+>ERN;?y7I@YL~-Q;7TxceD_1HbW$HmJ)mh3QPQ*pfN`l!9X4QL>wJ^oc z8|NLmH>1)s5{x9`;Y+SK=>N7A8o`D_9?htPh^6fq8~NrMale2|vwjyN!=EOjw)7iaDgJOw1@Xy9=TXwFFn-BTi-96wP$@jF3NlncGQx zJM$1uPQw9edoqLDYak#0|7W3r%@1*u!j?L@&YmrLp>AO@LP0o#{r~lT&j`WXOGV`W zsXLR-3JjVJ?#&lQ!a^{gw+vf0nsoSqeE#vnv0D_Gc_7i574a^Ez^`|?|TfihoDe(k}z@d0u$%)a{|V!);GXq zBw3R+Yr~|AAQJecq6D)If&G%~JNOKEZrOX+T~JZH>8M?)tLBGw;*$UocraGNGWQhX zlTbx|u@S@kZ5NQ9{)!KqU@=mbt zDN(3b5dm*fsiXO#L!UdL+?CXi=dWZq2u2cl;PbG$#$bj+mcsJj#;}WuP5FHA4U~ZH90~%?-6D*0<1; zLmYAx<%cx=gZK98=6ABL3BS(RmY*-7cCpDmVR-XCm8o_^ENlE`rsf7sRP$0Qf}tN$ z>-HEt^D3gK9dMYQMY+8nhmS1qC(JCoxPcM@xMOnjq^n!NZJ$)3_UivPLTM z#X9gYD>x}gabm)csaD8&vQyrT*AT+j-Br^MylRB6P$qjDZL{!3+;SK)osC@}fCAXI zJJbd#_~k3m{F`Yj`K=6np#F1@H+2!s4jAQb{b{@u4kQ^H;>7y?a(|Pz&!lSm>%_bW z=1sW@4ZT`i*jJ66*k(ZnOp9ZqDY%}laS=Vfsh|bqqC9owDUXx0v1XDbmQ;UXko{qU z`yT#fLMv(K&~jmaii1xU-W_qZFcoHM=F}5>rB-b2k}L?1*j@|n_oqKlJSzl9qYqr* z>7L%XlloLdKTj=>K)F-2*ue$|*2J~` z2`sR4yp+k>8Pt>ao^xx?ZHt=5OdNZg&0n8tb!@19J>TvGeaZ7@W zNWvtbPH;^a_vc)Gi{fv4?(Dfu^rzmv6)sE^u1ONBNfQ%)#)S-(MWYjqLALxIyP@Cu57|E@f65h04YJv$o=wsHQvgLA3h`*vm)`zXc-^dDsMh#$4yD&NcXz- z@^LKZa01wGpEWaQIDABaZI)1KU{sU5Ar2ca;DBYz)-=oSsFrvad4FmVNuAJMtT7wy zhVexo^xljA)>IwEoE*p#^(?^FwPFciCk#8B1mU&g!^)+nFpZhYQg$syIdv)U=XW4O zjS;E^D^{V1mZ1ULpTz1YebPW!@2I)`Z?rxOPiC%663zs1yzz-oEF0cvH-}Bph0jCD z#b144yeBU74&5GelWck87pWP8!GuDyBv6jNGrKV|k%Z;7>k3$6IQ;l@)o)#JTW)I0 z*yKa_dkX`F(a8MARX9I0bYzHC`~*uhB_DDQEV0ee7R(dul%u$c=H%6szWn&FwV59T!KIA zZQr_d__}$xwp*o#B}XA1cz_+A>0#r0=)388n0xQpX|HHeRE}Z|%_||RvXNb^YK$-} z5NQhDh~LCSZMQefwLCc`ZzHJLw6e$YoyTAg7O}r}S9kb}wSc$B_fFCwp{Nm`uLaT; zeq2+FawLOGnSH$H2I!I|$qbKnf4)$rTpYbT|} z53PnwB=8VN#36m-P^3rS6*BAK{(C6)QXmadH#aXamHm@iHdbQCx|!wnzPiXw$jA7G zc6J|6R7^rMr^W-j)nBlUqr0r;q zCUdrBWseziwcg~n>3oOR82*BxV#>hN-~FPvu&!9M(H#ZZV(&NO>)^wMDf@8V=%vC6 zHq^uNxjyLRiUn)~%t=qTP?5Jz+P80R7;f5cPRhyz_qq8VTW|@_S0b@$&rNyT29u+G z$c4qS^1VaDTCY$gUc+LU*!+q&DWYv)be>?&fYIq5)z(pyyUTXeqkU4ApOc9aJZhp? z&+LZ2&a!iyCmf{DO=N)gLsxi%CdQeEag8RLCl3uEUAo#bc$Y z6i!2hh^r3?aF=X(!!>qd8}M5N>p;#%ax=2(M#b-%nuIVC>+A4%WPF`PBMc^+C1b#P z7gU-0Mm1KkLS}nHY38s&jn~u(2{kA{jd49#jK6=J5W-i5%2Fl7*!d&yGHMGIz}!SZ z2l-ZNb((ByOpS6@ULb8+9J|Nt$$mNfPGgxp4I7@@Yc;hBT2N8F*x?14t#+Vd))M0W zhKb{JuvOgSyMIGI%cSTfY7^wOdb-)<9s1rSi|;?wRS@VjI2)xK&Lk~~htf{3p$g}~5Q&DG`jleEsP?N7`^HtCZs8;PA$qKD?mD_p zd3uHJn9jy)=`CjFs2fxVSh|nW{n*bY% zRnSazadQ@z3dJNuIN;jH3VCXT1Y{F zCOU`HTJ@_@Ysp(yRtD6mmfcJk+7^}J;~HU~!lA4X;*{|uUX^wb6snP)Y8jN*vWx-+ zbgUX(P&SZE7(T9cA)t}DxV<`ufA7H0310uGP~@v+Lty{wsL1&P=`!5K2!_|mhCRkc!*7Q(#K< zZF{v=w`a7yQX|8%NjF_^8V7bXh~1#Kl~jpm0vd8nP+cWxNtqrzwEg(7{}Ymq3PC^E z5g*o&Uu)kpN;6jt*l=@u@lTur3WkJJ3jO%2-Ui^jte@Q%B?sM{x@*N1wB88ML=kxoDw7OB;$6+{AV!Y(RM z!)wO96A!UFRpUxt{|RnxJsFwp#sf8zg$$iURe=0xmcLNSMqJW?wFZ#uDE#6UD*Z=GA};P_Y0oOMrsLM!3dYbc|gVe>O7Rjw}E?5G1LiuOBTIT#1PTcgx2f_q2cX{ZVJ*3^m0ao316PA z&7!tVTq-S(RS$_>l6V1zKl=Z0&8SzWjui8Rkp5m3tU2Kq7})!8$6T zWx|I3j*oIwNZY}^JiXVmHNsYuBx>dFtdk-wFE-~v9HUF^ z;4_B0pupP~X~l=YUcfJUtiUYJIX=*iqDC298O8MjHaDz5ZIEl4|9$FFMf~T~`|m?> zlS3NBATK9UUm`17Zk`pu2U9QKr?Y07saDPfH*gqHb&l)l zcO{qBton!3H8e;AgKBD^si%Z|-k8+o@Gbi3Dlou_np84AsJR3j zA??V@x+0>ao9Z$*?`NVt!)04khazM7?_Vu)E!jpjRm||i=A#SP$6|)+#O=DaQ-#i$ zU$?O0)zw@&>~&T)&cZ3%gtL@X6_seC5_H&c?R0N*I3)Qcuwji6iG5xSHZIMmg1)Jd z^RP~6dk*Msc;}^&vK!H8`SvYR}bc8QL5C670l7taW-`9-5tob=X#PdR`iu)DAnZu>zFcWIPx@ z<*;Dy9Z-_`9kox`;z!VZ+2tFmLLl(o%}96HqdBV;pfO>ih2|M2$AnBF&Ei4>@Z_yf zj-}ye(a#T%-vgDc1o#h?SK>+aj_sB1J_L-IrkXTvKES^m{Ve+uf)^KpDet!I(RN10 z!fhUO=vy3YYQlSaZ@WpMSxe1zO{*r?yTjr)7{y7@`GSN#wf zQZ{?qQmikvp+|Lc?lVU9sqbv*pWDKZzN^4Woi93494~XU7x&abnzu4gS1p$m%0_%d zTL9Qk_fGc6ePE%Z9YqVv*@AmUNtYS*GnJm@lTZzV8Tu)V2Reu$q`dYPy6Ew19YVK+ zl{VXrs6WCA=AnQUUw?i|RM63|*2e(9#y-OnHO5}xpF?d&f#R_oI7IHRrfZ0d9bwUO zD(+92pVrri@za`xT4`R`FX`o2V?FAogg_5$q@5RlxSg~|ns6IZIVqBwb@@|xv&utM zt{1AS>buI5Q?fux!A!u-+Y1?w9X_Y@YG>_xTWRwiTPo zKU$#Dq$FNXtgy11ns))}U`lE{`~*3BIB2w^x@)U+j+SkJYrp@>O!EYhXqg z`@XL37uxoUf!(!A3W19T$XA%pB!Zkeg41^%LiAG%*Hdfd2{NfaX)j!F-EO?e!qf&= z7h-1u{1SG@9Wm~l-X0X$u%S-UK=gEVBfujLM&WHEhryWP2LvGh=V|TV zx%G0`0J6#PzmK(w zUnSr_Px0`rIrr?BoST1O{~c7c-)=9f?1HPj(3~jx2o6sW`8!=7RN|-{AtwB*CoTM#a&2R{&=%?s z3dfR8xmw$(jx!Zk$+oY2mt4EWo`s;~2B2huzJ^=)z{o(iZLunNasf_FjxJUK3J2F( zT0ZjO3}0&1wzVmEacvNWN&_BWUO_qLrja13&8e>@cZb5DX@)>W{B~~7j#O!(#*Tvu-=o=z73j1JFlza81nhz;%9Q< zjc%@4RJ7#zFH`eBLQPQYw4(GeE^sL~SwA{&SyNEk_eMXkW}jWN5C0gKO~p>@JL(hU z`#iu_`F{O+6jz_3C0GD}JhmASd5DvP%Rmgi?pZ1?P0;bV^SFv1%JHV#dB`0tDRU26 z7=*_z@cnv>SB{HCuM}6+gJ@sD-ow%4fdYt5ysMh+fx4D(*T%@A^Lj~!q&x*&$LB7z z4MB!!&i8L2-1hGVTW72~Yew0QsYm6s+!Fb9d|m7osGp7Y=ztd9)%p2>DSF^YH?ccv zQf9#Wb=ktzP}VQ=#7}V0ok;;tEz!n)`J5v_Yv%WW7Q+slITs-ER+uZeA z>$4fWJAcns%yiGOGsbs7oxX!g}sCv+E89z(==LmQxPQ0HN36Fnw{sgTF9K~LodgGAY%vl=L<|If6E7HpTuXcj?Lb)xk@Tq6ZH7l##*v8^f2K8hvq;S?4x|mZ zKZH~o7yh!-Y0v1_I8@co@DUun&(`Hq2Db>5rpLnAc@E@#6xD?2Fkt$kX!)DH2DxRf zmdF%ryizhow;I^l^`5{u^vYK`$z1h*PfoC@ST|Oi3eI_Z2; za&xBOdW5l?%?vY(z?>5G-L$Pef4)4%U>wa}zN;k}m|$u8=rM|0;r;-X;f~_=`1iuL zZOUchhVdN*p0??iODgrmW@f&JlqhC6LikkESsC}9df6~t@`NW>i&sc_Qxt1oC9&D# z#Hw|BdHbx>vX`exE|rjr6oSe1uahYdKcy=8k=919eNQivzZK4n-y80SB$Ca3?x*+w z4<2yIB>8Gz^E}ih+rb>0H@NK2S-^hbY5w6L37cUy^iot@nRwVNRqp2`9HrMnsYVXt zfj;>qRYD2)p$Zt2DRP+Fh~FsR5yMx_;# z1SrSk(er`!>dK^lf2!LBjV01D&18LX_DtCG5}y$Q^YO_wkuH7b%m8>MKab61=H|*# zjee}lJiPQ58g$@{Uzqv2J#ugag-Xc{Dan8h%a&O1b+_@;t>RRl8JYzumflymx^%h3 zy4uQO2!@I8dcWqJR-GBj990PHbOj!A%!U<|RH*0MGpF8|VQQXitm{FR>tgn=-eGEa zfVE`k-Zgkq&VNW0q2=~`$y_0STD#pO2^*gYet5*@u_#4HwR~j z`CTJ7Fo-|#yLexEqWerB4$c)6utIl|Jj-M;^54F1K=TRdZxM-3HY=%O8H$Z$^rk+U zsaO|6qwZZ?F2d+})|rGA*d*dNqV=oVadfP&VN`-KGmBvR*i9;|bp@UuO&v|tu X zsa@%o>3!+SN!NMETXAcZ+9*J%WZ>+9^!~%1Lx(V8>n=ob@w;a73i2kTJK^bXF>aw6 z(`jnq5X8rL8B3H-?w4M@0WGpu7C3Mm#V2Fm6l8VZzAch(bQ&UE2uFm&)m((NS3pEo zR1DvV4Cxv{$nJbxCFfW!5`iR{oo0!@+C|V;}Wv%2~G6B6mw$Xv^+^+0l zfS!)V`F!|{yBnyF`FCMwjg}UdwEo~DIYMbeLW)Nm2>-1ysc3VU9-na7|{Xg~mce;mu6#U!c!=A270E-kE3LFiM zjlF#Wa_-SG)?u%uXESS<=J9^T|iSFA^rfwW=PNVC1^AhYFnnWF@YT$-Pie^Q)51go9LGC z5`s$LThSdGT?Z5>kyOKgo1$B;%WCZ#eRt0{BaW(Z1DXMWK6k*I9CfJB>*3xJSiQ#2 z(pB?iuDM4|lNWeG-kC<3qkX6(oqL&diZQj-kkloP2OSKw1R@f)^)?v49n1on;U2SI zck745o5H(Cp*4;X&a(h8%Mm|6dxvTHBGdg zh`cqPMb;vIJ|Q#$-T(&~Z0f5HeDP-z5+lOxhY@~3TRRPXS%3r1F8YSqA3p?%FOj}Y z*8~N%uJEKe6r>A32yezPrJTuU?vbr#tr{n(RUt%KHZO4S4q`m$n7I{>l2bqETMsps zSHB{pykJIDP3pOhK4K}U{P_5Z6u!JWBNKGzVNPERX-|C^(hw($O6FF&X8We$!O_~2 z$G;w)&%tncrrl9n%KCd+)sE2Dal7zKpB{#g;_}j?1S2`~7LB`_Gd*e;;d|<@-PNNF`ZoZtg>1NvT@yjiKy1T`G4!CQ^-4G!9d^s?uu1tUj4$uy+{DWC+ zVvt|O37$*qB*m65r0jai5#%~Vu(1@Di-^Ih;KKIyin&8Am- z77r+lpM_I`>Hx}s1gfNleU)=(@rK~GyY*B1qL@-a=4Lm#%u3z84lUVDX9c@)U$~PF4?YF{RZcyIg7{B{f`XD_M7HxAhV0=#JP6jEX5UbRg zh=>dIC6A~;-=W>V>o((KhkSsR?N{|mk4ore>x?cv)HMTne1%olN2fbz#25(NgcP@B zPTSnJp~q#t6B7wZK*_VoOL;8~r?T>VuC-7T^_{Z1=iOiTgiww{Ana3JX?_o{wop{h zZ}cR`EM%QdutVR0-s*?La19Vq$-QZ4Tf&xfiKN0<-iEyXiHr0DLsZ!7=klecd0B^` zQj7>o=nkjh3mk=RzDaaqqGP&cI(2(j;-zojDwk^dewv}B_s#CvcbYjCK9dGO0d1jr zQQRq@+^Rb@avC>apygR)1C!gV7|z_9#!tgQ6TjY*M+t*oES?}dH(i4~6D;5dhiBp5w$P0mdRkn!3H#jg4DLfcl_Mj2Gq@>pefQdY(R_kpdCs{*K_<2OwxtrX%tR^c z-lCA|C7U&!Y&Z_Lmdc@`nwz~#aNG{Gq2l$No2_O`EO|6wcKK+KCY=H>b(MWd;aFUC z%lkw2X6_8>0Z_}aoSyekb78VJXd{nLW6BwI$qJ)tO*gQ(yEx|vdrfn5ca;!fCq{BQ zwx+zhGD!ulcX%V3&|AJ4rPJ{GLL~H#`O9GT>m_)Dvkm>701}pR`k6G)u{tplz@b(K}5n*Fq>*2wSim!87SeUz}y6|5fr$79&a8iV>(Vx|9?|^<^a*T-!F}oAjWdG!Jw`hh(8ly%()<@I(iJ1Wuh< zLG^rCQRIR6(-P8@69yPvYe`wuc?WN|B+Dx`7%)8I4jl$(h{L{CUEQ^Xqg8WBd~@1l z{HM98R{o7V>tJ!rRV6jj7*ZPU)_DMmkjdBn$Bd7~;AfMBVB=}@3+*VgRm7|vd{&CE zBRY3F&gbQMF8EyZ-%m0SVc`WD=siXwVBAzw{Mh7I4PPv)Ztbn9-qgL1EJkFQh~6ip zND-}FUR}j_kpX3e|E{nguPtO4W1AN{!e@)LPUHFxvW+Hn*aCGyW+ z*EZqU>_UkE_q-G1oZ3gMWw)BkVaf}w#}WKc0Q&@4OY8tL({O+1tEaoC%P;w`oYg$) zvpkT<+gRP!a&*U>wq->R+u>9Z=1Q%)s z6c+yBEw?RBhg`1Z7AxQG&7B?EldyJVeZXVua5|3L4Q^*mUrJWgahI}=dPsbo)O$$q zFGrC8yC!x4qoPJ%#{@6aKBBU*(Lz|{AcRLQQDvex^+wYuxtKKL zRp47zM`ysnlLMbAPPitZnj5jxtv)X` zYGw8Qr6cTW>{KkCk;5@rpzKJZby8I|1-)u$F_r^^+OtUTryJ{7_m=0PJLMG=tWHn9 zT)`C=;ojVbAgy_8E+>m{RmUTCC**jzgEg#?9Gy)*Tx!?%&zc?1HZ=0BRj+EWP9Y~U zsVZtOS3HXxSOz#;@xV297s%^^+@N;^!3h&ptjkt&YTiK>M??Eq$Gn(SN4gV9Tu(x-xFLbFTd{?@ zY~I~7u9o~2#0z$x#deU_Hj2$#9i<`P@Lr$M|P9a9z?kS5MO?kgBgFj@oqjpb>r5>hM` z4T!(FO^y8NP{9DxG^nVk{72g)jcI9VMwRgYxl_$@6qJ;{ai1g9^yu8b-5uh0{^>XU zdn`4t51Rb17x%}(?mOQ#h{u%3L z!H0%Q`0LK+l$B|ns;a0AdD`(RMsrI!G5q#ei-P|4P>av?kOH7sSyf$qei26|q5g

uM#>3$MRE_6A_UPd{p4YJ5cj>J28h>NRpzQr_o zlCUeYU^?47`o+aHl+*fHIQ$kD87WUszp|*pGcwOR_1}`>7Qee|Os(GX&a=D6hJph^ z)W4e5{t@--dwe#`2w$*A{k;kR6f^>Q|Mn9-X2kvF(OH0PNl(j7TE4y*zzXF<)F9&A z@|gz({8nCfFlkPM0A?w%2wY!i!cla3df+>K`bxEC2;shh``f21eJ0HFm#B^}>z%Ln z^EhW>`i=(#rSvAZaQgd+TL&gO@qv3$yfm>QyOkX@F%ZlTPxEVuM8uzQh(!_N`p;%R z#pQ!aL0lfI&s0mT?1gl2lfYR!f9;II;{MR;eAZKgW}e^i{PJ?1)%XevDGIq!1pEZ! zCBcXav>&Vb>Q$Uewnvs$V{GcrP(9>2c1>Ix$8q6OE6inCd3_k)6g@$tJaJo)JjHIi5^ zA|@sm)WFOft5ffmaSgWEW~h3)R70ZU&&J*!tYWD+ z_IHvBjdPU#<1DKVEPcYRrmfqwZAeOHW-$2K(8V$3TMvNQ>&`;GJAs6RWI)#fhF~C^ zfMggyW*}+J4Lx*WZv?AW1nA4tMj%cFzZ@TkhIDy1UqtkL!A5ZjGXwGmT#{4QxUy$y z)IhSE`+_Hhqc5A8t=4{(QH>TQQs1tQ7eDXVnuSOiI33*3m?9A<9&$^`nVXu0;Nc`u z2wO=;ZB|Vp<>%+?za}JYl#mmk^?NqqDm>0-w{FcOvc`YkeRKj9})!isj%XnnsFPJZ9{E^J+pYCf-7XfPn6k>Fp6tNjfwf zE@r?{B|w5DzTNE=ZSvqoOnM~#ou!%@lm`I7U^Z)WyzGtSmLU@gFf;%z24bzX?d|x? zKkD(8=6d6Y;%s_u=Eat$-`()F-|Qa6BqsVA>et3vO5|x`Ns~1fu9-7ofBhUc=DA$X zN<>Dcqe2;HDbZl3t(~DBkFMplXtBM!Gm;4qjoQs=X;4{edi83rVZAJ8)eZ7~ei7G4 zWF@5UBxqc90~@BK?5me*x}H90vg-O#gW+InThcb~e_^0^rngo>`&&^Yp8|m!Kvgo6 z*VNi7LClmZi>c#spj&fyG;LH$?=Yz69|&QvGwe8=g7?{=AC-Mp$xFv~!MraM0GVH1 zhGF&E-oDV{NG>5E5rC{l=6;YFoSvTNa#R1Ncb*Mu+5eSaA6e&Zepw;B-C@pw{hf%s zKEv_xlJ|#_gxS~vs*7jX%ADe2OwVpX+r<^hi|4Sn-dH0l2Ip}pR~;vr3f#yMe#~N~ z_^XBLyltCF5{QXRZZMz-ea?J%lAN}j>;z?$5nCxlpPiFRVMNyTd;uJnOUaE`)r-*d zovIvk{~PYTb{agTL1oFG((A=}bH%8(g{DAdG4bi>sN)qM?ki=Z;)^IwMc^JaFg(XLDf_S?V=JoM`oEs8cTCuTlBB zZQ1g*O$DspFT;eTe%#9Xuff{bn^*f(1yg6&GcKKXdz)O zaEp&?p(~InT(J(CS1>xRJBMY*(9p1pQ}?$X%{SNjv50nGhmP?I;X4+@H2p=^!8Hvp z*=SwUHAbn=8GxD@xIt;EdE{=Ykw1);xZF4->?{_-L-^pGHT47BK>@nTVR*D#-228TKkz5N)w=P ze`LHt5SCWXZ5~#xEz!fdyv!-qpH3$|{ya#ZuL2qU^Ta>L_P!s%*K4`yi2utwq+1T&8eRP!;IG*ZY?iAw zZKu2nbe)jtEBr4%VXvQ~pb61YW6=7?t?O*YM=-6b7BEx`OZWADLxu_s{~6J{&;1r# zH9trGX}d=&*}?Gc`*D1GCuIWOEF~H?HuetBA00W1j*x7iU2LPQo-<`Cwl@%1QFIJBc1-S`i}AC#w$o|0B49qTaDNNkzZc%P&?(ww~4(?}}@ucP<)x@Lit zhVd1t797X~GkI#1#54=1%U{N$qV!uQeou#ewLUFR%81riP zI0dz6SW~+<0@}W5auAj!`E`0FWrn|bN}odnHD}+u+3Is>AHfYsLwufTRM2^4M8zf*mUzqAb4#qX?}l$%87R1+rta&Qg74oQz?UB`kAZ(~yxl;`Ki6$0c` zc6T|QmDw_2K1xy3*wVJBZ*dV?MniNw>o2M%e}+kt{FlIPtcGa^*KYeaG;*b5S8uTq zWb-5-Gtdgp%yoPQmA-RR@(-VYyl78rYGD>AQ)I0=wY$F$VnSZNV)EAzl50W#r@Ao? zJUAMNV&>ZcA-y_$^Dc8HXuaKkxw3*AfWn8_l)xAE$^K^=&E&t(`d>ag(|C|kFF?_HQQMKvg zf;RCfTEuZ;HtoYv{^Z?9GG*u@gytzo`NM^Jdgo9(X{?~4n6qJP+!pM&DWcafnU}P` zl%##)fkboN@(qNFQ;mFll)|C5&#`IkPr6~Fu2qLI7bX`c9b+@y3QCj)2TJTVVXQlc zrMf$@hv?%+u7x1iJgSb}OTvGakRsScOL+K*Nz>6Dz8-|=H%VbN%ANs@8x6(UJ$R3* zqS3ZIDnTnREQdPF$()7;^nwT1Nvv&oeylkzPsqgGkTpv;%&3YFfeVM6RV-@+JrECR z@Y#V}w(zdt`(}=l(8N>#v16Ru&9SPa>H>cJcXsF-yFZ{8UJh^;luHDcFjzOoxE(SP znz68uc$JIM_R9QdyFFfdh3U5H_f|W1B{+<4^R#*&II0tQ&9mz_--uw+7SK0Ly`@_! zYs~ZQN8~g_FseiRAn+uHc!?0~Fn;<%dXGmBI0$16jxB~E^85_LUc#84sP`}b`9l3V zNw`7|wpKA74b*@37t?bJkh>m>ZI+TBUYmB@^QqkDT;X;c>l41{ZfBr7T%2u=vo`V< zNp|nawuK3$$gA&|#M3G0RD7=F9Ld_L4-f_;&`Nk3mq|Ex88qjbyO8%pxdt85blS*%3gwKkoN#opVedU)9u_+~;NLO! z(8jj5BwJT#K!h)`b6ag4<=@UQl3)(C)GfSxvRM;%hRWV{M95-GVKoGl9{fIPeY896^Rn=Mg{I7_p(&Aj z1Suidk6fc_s6u)(}xjd-rnI$&>Lcp zvU-Wc$$ZfaRoEM5rb>{|s79GhU@A`lapw63)wm?lJ0XS87pWLzo{{rAQuK z;^qdxw`rvc8D}_1zhRk->t3Gnndh7Y(@*Q%YNp#Z}H@v^rL++H+6C)%#2$sm>TQ5hu?7-Q1Bu0+jIkM z&(;v`5}em}8n}#UFJE2p&>MwvEjC8P2%J6#y1%pScm-QZFhdvFpb z)k0h%Y?Fn#GG$Ngd-k;7j|H*^3|=u50*8&uxTGV$d;Kdo_x)o{OFkcJB!W?-*s;h+t8 zA8(X1WBFDM5V#UCjCj^#9KmZhU*`AX54~_(_T!F0VdX8t<(|nSWX~Wd_iXi(u{T^A zi1eY|ES$Dam(}jxU+g@y%&z`>eZ3J^YsO3V{2|8|AJL!(^JsF6;q-QM&R&E0=~b1G z%@vZqN6T2^*@cCt6fbZIuQBxE0tDpkT3m=xIC(tC+Z8lb zGm~!zTb>2LC4d_ydf6Uz@jR}lmG=S)CR5lR&9r=g@I=tlL2YEID(Z1FOGkfC zx)BlJn9NcKN5zu#rE?#9qa7VPi>pi>UdmI*kDzQ*-*jjy5oUYRm7G3Y~yU=#*@`7vAWuR+v zY#h1fS$7}U>q9|t;mI%;32KVwy2hjl`4D<_h!JqzDs-yK!DKy=8Er5I7EKRtEjy~&w|p=>amU~92kqX*_dFNQ=WbITr2T=wK#yX2oWzqdzU31^Q>B4&`) z5_%*a_8qqagR(`lVki^xBiuz1$LLQi?IEJ%IR1QDbR;ECmeMV9Jg6OqqkEvJ$&-~_(c}a`87?v$0KM_&>&HU> zX@mfCIPA}szj(Y@?J zRcwBw;9JEkj%l3@6NpLyqb~&_Sw$yZ3gSAQ{W4X~%N}>Y`NCN>S)UsTJ?zxNi}oiK z#i$M8k*elFgMF!UlTun<8m6r-6bVxa@S6o z&`xsw^_?cxJMFgHrB<=~r+09~jofQnVw@MOM)&I@ps5$DWsZvkP8ax z#n|Lv2Ux7x1&&S;oSmt>olqfF?nM!VA1A`1IoB0jJl>qSUSbvkQOLA#0+`R*!W-uT zHX4SuY!5tL?~m&{wrb<|Z2I(e27qpXid>+j=tKSeghMy=5}qQE1$nw@P|VvOICb85 z;ChHgP2gJ(Kkf6hVzaKee2je{*fa|g!@7sgRzt{nIglG}BK}&Orvt9_Dy` z1gyv^@y-Q*jk8Z?!ry`x>vpz`K;F_ZoUHy~sGg~p70Gr2h z_!jPw>VpYh{k{pDs#i(TGWO^I8tYZxfCKl7T|ZqyhE3FwpxsYV;4C{mwk$s#{Br5J zULc>Rm=NX%I>JPCA2C}80oq(E;hZvR{eSyWK-a=E@++V_(A;beR1KFL^t(xPH;Q#Tl^vAh? zNdg-uCzbblMhNS3abp`ZSlBF^!0Y2AvjRbvro*MJep^@=-q08DdKZ61HFk5?l|~A* ztULd<1>x*(s}?LNuOb(d4SqeyJ@>$1nI^+Ah5fhFan1FITgUGGv32ZAzc^?UJk?et z(28XrSWs$W_{)hNW%vElpT@z_lfM zOaFDofd_ju)c^M@S|9(4)~T)oBO6T2EJPF(eC&o~3;?mkFTaQ0^9VV_yfgG?jujan zoha&8c96Vq(NriS2b|fB+YHWaHq6e-A6Ab(Wj){4KW+(Bqn;R789{Dw@lyw*AXr+1 zGjN2>E(d1+Lv=UwFr7(dVDfN%`xp)w23c5K%+UHPk(uXC4ndW9kRH98MK|AC0b!T0K$3+){t-w>C-@x%n;F>%WeL=$HU56%W;KbRQ^6n=pFBP21-T{>@>aP)9xJme_40Mkj?_bU|ftGMAF9%!!21{2sZ(wmH6 zH_^Q!Ts4#fx6=q&@J8=ltCdb@M^6hy*euT{u-U6nJy+R`T9E(XN2#4*2l0<{{hRsH z)oIm07YxmWt*m&ymztv{MNSH>XUcPM@J@iE)l3}2ZjyFZu2u?wd zj}V4NJLgZpk=vu2GNi~Y=MGFi<7#!-qX;CveQUk7>e-F$hLt(zMy4SH%cW907eD;) z?D(eX!hQ>D@rlPDLU2YH4H4KrAfaLo#~}&j2O26`Qg%s+`rRemxwy!@L9Q7r={m2uUpR?pVKVw}Jl$I{voX$K3<_xaN z-*T&}Fhj(LHVM<>iShF0kAP{?H3{PJcck6-_av_2`pKuYt|Lw>wtIf}SAw$Z5#Aj^ z{e@&ZVt3hX`$7-MfKoc(2IUC2T+~zs8T9c6qO?tQ;!2=dkDXdmezKB4EKi^1twjER+b zOSiHEijEHPSrn5b%=-;2C#MUz9QL=Ky&<+bo%Jj^rqSE=(jO#dW`+=WYxpDg1g*Cc zc!B=_Jzc2AIcvLP7#<#G(BtDh=C#4>34-rpU3(4A5ro)i6!y+8YZDN8?O5|50D=tq zIze9wK%OdDSGyuJ+$VXz6L4{JZ?hkslKVNcgW1#9E&WZ!m6n;AX zCwsbH15a-+LgVVFxTwLzLnW9@E+2CZHhaC0R=w`>8mj6r;qKRaCaT=VAbR^rgKgM0 zdZKue=Chb=ae=V+0ET&@4^u4nkB{p|*6jnS^=aGnB2oB+0}IBOh4$aSmsX!IXI*sL z%WeTvd7^>_#K+9oN-8S#?t6%Mk-{ps@(Y{`TU${b{#jXcJTJ#b4bHW?N+j*ihnyBG zb<(?p*X@e!Uouz=3JVP`Vt1fm;5z-G4YE~AF93sKiREfEmtfqtr<{|CtZqSA03IQ1QaXlUuA!bDZ7bl4 zd(HB}?EATy0Mo074F-?2tcZXksRQ{}EoYVx8`~aJI?nw0-A}Z8=&?Ol*b-F$5)lMM zZEI73>^Q`9W{oT8UqTUn8ZSAq=LYup6PV-f^Lc$a52<2TqU7|T8h%-BI1}*c;Elu| z>&Xw<%0YGtv&8#_11NYK>d!X7!b-tpaiC8O^Q^&OWUT##mk|AUb$!_j%*9t5{}i!} z=z~Iak_fvW;|<6vi7mEX6SGBRj*V4VIvx01KVmSJVWcNthvPQmf9#&enk`MK6Nj1j zIsw{dcmN}X5;*<&?XHQb4T$PDG}m%tGu$uJs+Y+W?U!;DCS|O(6Y9kkmXq^A6@R<9 zBacZH2*O-_hssA#0Hqi*<1p@3b1WLhD7Ys^QT8Tz^A1hzjOxg z)?2Q&r(1PBa$JB0qxr;uWxqGt{c`sz{^-YMMwdSDPj}R!~?_$$ZIP{@FteW zcAw@&J!2gO5Y8=3lE7&aXS!V?D=GgF;~mT3M)CH%_W~v)ht^_o9vX$$zV-JTKd;S1 zK{u)#|8(cWHyMXhdN?1cl#J&dw6rrAr=zIMmO%KRixDY+$opVW7EHLG_aQa}xc_W7udX}4msqeM z-nRVvB2A!j5ps%0-%7>9p*K5G@JNga&n*<$ftpd4NGq+{-dEvjd9!>@twkSl9%_?b1qbJ})nQ z&25d3pa~kg*wP}d+$~n}w$)rL#@Av%{}|y>Ga zb&CuudM>^pDJ-RZC>u1)Zy7%iNyW`y$n}l39-gI9c z>xOEC&0Sr=Grc#M7d;gDCKKH)7m9fSHH zXMr`z3j=&Dpy??y=;CP_t>&qgd8SY%v4`FJ`T~Q3mc|cI_<}Ufv>jU;RtslsW(J|- zwxfG8>w;ZzSlz)*tV#B3%1m-FHX1aoqhT?&$7Lx5^Hm;YfuEH_*YXY;RSH5R_=Yt@ zzIEf>?)TRApsPiD866yK<8k*wcR!(dmZx5VTN9u$L;ZY9o}XVh@)CJjIGznbcaqo>JIX%wmjd5*8U@}y@t|bAzOms8#HDdv zyuA`m90YsVN`FWEsOfWvc?x(#R`(SW>{%25Bny56yLiiV(~-e&Br49OprH}Gf9c)( zoQnbwAT zxP7_8-s=|~+|&_3>o_zT*% zzByW(6nZ0_M%4ABK68gko^933d-pfoP~r|*$Z17x>{vy)Dtgk}_Vy{Z1NE%44cTx3 zh9ZF9Qad9ZBYc;=P(M>N3fDK~a}lNJzp1yD{zFI29kOZk!mJ0De9n-U@&*Par%V_1^n`4ADS#oa^F$Qt#R~V9u%-+J2w>E>3)DpI>pFaYBNr>3WOA2<>e97 zq&P*LpWi0XcMLWN0*cF7DJpu z4at=i9ZmOOz2wDU4!0=__826sokj$izYI=r;HFu)>oX%4ZM{D?Wh( zPWwxqob3S*gaH+LIaQbY8Xh+(Vah-A@yk+gKK}>9uuHU)PJ6^BsLosg=-cB&y5xP0(4DTneIMS2MY-+~U@e zINiqEs<@&SN01u`Ilh*^FL9-SycJw`E}39C&qaDKB^teTC>?FuW?mDJ#~cX$^mpB5 zgh6%*v;P*#cQ9$#whs-CF30DqVG_^WXvZ0Na&>fyp&iWX1%u0p)O+Bk;#Og8aHY=i zpWN|gmdv`_r3v&W0`HL7P04U^wR04fvy`4m_mL|X)gvdoMg$cHE-fJ8>vfa;_DHWg_oSBcr=M_aQ$waV&##Np0 zC2USJkQu;!>lPKvo9h0-jU<};#^*9?xMMmmHe}V?(LN}m;uW{~A36&-T&?|okTUk5 z_Gj%UO~wNdvp5>47`ukaa3b5*lKqh;-hKHP=z80_#yOi}zINBwSO;hU@yBjPl?GB| zern+qbP~RPbKuaBUV<)fry(8ahd2@U_j_CxtIoEg5C1c|>KTJ~HU^3);r#|ZBU4U- zf_dr0`-bVK%@Gk1rog?P+;?3=_i@eN97II-rt9}pfg)c7wnG)qs$r0(3)BPYpTy2H zTE3FDkI4j;z#38SVrI&NHeKhn+6+m~ce78T1Qw#d4-b)x%*1Dc95L{->W`udLrdEF zG|C=sN%i_E$Q_?^3lt916%8UX9g#Ka<4*Xg0b~7_od!mab~XYIZbZ;=pvDr`*5)=d zGb?z}QBqnV)$AzUzj?$5tTy+~%~kc{Oes2vIUj1a2q-(&x8VcP*Kv}n*-y)J@Hg+d z6Y$G=1m^RO{$5ou@PB?va?0n<6bJCVJYUhZ3E+^$K?f$HH#Ij8gJtmhs<&F9wBKK9 zN@4P%Ym}pFHk|SS6+Z%QxQLny#dmWv;AUkz#oxaRXnA~qK*at?)f(L0P1JTX9#r#j zrNf&S_sI?hHHp($OpRNWAcy(=T=Owl`v^MAj+}^H%2M?`q^zl9{fBiZn;#$9DW-ah_ zcxaNEPx=MWZWRF9bRP!I$btf@pV6)!9<<^kc?J1fhm}4Zjn%mdnyR2n`V`mJtSmqU zyrI@=(mJB)9NIFdyRCY1Vm$=n4WhGTyV-RkL579m<6GY009vv^iQ@9UJY@P9HHXcQ zK_DD5t!1V^!zlZ8ZeddM@{8Z)?I=jC^#$O6a>(29^S2PM*o6*LE;v_Rnr?0GQeSxS zv&3_BtggO?S%gC)VpidHcTZ5Q`&?Qh>>7eYR}DyM_Yqb;fvx|v5Id7apI=-hJW_Zc zuehLXY-9t5)3`(;k`ryvQeQ81hh%BuH9~N%;iTY!8h_`${gqipSs5)2!^wnhy*@X- z5w+z~8==?Zjdb@%#JTz)vD{cER#NXPZX(eZXxKX!v+wdP+#!2n`dRML#Jn!ulbz^* zEat1!@P?t`_`;W)@r%Uo%$9%kn&cuieeSPa^ikOjyMsQ#qaXyNYI>wnf!edA=Ig5* z_DG;%UpZ#rUZMM62IjvXUto*e&8n; zuYeN~9dZ(%ndj`#Nq8-mmVWtL|4uq^v8oD9;j^`fa=S#aG%0tSAI!Ygdl!YX!Y+Vs zCKpE%c2%QcVXfV6)37?Rv@|V@`$8W|uDo90cLm5Xje7D-jdC(=r_GL*(hWOrmIp!v zZ0()90M)Z`R!T~${^|M;I`n;Icv60Mie)Wr-d4_Ianb9<`O@NI^q>sFFsUIl3=9U* z!(Ug@07QisL_^0Yls}O5c=bO1KKiSZB^pc#(xT5gnja+8Bqs~x`Flw`9wRg=S-kLt z1?Ye`fe8&oBD+gu7n(yea?o$JKMetZFqxdT=#&qB&-w2ftSiIld1+&Yp&E6% zs1(^rxLs zgN`sV{;!x5#P@lt9$*RyJYIuT#l`KR*)c0|z+*G}0GzL$)3m&I57Xn}RW7eWwBB=b zvl~k`K1tZ1VATE)N}S)fC*a5)et!PE%r{BBOlo~7%cH(qdL&_kL_2mkOWPkE@>8jo zoMvbYa!#97DtdVu-GZP@r@Cv!CuuD2_o%4xU)bJvUx8zik>KDwHVS*EDhVP9{1bo| zSO7kmd1w9-xoj^Cf#Sk<+FOOXIKx%D;g3pN&K4qosL`MvKB9hq7`6m<9e zAo^ACiDr{SBLF0FSC^F~(RVI}?lMMpLi=gtC%@EOcVmdDNTl}u)7_m&Ku}=Vo`;0a z()>6aFv)cOfKcF~$bjqJ>N@rQB4(1*=u8BQ6oCN*!M3z`y1Kh&l{CX5Ry08ZI{AcK zz^cQN zV2=Araiy3Z`?b7FAlADG)7Rf$IQ3l`#ilg<)NaL!$I_I6uve~hI|PLH#Qs%HTdA&~ z{v{=eZ+LAjmOE{_BHw}LRZ&GnqCP&4V+*)=xsiiq}5eIQ$Lo_Y{xq7JOnqT6Ww?0KsHRIv?mQ%$y z`if!M9~y70uB>Pi2;vl-$-qXzJRoD=pc040`Y~g-SdCZfc`#z96vxQ;=FEYO%3@-q zU?con{b{xzmS`@cNC}d?1F@Vw?kX89?vWy*7#4yOSP%d9VJ6 z#(rdvwbQ%VF(-$P#zU0R#y=g-z$YJmkJ)mzLvKejQryoQO)PSejj%)WCWjWPzj2z^ z30$)NEqPOw2fKht9nl@K(amJ{gr{Xc=vu^XVLmQsyOyq4HZn3Iq^=Hw!;l=!oGU)m z98hg2_SGXZfWPK-n4T_wUDEiJ+rebh-44~lRWj!)O9+bTb!d2kP9Wr0+hvp{8g6FM z-GCOi!+zO*GM8OhOCNE=8bhGoL3OD@>C%%ZKYOw1p)RTSyXV}8FqU>nMvA*t03b{D z>D6-cc_3Z^58d+smW8x=g!VPtXZER4$oCm@^W@brH>95H)@&Rcl6Eb+YZA+zTXpuY z0G12BChLLTpf0Jcs$(xIgt+%QTZgdEv_#R=?8dNZYg_7b_@2-wOyru`h0GPu|ehQxfHdM%v7&Dl# z;x{a-iL|JNg~n1{vHxd(cvPWtLneZ}0r#a(oFRKWU-?cgxh;tJJuqatyT9bE72!g& zXN?X6+k5OD%Q?S7WNao(p@jkuJt|&Uv;F=CPC}Z`Z+*R^-VjT5MhHMKD!}?5&zE>! zkh_9%Gw?z~2a|bClRR(csC=gw{EnR}TV-t~C*$JF5GHMAHeXzXH%}&=u=Ve2v7VmfOBP_T z$=E#Jc3rM^p+{0l9FyiWvkJ_X1kq2r@HgPewplN{W+pQ2d&o++gAObhG}i8y+XH^9 zCSMH~(YkaBI&!6HwIq@k28YKJxM=SN%Y@s0$>5NK(cjwY8YPWTP5)02(eXE(n``KCEnlf?i(Y$JNC}!p=cWjXn1^)8amz z9qIwH=YE;_1wm5M4TV4{JHaAay8Dnu)m`X^^Cnh_fV{QI+m88p)u;zy?`)DXN91N_ zFRxa6j`TIMXEE=Z<#`Oot{ZoX5{)NO@BEGArKbuUZ>&A^Uj=6_M&HXYA1SOs>dlHM zfzqu~R#wPTEeh%HwKD^5=qr=M7aF16y!@VIAzAgQyCfkCDATT_i*OldYvn07p6$~eDKBQKNaOELGgGz-phDypEM=dD2q5Ddkg(@n>gLiImJ@t zc08nEC=?Y)kg+d6EQbi_tF^fPOmhi55$*dTl4(oC<*MdfSgbsdV02O%ijT2Ld?=L#}b{*eCn=#<1df@o4Ku^ zl+V+a^TmNe_6E`!Ip2jpf5K)OXK8>DPCy}E)J-`u;JJOsdIdtia7{{ryz6SO6ean3V04{=Koe`d+fxtM`?&#F4kzHShbj6 za?sKh6q*{`Rb}6K?IX~l#T7|h<}3350Ayz5PIV!VQ_D4MJp|gqW4$Ty^o3^GBsn;| znY$MG?ywjVkGIirmvwV9b3;1m+l3~gF;sR5(8dU;P19Zjx)cVA-L~rEF+V@`3JVI7 z(mqX|%@!B$*TB(**0#UYLjz{AVSD~XXwCYg7$wR5Yo5j0#3w=TCp^og`qE=}L$T`$%f zcn9gQ>hMN2?rWQt02~GfwG76&-sy)e%8&aYA@m;jxQ2xsZbb!s6VdoC|;Zxc6UB)%qf3r?S{C|8QKx|wIXA6MwK zk}Pg=tA_6hxQ|FIVkSpTqD^6~T`hl7@>cH`ENEpd&FM!UN~e? znf>^zUncn0DZril27a|y&vHuEQfTIow`S$#Aql=b5!%-{>`aV*%z0WPZe3Rn`ceM| zp5?2AQp|9$b0CmM?0p1YxQ`G?Hojc%#aWTeDQ;54ADCaq_3e*YdfGO}H)VBH%04C} z!;OdZ)HCt6CbR*^5$V?t%Y^2^?Ds%^XcRNPbjYJ6>qSH1XXDDC(=#UNr~cWY$!SBs zQ#5Igk^ai>QKt~n{KF+*YhxT;Y02QmKAW|NW;OYk-*`)c$>=Ka?OjFghB) zNrb%RLFTRb1jm@^u`fxesWYI~pPC@ED;#clz7j8= zA&vN-Nh$&k<)~-=XYmlpG`=?Wk8*SN6um-$<3&XZHt2({LD0tOsZl7Owwi2gCD6dfDvXNK~C({@cb5ON@)|cQF$$<&OJ(6%tezdEjFXF-AQfx?(4-?wblKh?M$=& z)N*@WXnVliBBuDXa}EUveY(OE2S1chkA)y1H=Wf!i;xP*soTSccZTvD%+*qdr`tkQ zc=QHyahqk#X5jd|$G}s6I`*1iZJOxO_3IMtmaV<}*G_iD(fZ?G5Ip%3ehMu!lK;nR z0aXfdGD)`)Qw~}2=P`)o_$R}^{C6hizBMjLyyvRgc35^E-XfxsuqIlUd&ovb+|k0z^M2B;X8=FC1ZnJ^@!=8)c;bDZD~nyKuCBKK@5sOD)c=LO`LcVBx|Rmd z?e*O=l2JLcifc&Db*;L6IaTQ@3WNQJNUZ5xl;?;*bW6p`$#v_-BFODT!u>1ngu_vM zhg#Z291Pi)Tf3Ot4^|{XwSBjfcaj~t+nJ7sOcPjn`er2~c|n)meYy@YKjq6CN#s5^ zB4)UnGFZR*_+x_&kF+&^=&s6fG;sZeF)}vZC@HPzikB0hy_H1MX>nyxI3)zdtZCV!6afM;Es=IXSriU~b-z$DBPqJ?s9c0x|QopD#_kZ&zG~ zGTdG=C+6nnKz3n#|9>u^f36{Ycg+70uBE{N6wJAyENn(N z?}8><6CxsdyMXYBgGQ9M5o6l(^3Kiv#XuI}`PLAb@wl|Hc|i>&!j=WH*78%23jGx3 zoc>J0?@>5tYru$vN)q9}B+#FwfVh5u?mCs7$!@{B><}o(vRPW?<(9GO&PU*ZP4cow z<9Rs_T{KIlXhiG5AFWf_Kd7C`?4P5d#AQ|E{&S*T5MW8Fj3!=_0ggl&fU$8uY*emfVfMleu?0 zVBPKO|NE?*kt0XTl_h~l4!?poX(S9y@JNEnOzy85SzranYIJ)8VWIkNi~m%4dvxh? z0pHIgKR>d6?q>Vo;Gco-0bziw_xNa^l}CNo#Gkq*t)GS?SEyaBvCeAo?c#RaVx`5{ z&U8Ssy0GA(MM_K)3#@EgMM$%AnWNx0HfIY@k3o9Zhjg~yUTJlGmKvo7{fVOQ>nF2r zt2&yA(aG9t`hBzG!(Ocw5EhY8GY3(7^?6Mu))^a6q~*k`Zbw$xT;LH2fN>jN9u7B-ju?8Ef3li>$(>wJwP}kL7GCpteZITj%iM9pq>}DP z`lJcu+V9EB>0#JOPPE>xdhFN?4G*99V9H6jqflSf@2~4GR>6k^6V^_-_FB9^#xk zM78^hN>hfQO_G+2h=RiVw6t{NR)ksIH0A%+JnnAl8`?qa+USCSX0UlY6neejf`|4_ zQ3nydwXOS04+esVYV8MC9%)1%AtRBs+QOr0(>~%?BYRQt5GIU0cAxBTRA;(6`yT01 z*Ey-SX2kjBXYQ{To3Y?JQp18(sPfuEdod4*t_;pW#4XsSjX+J8E~A6S%)5y1-AsB3 zoRE)=>kX(%w*9Y!enV3xJ(i%(iN6RZ%7@pA_RFP_A&Gw(-Aq}F+t-zT- zTIkq3#qS!NNA5mJM@iOT-X5d1y|VB0ZBXf+F;E`kVpq<|de)n%BMxh)iiePiOvDqs z1lgagrGH;jj8gmPEod-BtadrQB@w9^I5F^E?fDXOsB;USdjc6VxOr=(o%l%k>H1>Y z;G`V=?jn(^?2e9@laKFR<=SsJQa&g6xI*!=^dei3HH*A5sb*L7g+%VxGg&m#)IE3D43j5INIR!O!ZcYy5>}>yL#qXo#Cd_fc z*Ose(oA&2||3g@(@y-B0@hg*L`6sQC<@j_nLN_KVed%DE0i~)cmRY?hm2x7M{ z+sCwP-s9ll2zx!wQpwaBujdEvGFf1FtCmJzMUTvZEUl3ucMkN+#UEy*K79cq`>G z=WO4B`M78EL|$bAUYr{F0p%KNO{n*rLak>FC~Cy9v9V!?`{k4>3r2Qd!+Gck=6Li~Px#)M={;HGFZoR_u)(k;FKme!^ z+PLtiJ+WDfy0e>`q&?P=z^*1n@YM7Ev%RC^XFI$1Y3b?B${8mJ?yYXWf-;)lXhxFi zo>Y~?1xn3)dU@inhUBx^j-v(K_}^w{neb&UxD&vtA%_;*_BGAf6%*R+9Gr(D4;=NW zvj1braSube9%Vd$*~jO$=l@W0>7EFPkc+=7K0|A_FF`W7*&a8`+-(lqFzY|5sdrWz zAEM+Hn5=hnngs*~=QJ0*>jjc3WQ3E>4YL`<8=)1@FufO&8N$C|7)G5a*{TiYhkQjts zehJJkF5&|cVNoG{=9^=|5FihUoSq&Ii0s0$7VWBH5ET(=eEI|cxZ-YTJ66iofcn*) zXmqr{V&!oibb*VDyBEKkC@ZV6GerCrprX}sMDwY$8_uOWK#9~E%-uH#z23#YZ^oX2 zcDsn9OtC$zpT$0gGBkN|Ia0-2?Wj&}ajVqg^xwxNLR z7Ry?TS%gO*jZ8?!wy)6pZl<=ETHw|_Sb?3{idNbPX%UH_uV8J4af?E_&Iq$!(EXHazB@erwmJ(>`MffTjf@jnt3-t*BRQs%+Q^W7JQGF8X7*anvMb2 zznG+CC|i`4wli)ej5}VY9blEjGmwc@GiC7)Q<~t!G`GEj>$v|1$N6NL{LpmHY9T_%|A8D-`3}ez zX0bU5+1^&332)&PY)5;%C5?09v^x*2IT>i4DkE>l0VfQaE?Zbw;WE0vq&8TJTWaNm z?7dN};WjFn_3jLs4Bme&QvMV40`!W~JX2DiP5^{v03cS6d2b{<{EmvFu0|^kU`$2d z75LeysfExSagdeh<{f?V*p@)R(Q=?%7VXT06zN+SK<`E)!3i4~VQ8{3H?}Y>?0Tob zREZ5sfiGeNkAgQL2g|`vj`biH9ND+5LqXJ?&kFn zkZofmq8ad01Y)goGJB;7Yxhqxj~0hZlBJ!7l4iI!nY5#e5W>Yb}SHF4&NBafZ;E? z%^MyM6QUeUet@V9=iVeEV^$%El{u`2^+a5h^u|Y0u;V#reo52l%|aZ>KQhyBHu> zJgd{;@#|4J@cnJjiy)oBhkt&4p3LvT@#V{x^?k|K_+vC8A_ka%onbIJAo5q$am&a0 z86OvC+l|brcYCtJ<$9KNBr1(8Tw7afJigxPKkD~Rh~IOc4}&W#Je=8jnalHPQoQl? z<pFAo8#X=-GBpuKndV)629Zp)7mQ5SlhS= znk(=BWoqH2j1Pg(KZDzh=bYu0|1h;ZR3F$V)RJ=HkO@Kn)#E+y5Xk$%4gKaskfv9z z=CJ+w##H^M{a^VAtWcNJ6;Pn4oE++Y;W4kX;dFu3g3o$Y%UEBeCcvtQSNHvgs3qHo zrnBStho~LDyt(TL*m`la^pEmy%XMiKluQIKA> z{QGZ`MfhKGU8eq3*nbHGpKH{D5=CSzssLq+-^2vk#=J0DJ7R!rC94e_?2tPOf{&wg zOWD%d?PXwP6@OH%cmVHxAVFVVzOmkF3pWtR9567hl_!zrNr8MsaFTZOq5)1T52IG&p&5kVCe$B&rvfOC(8*TP z%6vipfDt{-Qt;Q)k!DN02&&nOt zuW&H15>U3lb2B_jj#Y#QbT1!yhAQEQbj=oEOMWf1IdGbcCDUD|W9}s8lT{vJl2G}q z;REQyNblesGLU_?Ht%bw#-pwv!fYvPO zF;F~r19O7Z-0nL7#G#^|%Ddi+lG%4$)n8P9DyJf!13mDzLaFG23U+??zm9 zEk&P*D+xd9^o>TsE(+g*UWo!t>@1&-J|hwAL7C!u9BKUowF&jRCq}1Z(^$ju-OQ;q zx^sPCZ&u{Cw@3O!mDj7Rf06i+j3_J@dj;F4SXws6QZ>7gkjIgxKqi%{cX5BZP^xoY z<%!bHPh>k3llm)f&>RJxrnlTC2;b~#rN9vQV}$0j*QQfMOnIVDB-;!13yXu#en3EN zGXr^vz6>ucxDX3F zflb*?Lxbv#B@PkTQ2dLGbQaIgC231;7YE%Iv;KkhLN=KRr#l!$%u)-|)2p@DqqqzE za`(f>bNF3t0YU)DPsl0GSKxdfYSYvk&HSF=rBy zJH_G<*U6M06X?K}$LJWUw5xzn_(S*8V;r`GghU*9=Hz8AN%c%=iu>}a{iV~zAE)c< z%{21H^PulcmJ4X=zF5SV)Z$-qxG1ZCcAZ^ThUcG2+}Tt)b_>5h zKHPm!zl(KWR5Zrzjz~Tjn-(Zn^Hw$1 z12kQVR9$4x>YDV2&VQSZ7n;No&MBmo#?3BDE6>P#U$>>GBs@ko=RXR=epLWxRHv4f zhD>`|ZRF^5&KxFh#sYDxKvRXt&pGTs_Ayf|rS`6Kb{59&P5e~I=EL&%W=;jZnyRX1 zr9MGc!C<&bI#7O^R?*CAhSIc3BuH`Y1BUv-xw=jS7BRCi96BT*Pq0G)`iJ|V!p2J_ z>Ix`WH1~5_2q5}zDwr#x?!M6?m@@_PE*qa}r1H_lA;Lrc`geTxLBbA#6-|LzawryM zt}CM~0XhYZ{Wv>(JiHL<%)3%Hf`KBS^{Adu@D@!JOmG40Cg=?-?&JmrBYSFwsj7-5 zfdAJJ8Tt0f=t>}OKD}|d=ZdNP^G&lW(Mm$d3ui=s2%IS`Tr=u*b93uBpC!M1e&ah? zMje^~fq+=>a@0BNt6y3I@xb`9=}F)BUf)ld9cB}Q4wtnkdaLE9@WPvS-0a9JOXuZo*@tx|b7i-t+{^G{#(9R+{tFDp5 zE?d{{%v2-DU1w5H+uYi{LLwP$8mRG|d5y{0I#qIl&yL`pwcc=C7tN<*ze!VA)Y@5ZuVnnA{H&6fdFA+^u2()YLgF!?ypHrdL=)~i_fk!OlMRiM6K;# zA=BNbnFR~l=DdjCX-l$2ub*cP`>qaf(6jqJrwrbzh=O!$a2iT?#ioqc5(TT1Gqs7( z^G*htLHs&3j`@~%I*J<3Y5WGEoF#DChi_t$#*45fMW%+&-qah(RhS!j85K#kQ>=C_ z4v9|GGr|oDM5X2B{teN%Bp%!2iZKNnamZvx+r|VC=1+~x7aH{w@(f&=g$qW1t?itlN89Ml0_LC&Zb;TNOO@@iUPj_i3#Yptt~ICrW6iv}kHJgi51?76)nZ(MvZ%BRNeov622qlv^J)yLE4UeYtuR!PM0K*xYPcJSygIG=tye$Bu{yZthE#$ZTip z^d(&BNpyr;*Z=O&v`4RbULtc?F8lyM2UV1EcQT2m{IF*wbRTo;^^lO0@k)G5;no{z z+ta?~T%0$=cJ1{=6$SHoT263qqhQebV`r+zGYc-yTiG(6_Sm5HNREr-cO3Y@O~iEl z)oF&uU^wa6o@+}+vtCjm)_pGuPeA!bu@2rF5Utfj$oQEXiEwH3c$r(P6L3UU2z8&w znW?I)QwE#W&yY@Nbt_wQjw2EVT5jMTR7*mV+=sdoU{XZInMrJXbZJJt4-ep@+Zt~6 zAF)(-`OGgYX<4vQT8v@3*<+`e_I%wyNrpNAHufR7a2rk{Ry3PAbh_YFjt1)LzhpKr zef~>k3uDD+7Qgt5fpQyjNNTZsX1;?DIEtuQuNCu2DwH{yorWmfBF&XRvBDpwXVhkL ze+1Fj*NY<{gc-FcoNm6E7;g(#I{{AHj18*fHtSzbdl*pUi0W8($)1-1ZY?8_DuIs2 z%@O{c;l0Houm1Vz@Q%ZW*n|_|RwG&+z%UciSOc~bnvXh|SG^g?CqbF<0B-^}_-IY+ z^G0`dGM`&c#IU|FT&QjF_A@QxfHwjnvQS%9It^n{uzlv4d|sZ(2jK-h<@ssBl1i+4 zaHU#!PY-z!=6F)Zdwz0)KOQGX>MWJ7JM)xQ-uWb3JgqtchGDgFH8u6N3aCy5IG)!j z$QN1&-2)2U)eg6-^?Phi2NXU1q~@319S{n(&i2;0&IAhoQ>X5#%-$)Be^vs^a|5Bq zQm49IK&iT5P89lGf}8dgRS!s%-&L{LkoW>5%I9LS0L3jiURXHLYN<^Vg?&CAS(M?^ zc=43jTc&(*4xQG$8sMPb5X!M>Pi)^X>#imdl^$pQKZyg8`E_Q+^Mm(3a&Qj_o;>HL zu3KAVe>F$=4T^97WLxPD9A|IYKwtkYul(d|v;KL1E<=R~YcC0#sB_!x6?Jh?li6Zu z#cB-~L;ICQ@Es+7-Q9UQ`P8VNze=R(3nxUX&vXTa8I@a^!&lyZEgAwm~^UMx~U z!pQbkR-D9M8JbU)UrHwfGFPR7bgMAGUJxYK^7ao(Mw+e>1_%AMC(<@K`6j(-Ga&fo zY|P_y-4~9e1K^PIA49o_&%y3-&p@%UuUI)dvt9g}w7Y(NdHEgFO!9;G^{i^O`7{-G z*(IsZlP`6qry@ebfCWC=%dsv9iMb|7rM|$$H7<%$|14 z^QBF}ZQG$F*q^xMbLS@eb?y}(V?CbxJ~i$X90C9ihkzp&ENg*W>|-Hfz6?gVWx>IF4%eK^0h z3BEN@vh&^Sx?-a~fLK=62?o$Hn#e))VTHTs1H+a5`r(CAw#Jd~IQ1l49MRSeO30p& zIcUtbJc>EsZnGKkB01B|B4WQTF`>dz@yr(`G%SIVQMD{|DVwxiC{ygS`*6FdQ33#T zg^j-KoRXWCSIzI&9!Ke}_;x>}5MmRG@Os*Pez!3yVn@g;a!MnrVTp}m#n?xw8l<=O z@C87}X-r+l%7*>V*QbSJTIGA@R~37|I^~emqV|$Sra%~`Hg!xSKd8StdxJ3l9t9WUtC);J$xM#lGZm!MoeT?V9d|R)yW{K0h^mnc!+jCl+4mC z4$q4-PA&2I z1KC)fj;-wO8)ep{mfe(P_LmcQ$EQD5HzVj87tnZ&EcSKEgs)3I7!G6>ys4$+B%dfV zNWD?pGz@UGS>reqRVfm1smRaQ4Y(UlL!_+5U0(+;TuqAtvY9-)J`H8yPyN`Fxe|L7 z7<0X~fdioQTvO=vpK??=ukau)t`g?csJ2EU9e5NQ`o7U<;#9++iG`)?@eincR}VCN z=O=2=0Zm!Ooj<-IE{%sSprfGBJ>56yCv(rDGFSFwaa`WHmC)aQ%Mm!;=3fB*GV&gc zr#EPw(5Ae@^*<;!NpCyJ@Q-rkK-&b1!Fmvhwp8$diD1(9rKW){=xt6HW8kuFQ^ z@i#6;x;0=BzD8a}h3Z*IiB0W8XTVJ{F7q`(!A4GZSJ&APedPx(E<6|*m>PCa=)g=k z7Yz+O2??$Zs&Ejuwi(Ink9R)Cm3#1rh=KmIk7HLTe}7KYaw|<-2P5ITitWn&YgA0G zm{_`kB!L9PK?PtTHSa!sDBPx)tDu=59C6eX?!Z{KG8kE8Do;Eu~j@q9%G; zv}fb&T%QI?7SRGcnxy}o%X6DHgf;<$IsRwr*(EyvyTQ-!k|C^dkji|v`+g$)dZ1kk zA%3)_N!wWH&he?fUTqPI&x@RC=Ym=xB{Sq#D%YtFp6mBZm9f#!+6M z6scSXnhUalPNa~7d98h(q4Le=1xV6><-ERT@t26C0;+vkei(C_-MtJC6ou6~r~eJd1>PiXs5D3Tzf)oE2`Y1d#B2KT{MLDkZ8*(EzWMsrE^#S=db&&an0X{H zT%l!N)mk$cxfdo3(SfR(7_zzg7fv}Wrj{Ro>rXNawP;Y1o}l>ili39xP(8IYOB~ga zk=sFiMU2)vx`NB9o;SGt)4=>(vNuBQf?hX-;?qR;4u+Q9-fXY*G`uUL4yLHmx-&vZRZ@!`T-3HvfW{P0&?n-1xNX*HVOj$(*V8Igd^72ak{RyBO*iYJDy^T*@ z0Rc)Z7#ti+E>6d|Le9Z~BL!ycMFh3{pp;5luV1oOieefG6#iekX&S0+`detOLz`YX zE?OZAG}}1DTTt}yUkgznkZKP^TQ`eW?M$m7UC6P`G|g`bv)*z{3!f?=G4}lZ<9RAE zp7WZcapm`r9JaQ`ZSIyk>qnh7F@KUt-ge*O*?{Wllfb@JNdU%D?vmq_xdk}?Sq^a< z30+mbr#>^!yDNRZ^Hl(RmS)r9KVm*UkOxFLn260=d(a!r?N{R8icvD3$O(|^J`Kg* zEbtcDu1yQ09hHd&|t zR3t1$@SdKYz=jbdPEO7@;l~}&LD?PG%^U0tB~Bb(Hv;Fi%Jbe{9}io<(+>t%K0sf9 z*e;vOA+rh|yC3&?A+LOVx*V5+c=&zVCTwk8an##lJPagov2WB2GsZ)nwYXgZw|bC( z*MmemaB`vlPjVCATMGkJLupX|%%3pc8%scAN3_ZR0S$Zb*h7~yAvsw61Vy6`>Y$`d z*$Aet4`R!dKOhwRQm46DNt0^0DgwGfbm@b8Jw;<|{ixN9yTdlHGs)Snx6zJa+uaSt zw11)J`Dzl!XDwt{`36@c@H?QcPfkCbFU#V*3OmU3av%B}2<-!Ndtj@MPb8 zFNF2mZO&d39$R>A$E`k1Z&(710GqY~qr;<)#lMJh!YE&rB(|ZI2IRoE` z_*~HdE!E8xrT!gI6vf@#nvVFNj%vrd)bYfCZj^?GD~W`FkPw)pT$jCWS858YB?F?} z38vYnr>E_nujdW#&Nikd;fs~{_}mB@PEa33^jGX;Hzh`he#Y4 zZQoyrxP1}WY+nvLsyh#PbYu-$;}qupfRSag&wkPF+a|0M6yazEjntl^sl zueyBEAapl;m}|TJnH$F^EliV?G$J}PvJcgUvU6fe#}%1$JxVhZFJN6lH6raGIz)(M zf*n7fX&IfZ@a$WI$a;l1EZO<7YXUKiQj}xF;|F%J);Zj7i9kHyWP1)7`!{ZTzPhHS zfyEX{0B;q!Xtdj6((i&M;v(rh=vQIRMo?|N(p$#;q^xSoF0LI5O7Uf>hVJVf{E`800d54kH5R4`gBfU33%DtGVWM1 zyg=G^-27eszwV|j1wF4V_@W9@JjmleKX%ZQXFI73Z)ApcZh6Ld7Hz>oqiC?Nz8F&B zc%}LAzS__LikQvmJ;TJ@V>`RK_5FtaEZS-e?)E*J3gX-vxSW&sqT$*oH?5aAj_lN@ zpN`iLBC;E_qQLV+F**C)sDfocw(G8^-+u-0?PWOdKsy>L#aq(a_|_8=5aj!sAtIN~ zO&Q4FxRW$fuPpr$#IZb;*^5gJZB_?PQd+>twv{8}PUKwL{!=s%&o|mt#)jkLfle2R z!01b|g5wjq^q>=Tnsh6Ds*9?MY@NChE+`=P9nx#jaKQ+0s$jvoTm1KJ-NyGEj)Ytp4@!Lr~0{f zPmb=Tg!qVg`{8HfN&mRK%ky*cQ|A0z?cDuUTv{p)q?$4K1A0Xlv%^d}wq;K_ol`A? z@88unk1d7P$_olij8A*y)23^WA{{AZ7!thVcVY+YT#3ffBkYhXrkK+Cha8PDW8 z@vfKy)6rVYgyZIfA817dxlfa>uO)uU%E*X2k11HLRg0?(+=pL=M4hxcEy)_0l8WXx zf`fna&RAfpl<9yt#c z3gBIgYX_Q!;m$-z42w$kj;g(3c9F6t9A~0N2QxmP~30_InWC&ku7B}j@@}52F8O!YptHTMSZLtrgsqna*5jQo$?p7I_ z_U=U@tFKpCzt1iYrYjp&!fQ_W!T03k^^mE!q~Elng^nXptQo(^ld5hT&(Kz+$AiX- z%V(sRx%n#)0=ch;&_nF&5q#XN@x+j9#k-c?o6+qr|FuO?(jUM?-_!`M+RDe3*L5|h zP7PRtxGXf76Vw&E&l^6Uh{b9_^MSAamgs6RVT%upOKI%@FWYQ>>1;mi;pRT%g)sw! zkcFH9aEz&uATStZm@oS~1Gy%Y6F?hi@i|DuwTB=Hm*fk-p zw_1yA^CHIrXMFr$CxJ{VQ0 zo4!sOQ`yw0lLuKzds3iU#+-`r<9i`rh^fe)o99Q=_qSx|x1oSYHZ!fF12R9dw;d#| zq=Y$VvkWN?CyuW=r}i|V@Q`ho>3LBn0hMdCf*-hO#P;zc^Zl=B!rsA+zg)mN7&^v( zZmE&MzY?{-`kIk+=`HCrTRU!u==NO1+=H4RUVqSB{!%4Y0M;A~hbm{}U${2F=+Qw3 z2L@)fWuq%RlNp!x0}iCB^%VMiyU#F+EPY~8cvOf{KYyy*X9lQSARny%{h>e}EG5Ur z&N{fhF^Zes`2!7mOnR-Yb1591&dX%LQ};I2<=VgdbrAS(Vd6zo-emyNp^)x&%8 zR2C&NJ_czH=WGOP0!2YU=^-49gyFWJ*3(Bd;Mx0ayK>GAEwqE$575LnRoz{iQF)IH z%HJf{O3ER2bhkd_vV(|<7YpYv#f{;X`MPocs9?5v^9$MWlh`#%ZGse3^TnNk=qGFA z{c0UG;UM?*V$S|7XQ}L?YpHHsmwAsP9 z-7l9BrRQcA1Q}6_(If5-(Y0c^5VtYq6r!jUq7R5*kqKxB zEvL0smBr8g*YzEz{d(LWI2@Gn|4iRIRwbAp{!#dNE$9JjlHpDm5ieYlP83W`i!+Dz>F^1^3JqoIPJ5Up)vBZuEc zDw@{UPfhlvN65`Bu;m8WcUR@LXHDxJ6c}U>eMTCZg%2D+v$KQ*HXxz!+s!UzI~4`h zN4gT5VEqEvYOGx#)*>bq49b-8*7-PBw(-GiQhA*` z`?tX2KaCzGUumguoM&HckDE|7v>(5IA)yDKUn~ZPtbO~YvK4Jyibmgsi7zznXt?AA z2?Z7NGm(62_>XP|2?-F%kyM|ek~gmX`?kJU^Udkq4LH3Ox7&=STq8*MzX+hZQxA!F zHgWMH{su`bc#_8?q>%+~r2oFD@5Q}OJ?ei$x1H47$WXLamW?!`LZyBH+t#FQw&C3S z=EnV30fC8LRy!Bm#XVK%-XV2{mvHXcZ?Nf-lcxwDkYw?>06eN$55%A4{wgawb}L7> zQ&3Zjc-iEhbhrb6_?m2%)_HWV5%Q>i`#|bK@=;*#*;O55cRw{n-85oRiwzroH2t2- z8_fwg5L3L(RuJMM@NM+jCVPvj7A#mo3C%=)999ESj_W5UjFF^%yUgTUk$gg}mXelr ztr;*FcI0GTq5;H&^rd3!WZXeU-`e~x` zV5#ff(15r;RJPkw)@rx}{$0-?x`#|WPx>SqS|u%6WIAUZ=1xK{;q(QSZQJ$@BA_53pdu};NGKrP-6$bl z0s@i(LkumgbR*r}Juq~q4BZ{W(4E73a$VQ`-1qx@_q*12{^fF^Gt7C+aUT1&|MqRW zeNLL{OjdoFjJ@Ib?fI21C-EfmfcQZw7{`<4b@#ysxibE{3%!9biW#)zGGaiAb53jA z1YEh=tZL_d0mf{aFM`A=?4{rn!tStEy13u~t<2c)1lR6_>!(f#}YzmN`Kf?OEOSTgg!&yV8<;C8QQEuRCpfFwjS z4UC0AWapUl++tGJk%ojQD3k3^auIMXIv3A1Z|=>`?gT$>Q&MdfJtt-VW<0y~RaIZa zgOcCbYi_>>Ku<|8J9+i0L$!1~=f~?-j;4G1--b8m9(=-^_-8IWCX-zAT|#i(X)LMj zcuZWsUIxpMVnw$o82lnhH_3$mqsD`q+lYji5Da|(&^CDxYwaR9^MvTb>onUa;nd$L z-fyB9RtheUjm1z9$I{W+UAJ8Gb;AA$dlFyvL%5iPMMW!i0uSOa_an@M+LVxumV4P1 z?5!hn{L{AQz_^+Z@N8{Bgr~`c3t8<;{c$&2FwyVGV7LmSx%AQ_Yz9Flfw}Z+Xjq!M=BLdr1jeSDZJ)BN!(N)hX1afnEc6q$=V=Mrppc6|M3BQxq#Gl7VFYfUHtUoxr8%b2- zuKzFt%fLgRu10DRMjhZy!FJKn&ZS%pZMbRKSrbfb?~%UM9zK7 zUxq3gyaje~>9YfAYSxo2|Jo)~U7-LzFqr1(+6SgHzM$d1+Wr&FTg)ER((iVjkgNv- zU4M3<>%RhKgcA|WZIL+aUR@crBUEg(k4P_j?eq~?WV48f7Sltb%NWV`7RL=*7ZHrS z4}sBh6>?0V>rYWMHX2LPT>8%tI)TN6wRnCYk+y3GfelArBB=4JvGErG5qtMr-U^v@ zF!GGk!Qz{N5HMa2SDXqu7`2avCU<@(P+MJ%GUiUMR#Z-_Ns?-NGx8~(dHJ`XRYkB$ zMab5rZmmJn6Ry*eoP21}aHixnFjCF3+Ve$7bESu1@$3xu;PA|PQ^{UOUKD68GF{!` z0r}<>PUJss%-w|$eS84+?06_S9RF&zG^2vxm?brYfx=Vc=Pbv`2a)fhqKrYXJ?e%0 z?qZOeOP#AU>g9s#p0KTLc+o|ruMh0SxZfw%r?M6`!#*U^WHO4aD~oYdZ{A2KLcfOW zf<%A#m<$sTECF%49hK(({dcDOf=iX$dpC!kv;x~uC#rPO{duqVon07Cd@SDyx`UEE z?sQ6!c0+Xab98ZQc5%O=8st{Ezwb<8j6R9iLl0yb^Yf)03xBws=XATtHzUOle)@_E zHS(hI7@T36YMMGfJ$=f?zL=oNrEX-krFosjJm{t?XFGM&OhgS_5ck`d<>FQJ@d9~s z=#VYx$+JIS*~WvPn8)_ToqXkYIbs4Vg+Tk_GB;OYTw*z65q%$Zbe;%K*QhALt2}PM zKGSC$S(HK5$XO_#OF8*C*f%r+4^JOm>5H*TMr9KStE(x=Oi|n%n5NCjHr+ON0F;C8 z+{pO7-uRU76u*d={|qmdJC$|krtZNjZ4zcS=IV_F{8T=DDrY=koq$rAI4m^QS2|?- z2KE%Cl|8b#TNZGSiZ$P*?)F2xY5n1YHZHJTmZB#wi7B^9m@jWL4^dIV+dv?Sfs@lg zJI?LGowcuuFkuJ|+toQd)Af7(W!JEFHlGD|t`~ALLBEqyut;3nbuog==RHfu<6)+= z);nl|?{+^IZt#=NiWu*U?ZnYf2iCYOl<+&vPEJSR14bub0Yor+^W_^B%jpc)tOe-~ zAMCOnsk`8oT>Y-|UvdZ2gaP6FEiHSkZ?iA72593on&?SlFtk~q@%nkW&tr)p#;SSp zAV>M}c@y8P%z|!8{+Ffw{nvP86YRFVPYeK)($=oQSqA}~ANn3mO%QV72Qi-_@Xge( znORH6!i*!V$avkJU7}0y*3o4Wo6P7CXTMQ-E?2MnAdBtxdz0)h{yiB<2if1WPw8p7 z8BtAmC@yu*XyB0siP49kdI45_%+8xzcTkyfPHF7WHuj5w@m9?Q-rBMm?BZgzuy3&^!--tlN&=P(3qWS^X;mjdTFe<{!nT6sgum}YI6#cRWRbm(h5(cn zF_KGQ8EyJQrp&H)#Sgq~Xnq$S(ZmM*4kU!)Zfi|Q(O$g1qz4fte49-wWy4ZCqfw#l z_sHJu93IAG8DhD*fU&WSzn?|akP*LOM#x_OT1#AukymqijePl4KGnac$9Db&&FG_k zi=mwa@Y=3ujL<|klMAEwHy6p0hl1qfi|pGgPxF&M4|l{2)BqBE70eUSFNVaVe?oH<{V16>HvWwNH}5kLgB*`lGi9L-5zw>~wOl<04>U?y>KH ziO`YT9~y}pkYc-XXpnbpe(2dB&JYFWdDyBF*7;z; zpV!_`fUo<91b;c+c>c33Mt3oC7CWWbIF1>>_7QOo3&%Hf_(_#9LYLcw8|7pv9>Cud zvlkTb;K!j>G>)SlueF<<>yG8lK?BcX_xS?k)|AJ!KJg%?TI6EwoG9F`Xzs${B3{16 zdG$^~q^yvhsPkBg2CtT}%C`yhJ zZ8Ig(P*sUkfjaF2!f_WGbT znOjxwtDER~n=QImGs!te}L-p-liZl7wZzB?1jW&Ve$qXz7*+;-D#Ro2EUJe7}i z?pD`d;P0jL4IGgHIZ04K?uKFwv5}P01B|G8Y#U}XXgd)-U z(8_yQQKZxb(tTRRIe6!K?eh6;)N+(#g_mq2O)D@k(A!#HmdiV^_68aezh@mLp$9ha zjPhN@PVA1|hh99Gr1&FNk^VP)-`N>5$}=Iw&%56Sct$hKyC3PaW_#FM^Ig1sKO9GK zBw=dbU54qozL;6f8rr^j_w51fj;8u=WR5&S&}LiPTo8(t%RGssFQ^=ca{kzi0cYq!WI^OW1a-^J%8$=MQexCwZTdnfdaD z?*7rD6kO$uiq;|yTuwdBISlF5g`*l7BbK4V;yb*b&6#jQA9_v>oOjh3Fx+hK6ND%Q z1Oy~LUc5Wym&djhUpXfjal5=iDU_?j`HHmVw{){RfX6ij0x?^`HdkysJYObAOIPx7 z5Vi(0mcfe+gr4?$wBKg5LO%HCKnt-KdHJe7P2Iot{pDcs1ceY-1M{dy1B)O(mo9>k zubkVSi%AC$aFZGj9eTOgoql3&$UAn2>F*02fE!|qpS0n5)S}Q)t}m}Zes$$ePQ`nb zb-UvqMq;nrt?z$7<7(z?g7*)#Qn2f}qO%5v>r?8UzHv+9B^iTiV}Mrfv7oC+n0SsWh(V{j!{ z9t`d)br(qeh`3M+s{8Feez8H4T7MRQy82pYXx0mQw^(aiUDg8pt+p#+PV*I(-W(K- z$0D^Yxc&NYrkCcmrRBScmmX})SMY5tqoBZluDyqeT{*GV=)1eSX4cv*1T!;p;3K^8MZ%Gu$#i6c`%#bH z4kI(CV7evi{I5>CMp{M7@~J||4^iP9hY z?Pp4jR{*(E^`25aRQJ6gv}*w^{vzb{SZvPn8mmX>&;){yYHDiwOP}1ZQ5V9-z)69; zDK$1QdS;e%-i`0`LjYy@`C%tWmILcal}?`{8Z|Wu&eT_Faq&z)lSbj4DR=2R-Rmv8 z+gc$L6ZNH?l?V5+FjG@=y!W5K)1)xzOrY6XBs}$&^A=rw*2ZS+HBM>zL$6&+%fm$C zyI{}DMMSPf6S1~7shgDoiXA~=*>1AV>gX)Ptn1F@ca1aKr)-|dK{*xltBDkh36FG^ zahv_lzy+H}RjR9`*qkjLrYS8ur5-p^T6_o4u}W@T(7Dtqc!n=+WqP=EA(qM@BO-KN z`Tp=lo#DFg_@KoSLsJ}(?j?xYED zoR3;64Zq_&(_?ub`>#b{R`>p|#mEs1j5-~z1{)g%NwRB`k`5dv{OFHC!`qn6o1F1m zcy#R4VuL)?84eITSn7Lqb8wFR34)|P66|3Y+%+_M@I@a_a;cqj>Uy_y`Nlsi#HQr2 zK0l?B=LLmM^D&;Y;5C2j-rcjqb(5~z^C6`%PZ~Bg-us>S{=yN$@VZ}={+b)(TC3#q z*leA)!HJkJt}qM~q`6;QV^Yu2J*{-3H~7)b?c0FS*55j>aozO-bD*WWq11C|Z*U-W z+gp=x?$AbG(D44zv}1Wt418f|3dL+U8caXBF0A~nK)s3MHN3+65dl4S;yyU{49NM} zl<9Jt+hKTm*W|ZEiF~Qg^0sqMAl1NWdP$OPQO3M_{9W%y^S^G+{XKD{K@ztp3=Y~l z*m@-=C+qF)?1;rl8^Og#a%aGYL<>t3R;AiIk@t% zV(as`4`^iY4R#Ls@(6nH_B2efK9#%iS<3DUjWtfnhg5El)N@|lxvJKTQ8$!4A{u+! zQ1TQVXHv4O5A5l&gn1F5e?ks&W&e~up`X@K7NktHBz@tY( zWW|I(BF&-PmwkGQv$ehbBOri}MZf8X7s}lN=a2Mn78awkBqh7^auXmN`z9AKcx%1E zyzU%uuznyVC3P$BcK;D&j2P6dpszTlpjw`9Braa3yHTMZhn_hCIzIfljU>V4M5!mH z6a&LUO!SpM%b7jHtl}UA9DV`*r6mKKB9~i8cDBjICF=qVlbF=CxK(Omw%S$5 zUdRSFY3vFUk6gsjkwr0;C*UCP9eEaVDHA8Juux1^7K6T{Gq3HgT4Z3F$nIc>Z{KJy zNi#36sI6;I`%@+?I`X%-4B_g_hx8d#@O?oOM{eXxEUaI)Ov|(n&~8TlOgYR8Nbkke zyIgXAU#ZgTp1{ zBbG8N$4iUFq}qVT`WowDpyoc&*2}`KTpyZ{84JC@j?q$as?}!L$0$7`w@g?m?pudq zq6g|Ts~yA0=PnJ7B#S3y_6{vS_HRDWyYHtS+Nc*E`b8Z|7Z-CjktYD1&;tms6H_K( zh?@^{+@8==JW`O-@!1iqpTJn)`_U6>Rj44td4}~`c#V&@tc-$BC8KNqE%l)e+ZQAM z(qm~u!|zJr4JUTZ@Cw0L?TDJt_QS_7g#=+2#?BfwPVw?Nf>z8x+hnTT9uMmm3;ZhZ zVGo^#^-!($INzSH_g+IYBE6ZvF+2(zuubLG03H4H?SZIUzhDi&$T49u$UFRzH22_^ zi-lhHZdVC#p~gkZZcfbNqNK{nj*|jLi9XF>881$1e);C2w?8HjGgDL4ESw~uf(PcB z@o`w{&dzy5zVTbHt7@Hqv07{;fqD#z?X+WTERd4XV`|KTzQJI)idySpd2Oq-BvvY~ z`)7Ab-@{K4w)UWLg!J#DBbIHfjAU}tM*56dQ}V(K#gKa0%=kH1 zrhSo-)$Vp6(wp5>e)PQKD@Z6R5s)EJeRWlkoVk4QEVkyQ#a#SD>*f<_lt?`N)OMSy)VhuCmrReEs~lYP^AouC&HR z(c2+SOktsm1EVBvkR+xMVjFR|*Fc$3P(TtCB(oh8>`R#I;4<6auaf%)DgEGVUnp25 zm+;i_Y?m)@l%D42?v4VuIkF@#?>hv4v&Fj|f-13%A}F|!S8CBBh2W&t%?1vJI+z)B z@0jl7Kb0>Hn`R@oIchR1fOt|s6j<*sL1EnHCXd+ zlHjUo?5Wnz{f`3oj}v?ZaJ=50ppQ#`eFIuSY4JUh=x1k;%%j zuKr1R$Jegi6&G!jng2@TV!d!aV)RXadn(&dt|YOr8g%iC*9n+k zeuRZPMs7~GXru}m$fV#MYxXlG7^c!(m$Casva<38T$=5qszv9{!{Y+}=(YZVW)kcE z88|X;m+35`uFeG{OkH(6$Z8afc5Veu^O)rL#U=UUG1)RvD<>6XJv*B0OQnotuu%?m zy143lZ94$A|CqsW9U2K z+1b8>V?3^ZoH`8gGCRe4fFB|dQ(T;9Wy2n8#_i7hl|VN2lF5VDh=Lyc#PZq1$BX*9 zRk#}J#Yk;NxdB+|AWev%!ObL_^7l8b^5a{J^`%y4TeWvhcW0u}Mg3xXu9G>IHRn5B zWBZb=Mv`cbZg6aO$=jLV^6{rvaR)1{VpH5socx^7u)85et|oHwwdRft2+AVOaRe+FD>=!8h`Q=&QQ|HN0ibYP`o7vLC@K9o$8_$AQ+Y;mxU@ z>k?U6dJU|7uh*XUQ+E77w?E<3yWGKsKt&}Jf2+DIB$Y(Mlzks!E|cne>SD_A@im;t zJ!sOuxRKMio@xi*9q~<-62yI0cZUIMLF9n^j5Jd%gB3}|O&6jx1BjKw z?9S|#TK3yao#@whJFSFf>TDKr$Uxg5&~`|%#Ee4L;nqda=#=L{SxH#@adCRONbYIk zqB9yc(SU^cvVRl(|I9c8Q(*9{o}$QMsO zzFBaKZ12k47B)6k41W;&tJvb2 zf35fGlnSBI0u3a3!i&-f7{lrY%~ZMYIquEmG8(AyM!?>JX2yE+iW)h`lTIOQ%*Vnq z`_sQ?w8$UDx=Tw)oxQgiV$wB_jOb$?6u^;$S*U@xWQUdDos8aQ`CdIe%QkMi{brVy z9pi-{ur77RGCd8o@mQNv(=87F^$wx5jN<+|1ugsYooUyng_N48M5d;zlj0n)H&>z< zkgU^a|3O+MR@x%)gFE(p)ObrvLz}~kFg^tc6Sywn;OO_O#>?^79pXCrd7dk%ln-6_ zmOPsijosLQJUh;d3A~)u2q~ZMXLrdGR$q&eI^^^Z)awk}YH!0Y8Yow{nr~2cw-=w@ zCMPrJcpe@*!18TA^f`m&sUXOk=Rd}xl&4yPF zKU#n9G(Kz71ye-@i^1%f?$+KO%=;s8I%0P>dlrL{k@2+3OnIV4?K*s<_)x zG;gdDOw1y-ceWMcvZ}MIPqk*o1@tBekJLk(o6m3&HL-RvtVh9fop?+w{j36|XgM2h zQ6~vf6IWMPTf4vGtj5Y^-c2>?3uH`BHHYu7lWA=vI}FthVfP<1H*@XJMy}Pb83pvc zo%VY|9na-dbI7~|oH2PSO}Fu%;+~!HdRgY4vCdlAG;qH4=P9<+GxqWZcEwHa`vS#` zwk#BV?w50GTCP_LrxjZ)i)NN5<*rKE(F=;f#S(LDF2`$e>k^#>5UY4*Q(mmCcI{-CS=6ev^r+)^Xq&y4#j zzT+GA^!1IT%7vYwV{dFH)~*YfU7ftSFq@~p7sFF!+CP5$m{#72{ElUoF_K-`fUPfN zPxis8xQl^9bupEflr*+T*tak-<;$_29jK={+?ITCBUa(;&UU(b8NzXxH!#>L4P*UG4}H6YPQt(zDFv=0^psg z$EUN3+`K$1zz#j%>Iy&%zzKVD^inaA7oC*LX7tqYF~Qa4)wY+Zsd^lR_e{yzTN=UD zm5fu)H5W}lg$7*JM^rcxXJ4*qwxjz=@CpOyq>o$73v>JMl+#Fhm#XOSGxW!=`wx3I zD=1~+9@3e}8tPgP_fNKJd3x%TTgJk}O@14{*_X3*oWD|d&D5Bc%OCqD6_0}d2llqc zjH;%v-EL==1TR>Ua&ui{-J%?5v$K{n3VfusLmq0F_=mZ*RAQMI3(m5@0_gRoDVaIUap!8Vx%!1;QX|i|3mk`VWSiF@8esy7r559t`Di<8* z)zyjb??)B$flG<&hnUd*7O0$jK#i|nzeYh!+UyZxhbtb41rg2tkACZ_;y5)omc?ku zg(v+K|5F$}XqcZY)vKFA_d^j5&VNd{AD`n>d@B+Wr-`}t7s^auoq7En;(i?~p{nw$&(vjP2P}c@*G`O!f2UPf%viz#~WYd!z5|0QD2W>vIp|1e=YKCZ}KP zO(wpTNv4nO`g_)UzT<vaxXopE(7z>DLX{v#>wqzH61zwXRfGL7sWDW8v3b*G5M|0+D}?NQaA^>;^Lm2I}W ztww1dA3C(udU9f05h22l8H~1#)F=NJ|xXct20&W66x$rv~KS9w4=4#oJdEW93Lm6HiWBy}ePp7}_)IE(ieU^iz&D zhkf08<&xAepoR939A)E??tN86Qn;tuC_JZ#60f@(6lfiFV%AK^Wlv3#jO62+cb2NP zh^=L1OufAc#6w~^v10Nc$7pm69dHWP*JG-qFJF6V1j0^KB%5rqGTLPcZj0SKjKk-`JZTZ1-Ng2a3|<`T2{qSCbml8P`Gl$Dn_yw2S!SLx(dT z!nX1Yi2ssmGs-QqI!T5l8(3*bdr&&)}I(1i=< z!R*ZRQmF?wTH&Pc%79Rkhypm|iu~zS9YcoTrgx^$C5s|*({l@SOW(Cpes_yAgIsRV zNQm^ptXqtikmS4N@%O8ouC|8lIRmU!Q+Z0)ktMXBlCO3FFk zQ-X)cMEyY@Abk0-7YOikT_&Pr_M5*X$+~gHnjxK87MR7Y^nBs-GefETnp9s(!I~wh z5n6U4b@yQM?m~%QT_v=8_54+SPTy4DRNSIQX(~eIUy^LQ530fa%Tq;`t&ekJc-g2= z%nY~Cwtta&ld!UxOB&lcG)CAG%YCL&D!x44oDf`n7p+4 z=Nx%z+fXZNWz(s8;LQ@6+u#VsTfDuF!#+D`$hC}uHX@JYQsJN1@zjnXQIhu&vMWY5|MLTg{u(;mx$-G+ZL2t;jjvuocFF{n3iR^VFpGBr*JMqp5x&K7SRu@F%`E)L2Vdp|g6XJ9-e734m^7dQ z-4YB-c3ME;X=D4pdM2qA6>n`Fzk5TW0+yDR*5tsF$!M@h!?6lDA7=~u7J)jNny=|$cSjU}EbhV&G3D~$v*7*WX#MqIvM>FJZI%4K z_`1Jvp8wsR5L2C=`O=u_&0F?maLR43kT+}kj*YNB;Lg{5@zNsLbxVZ5-j!%Uo13zg zk8^pqk;zD+B3eV&yQYNY-^#lGkAIdEWM<(j@Sk14F1Y2-4%lM5DEOo>AIc{OZ#wO^ zUCf@Zm!` z6xyx))TA3|-PWl{8Bw+?S8O1GP zv$h)zbKcyz6&yaEmv?vNOWN51?s7)cHiFdl^joqu`|Gz2{6*{VnwpyTDuT7v`|mbq zp|-5&?yMo%h`)LU{$F2}d+`xhR=FMz?%#e~Z~%eQGoj=_*woc8(uj_|87O75=e6!Y zDi@}rq9V8R)+3;@{(d#U<16KxezvVB^agDqJ>->KmfKF};aI63*VA7p0CqpRlabjVG+04oW1W+5(rKRNT*zo4v412a}mmi0W51z}YG+`O9`c!D3U(u64a zOP%?VH69OL1Bo0jBhKmp9#eA+VPAW)iDEtC`#d(cZq))_$z z$iBA@UhL#>anWKKx?wsM6jbd^G9YN($`!%%%6>&kK~aEK`+npTFI#d#f?sZm4jNtz z_hT<<6U(lXe4z0ornevgwKO#?JR1SL@i7OI-YYO<)MrZ+6MD=;loNt}g-9kB7;An0 zJ(Q%-mc+yU-e!*}D=P~j3Qd$PT|c9Z@&)m(UsqMhGwB|oSdO>KWvej)_Je39?)vW+ z|5#aB0S@Juo**S4R1pPxV_4#w7DkSIO5Vb-h@Bk?fboVWx|R<^mG@k^+ELz(Y?VQ? zo;LKc5CgXkQ@zNq-TmoW)Q>YaeNV+(eqlDeKYcAv#p}y`=mC*?$}a!m>B=f$cy#mw z8yg$d&#H#!3up!MJL#mtvMe#%7~vpFn+ft(I^GBa~(xL+X zcwPCUL14b?Gx9O>2DeMBoxc<^7I@v85N=FdvI(5m%9sa-hm!8PXo6a`_;5yMAl8ld zDYLiXrM}jc3pY0~FK+e6{6oUdyYHe!3#A-KmUj+L`)65#RQ*z66qD@fy_|v$->(gB(MP&bx)6VZp&n^Z6f+Z_st)64GGJ z|G&htaJv5x%T}9oxYR8W2SlJfWtCCuppHFw7lp0GNe_Zik*re0l6lb6ggzy z`}KUcz@QjTwjnSu$1lz?^OtDBfT+vwc)-+upxpgZe&DF&p%>jBD$<^hL2+o2Xwl~G zS&_7};cc~zrG=&K*OWz4($ZymN{;lba6d*&&!aI-CLL}f#n8~nV#L-~niT%z*x1=) z6gj$0;2aE8O7P3uAN9Oqfc|4nI01L~{{1uhv7{x^m=6p4XPM>nmwD2dK(n->{kId) zzRC*w69HB0D+#|&$cQA^L%&`b6;H{js;26!UR~Cw^Dk|h_vUZ~o%XXjiJSv_lmPVL zbV}yk^c-a-zrZf}K{L2%TLzg(E0>)SH3-?On5{@m;!3xyiZz;^jpitfh)6%~+P>Y`IGxr51hCsgh7{)~o0TkEC>5DndbbBy zNkX2esjlnj0@n!~Pi4ZDAM_JEO6E7uuy&2WFMw(4{ir5n=*lRpl*9Z^=M28-Fz=vL zXc6m=%{v~;KOP)yC-3Z}yV&U;ZkKyd1_JT6+^k>^Z|#oft;X!zTB!Owv8Bn}n{#_b2FZBcYZ4qF0^FDeC zW!B8kjXiM%?E#O8!=8fYk8mF=!y&$P@rS&N*$dIJDd|4Pii)Az5Sd-*3)(cM$zkAQ zb7+}r+#k&){N$D|o_#ALpUkU?*+e&}Ib9D?DJdq8CkXzq>60m&_z+GPW@6k0 zU~{hLRNi0gN$kfjqm017`#y!Jmqce4Llsh0`t4uC;}A+EpQaV9cGZepb_{P9Lv;}O zjO52aknx>D4^Pb5`}>0z$-MP5*6^cB(A?PIJXDET?@OXjkmiCSigQn~jk0YFme0wb zqM`!WbD{)Zsf?M$iX21dgWpIQiRVg{-f z7DA-cwZYFlH)j`HDhn#YBa^J%#Kbuqtaf*=Fj#QdMfd#dl%icT=V)|wbxIo42}Y*E zJ*p>w8tJGtW8Jn2>M7YcmEU&eIjm{MG*V1ESw@3CqCwTFLHztp<|mVmwUGG!4w&KW z|E;F+=4~x4rAcjpU0vaJRUAn@Rc5eIgTgZ^kuQ%SSjT~~+SU4eQ8Hm|F^X$nH#i>i zoz92!Fqt0lnZG+cJ{}F>jeG&WVVMoL;^F}MdHq+ryjGF)#~#f6R}-^QT@>~Z+G6J7 z;z^iwE-ddaF->0*-WO<0OwOF?XacUA|EBpMA8>;09@4%3SaKxsqwW`_hF6?Em;yMa zKriXx>|sTxr!m6y3i}ly50|yIT+a)oI7qLFj-W|m{f&q{h#)J|aP7@Pqm5kTW@H#S zW2rF_(xZuY>)Xcmb_UuBTYKWeaOP6=P!P)3B z?F}(_w(`z`JxcPnGt+R~PCHu&V4=d+1UFxbT4hfiO&PvQ5u-|`9Wd@{`18kr|9DI* zd6*4cpA#Dv@ald^^k4l-)QVd++1}(MuOvHpWWa7OuFa@_Fig$PPTC*KJc3z+ zTpjFb&`5hr`u+R+3*%Wuf$Y(%(?k%S!lfdkq;5f(b^TtE<|rs#3oQ3r3Plc2E`Lip z?ShrEL`uX1|I3#Qd;+pSJfXQirmo5_<3NK@t3kMfz5Te#Ue8f|)-xuJcePH8ucM> zcl^rK*Bh^8k{TF1k|F@bV32z{;b4491`+{OSg}A$jdg>lt-D+9++esNzLYY=4p7Pj z7{^C?@iFnb5cwhJl-$99VYdLU)6CeLsXCWLYrJrjq}0;Vl36(~7Dl!QyWg7GNVr&7 zv}{)Id*7^p+pll$iTTDEnoDRQM~?KWtfl3XBQ-7KvBDGoIF9O!$_Fqd3uX(5{HSDOwl!R)o3DA5Df2%%S-r62y6k_` z$v8iJK)gxLzNMk1mEIg5dlTh=lnJ-H4xIE}c1Lz%gBp5abiW(~Xc_Iu zfVg(hJ9bU-%HST|I@^?#4UHoOSVVMWj#N3&2S6C)1#2-gHf8A(ykcfzoPfs>htMkq zj*6Hj#45sQPAQ11nOtbIcBN;$nT|6ckeYKhxs<->xefPR6XTUX=|)%lz*IKsJ@r|8 zRNrfi=Zfi?ykDW;s{%0e@_5!wFX#&w$>q4yXTxaq2d?$1%qWtQlD@0zYQq+2CcU#j z)38qN%!!Ck^&7%fjkN=q^++r%>{Ew{$h*;8g^|g;9kCJtdy?#OMadAkS6UPj^w+6C zRQp2iDNi&)X()NXnqgC0lC0lsWopXIof(KUgJTHuV8)7={=MN9t)fR1Ffo}(^lP-Z zsj-$ZwaXFPy?ft3ON?qcIyDAk7NDoQm;n^IR1;Bg@!E;3y@Y^O!V^_}yZ=R0etd5D zFb=3Pf~KzUe)4Awg6~zdk>canCUEli6_nh@9pCcvAb5anZbGIAD zzuoy41!;13KKb+sb%r4=bTGU1Tb<2@I0uA-bd&%#2*npzZo)=l5g*>@IA@iMbB#`n z`?0JF;D@-QB9ZZ&pvdwuA!7IIKVotYPgPP--3pgVoeh@x>*^pc<<1%U-5O?@&Y5ZO z07~}c*#w(Pq)ScKh-A*5U}C)Q+x7J;p68Mx2lwvbfArZ`WYyo>c$a&~@677QaTG zeE&=_Pm}4fIh@#T@$3Fqw>JB?$n|4r&-(tq$~(U0Be8(Ql^%v#ODe?;!c+f6%J~QX zQ_gRFzRT1$Vi_s!dG_aDbvlQ`-#j4>DkchEFhBOWhsjFi3a0O0|KxrdWh@)sua)97 zD3p9qLE#ZDE=SY$C%tj6qiwKJkl7mc!S~G%a+#qzwWv+jSJ1hrbv0#W3eKGr!lx5p#;C!^0yqjgXkeE0NsG5Rk%OflIs;9 z)p%L?1Ls&RjjsPDnwHhp2800VF86|mgA+~_K)6a`T%UT1W1_Wity`J~m>el zOTV7;QkehEFg3!rw?(B~`R3;5Pl&jvgXaH}NlHqxJ@|tUOeU?IB-lR+dnC3yUI=Xd zZ-J&$_}|PCI2BHZ*w|QK?Fbru^yEN&7SR@~US#MkIC1Af}X;eqXBGtmF<%u$&AsHPSY9DE%Aj_O4KF6C~NqNyo^ z@z<}b3_`c8r`kdfF)`tb1o)@9&DW{ZBSs7-w`&8__6J8t;_6Q4p!2l$!|w1@{k%P; z4+kd)UOqn1Lj+PLGpM)8G&wXB*BN|t86i$H(wwR!!oUZfg9#}mqt9M*v@zV#-@F#+ z)yN<%uPyI99|MVs(+mT>qiej5_O1zx1wB2m=8qx<#S{_Wf`H96y)kduH+XoevfoIO z)TXs(o)Zky(QwkwTzuWa!u|y^sL%Qzw#YH$-)s?pDYWwKH-^>Qe{D5p!^yJ(?h7o| zt`^5(5v`trsWeqvv)K^4O;qe^Y<$lj2t8a5h`6NZ5433T)4{i^B8N$kWf zTFoH{t72-$ytvNaw-49<7J*1J-CdkkkK@> z7UlO?cz6{G<5fyFHQ>-uI8-6J=aH)^bM8`7=3)ciV_@!2Bfy4j0K zBFZ9xzkW@K#3jw~19#0hf1pY}H%m!T8nCxV;s9S32lk0`p<^6qeLXtBv%Lqb3FT9` zQIXq7S}yy3*N-O`(zGdZBj@BUIJEKo_v**N@o~PH$~rNmeqS-=anz@whQ*%Kzd=sx z4n1AU#l$w?$Npc^2e3f?;Jl)XlLevmK*G2XimL>^F-J#0=tH>eO?1I`;oJ%=69=aP!Km1?=KPk~tsGO;0DD zc+deQ{i*}akT+TY2<_(>YE~xre~TU=97oMnC&v)`O-xGbzeSHv<7mEP*fpMz1}9hL z)bMq{)eB9Z1DPQ(oR0~ctgk*Wi%lBUxEgNuph?&DpfF|F=bVI7V{F2=$qTFHHFNm6CX=(0!*vq`*xyJp>?y;t^a=A^9dh3#j ziDlO9x$K-An%CSPog!o0!al(()Hhp`Oo51Opq3*c{e5yu_;M>Or)xv-8epWxX8Cf5 zx}DXe8UV#BVzmwAlc-~~VWBpZ`2?#>zCT3(6W@~q70Gy)H8OaVbU!}jRrzpCS10N4 zjBh`GQCIa^Mr6+SrLoES7RN@uRcD7JVyTp@wklsC@Rx*yNj3yy<)4mD`+W^}6$P48 z{qi8z#5u@BR&!4OHim8I$ECfEmSbZw%0Zg;@>;;(I8p1Il-h4&BW16>y=|D^nSU3? z4SblgrM+ED-NUz-QCx0af#AC!;z5R*e~(S}7b;H6nSxq|D{XbjQ&|ZsSQa-lbVmj2 zq+1Q${I0bfNX(c>#g_RMm&-7eq5vbdu&{8_Q$4-j(Bo$Sj!%^BDnUG7_-OuWY zu{mst7%79Ly?38cWs2t_{q2f}wh3yN`VR!CUUPKr@Aidh()OW#ulMk2t3FZwd)j+-i?8q}~ z5Bp5@|LkJ3eVNSayWDVyiH@bF<$knyafRU3V62So{r^Hh-{P)XraO%Ji($yQN~P`L zfvh>3dI2~$W4}!!lJWQN-ymClu-h{|XQVmwrc+%A8xs@rcJ`7{0oFu)4WL^XWaQ+h zn`q{w?>Du@#C#MHT+N3VFIeJ#!7BQ}nrDW={}=v)sWf=W;zB>G zpeWNm4uJ?x{>T@(&+8NtYmGKb++UaGjUnXHuK|HeN?Ez!u%AMv zSD?T0tKvS_{h2~!j}`Xx71ZtP;O~;RcWp-$S$n4tZ#nRRQX(&LOw9NdAE1cLsMfc& z*5qcA&g;n7M;-1V?eptLoTa$zn-%dDIbKXpO>KXQK3c3E*Z|RNfa`36_+tf_DTO8ifyk`2(5v~>O^>R0>~R|S)#y&N zDbC(3!3pMUl1vo4sqJC2P)pZq-`kBFqh5gxf5~UFXSu4~GCnRbnQ#1p+nlMg@dd4? z-@r4|`h9>6S}>{i=MRzkad`>OEPz0UIq9S=z6#!L0J;K=p&&z>o1R~AR=7oLYq=@y z4ZBkD_$7U21YI7>uDYE7!TtI1lqjrjWlm|0RKwJeT zU)B+DQ2q%B4WcQYZ=l@kEfb!N#4beG4kk1#EEuVlv-!CWTFoBpKUrh8_8mH<)y#m< zjGw{BnvihTQ8KG(NaiAlQm>j!E{+KX)ii-@*;eoE31Eg7u_;JSGwX0Goj1nFMx1!K zU*qk=pTxp*jj!l}O0;uSCh$!P?5MfXIq-3OFOdu(C~PJPCx6~BGq<<;NPSdwkXg*l z!tXkw;PANNPT~i>Fdc)+<`71Kt`OwLLH9GLZdO1y-fGW9$7rn0>t?V}MK zd2~GRj8^q5nhV~=Ki2F5fW7|r2m9WC(>kfBZ)xOBPPWR87{+Y)mbcdO`UVdnNa$UQ z;n?^%LT{h#i~Z_`6>kr{h^UahzHaUQ&NhtZ0(efiY zDk_CiKl>`bU}ODq_#YKQJU>`A=D(>BDtL&Rz(zOnmnY}v$Qwd~G zivl`?z-eg}kF>k+S2SR1U_A3T-7Vno+qK-@4X)*Kop2!I^H9c=F{#RzhwEs&KBuA* z;VsQkOvpM``cXaWv@=0tK&cB=7E=2BqfqVz>sYd)%{V9Z=)FqM8>tLCsj};R1Lu9o zSXtB?sNo{xRaKU!k*iOUNH_XI?teHPRK;EzDk~`%u5kj<_;@vRQ~O9YXN_~8kC}!r z0GE7p(-4;R*!H{QNOR1vNi6L@g2Qo-W<9+z*!H;ko#ySHM%&|CdG}tT<0g}}vZyHb z&;kp&oU&MiFbrY||C00xA?@Bz78rXTYaWrXWn5K3mYT}jT!C}U6VVvkQn{v*39&Yo z-6U@~+cKz^XGON4VV~6B&!ggiy^%>^wZhgXym|*y{~r6cD7mdUYW@CJ7*2- z8EN{*b+5=KeEL$s7IISjZ}!JX`9U>MJ{AzXFe{Q32kP#>#fF2a%)%2KP+gCJrXI{} zb#13;QBF*)0|iO-Dx;yWx{`3z(MnYDwt8AI&r=XLG|&0W9-K9Jo24?}j>dV1K5iwD z8MM{arla%eW~{%906*lRQ-u!WaBHM_s(P``S2sI>$3ql+js(AmSb>zua$J-?jy|qR zkMV_OvBO`&?pQ)duT?k`bln#x)UT8SU-nNIW=kJtOb< zmFm)Uk;R(uh4v?8OPQD8j7!T-Awlt&3 zSmv@ge?dEWB7dvMHF?rTv~20*8RBccx8v2{y?@{Mc)v%{<8p%zbmAp{00feir6p_> zQ*OzU`#F)msKLiqWWo6T4mSUR<2aD-`IoiU%~$n|xv8`0i#T6EAM4$Z2LdCfxhv>s zCgdm-NB2ePo;ob^R&Ra)DA-?a@|Ja*J`LA(8h3WOtD_9NbVTPqnhp{N{B{HpwwRuN z58*Fw$a&VtN&$j6Wn)hd!?P3k97-54Jn!%K)@MnrMz4P)g?RY7MPsJ6%X$Y@l_Q8m z&M1|vkc=H?Kvl`+Ki~xPf6C}Grgu|-@Ez$={eoO~z6&p$d%766F? zeu1Yt-)0x2+Cj!Wx4;??;nCn0i#ZG7v<$-lIV_O_hz{A_IzS69B@iNArU95c7^ z%*F!L_3_g#f{`AgrPU#eSV{7FYcx046dK0=&Y)17<9JGnNi~#<*TN1GSlh;p0nQ<( zD-^fR%6Sq1K=NFW*asDxm8U_Hk>0U#)7HYkd>-oTlb}Ges4 zfSANuTwpqLWd6hdVePD=qFmdy4~QTtAQ)`AK|)ZZ8%0_g>5xWJn2|06P)ZskrMp80 zh9Q&|WGG=s>F%!Y8q^)nyPx-u@B8MDz1P}{y~KO&nfp4A^EiITH$PrFGEyBup?h9O zZjn5Eq{-h3Jght@#a`HG1W+cmw z!gWq9s{x)8q3PJ^@0Je76p2C3zpos(`Y+X|XVb@MiW0wXW|ryr?n*)l_lwqhZ6!Su z!o-~mroXiezmDRIKJg#odxnOr*d-A5;I{0(R65Yt_Zko=Osw|XM9s#d7plVw3+?&_ z`Q{Pkz?n-=)MKPIjykL%)EQ@cYiXlJ^#|~!H0)OeF)VY`n6d|ZIkGz{aJzK-JtA8R z2qi1WojN(nGNk=W4*^g zr*{?|kc|LHaq``eM0aH^2p+J4EV@7O*KtNw>I2t^l#Uw{nECqm*gD)Z%C^2{)kI2N zkAN}1JJ&qi=JzDIH}`W(o0YgCdZ00v9ZcGQ@o4{nI(sdpTf23d##0lK*_EMZ>^(-n z8NT6vQ66nYdJ6~+quw+IgEMe=?RF`)wo-!dt4kUg>oqZvMQ|s&Y0k zt4rA^ly7|fcJtP)rA-gng&D72Gf(y^x|ORyDZcAY_2tbG3z$XQX8mxqg09lqMB_x;>0QGITez5AK`kHm2%9d;1h+-uTh!aBBCm^ zAFf<%9xhzXu(e%*ZMA`o=KF$GS=t7P!z5$ZqR69x^A)&TtCQgw-<&X6zjq$D%UO&& z)p#P;!|{jGX(6i|*tQ4nDKYFKst)%y*O(u-%nKh$?)jqwQ?2Cx8JJSuaU#_B=LCT% zp@)S>E@gJd?`dqxbJNy_;e>cCN(-gsXg^4JFXWoyFa?uhg3spWA{pqWVPn%cf^kY^$dN*-2-1YcE!7kY^Qh(626NcIN;o?P#* zxKwZ@w$+W{(}mTs6?G^cuvj~2(h4|*+qAdFy-I7P&P zhH69l`b1HP1P*5GmMqq4>8h)SKg=-$i}qu~zVb{_`XjP3;eJtG+o8hlta6h!i&^Uj zl~Ix5@3!KG98?E~z8pXBq-?tl|o$TuyKhiY(wCuYTUVaJ-BVuhT48|!j(8Ov-YZhPnJCQI05rS`Vfd9GJ9u=pal-@`ml?>0Nqk)H;>6Ug+<(Bf>E}EJ=rb}H~ zlQ4HYi}3TEVpcTyshUVx%DlJZKR}G15*Z|k1S<~g$P!IY|d-m?oW8=D=;4F_98uzL>$ot2V#Z(afC^3+FL zMi!;LD;J8q7q$d1vFz-DfUnFC?1~kd!+nD!CgsVDZ$a=K(XA1+ zKd5;MyLrOG;xfnwZ;2IS+2g}87ku3&56MqS$f4957 zdJ*A8Rb&ikml9Zrk$<^@L&jGTqD@dmD|SKa^7f|94S|&QTvmPButtPr1!ALuGp(eg zq}$2Rv};MkozQrPo^9gCGRTN)#^++oboZiX>f~*unZ&}oa-0fy15chjS@J0~9jQ7) z6g{16banfXP9Am@{dU~7o`vWWZSU?PiQE@R+2Ix$bDTsy1u_(@8syXje2 zH1;M8D~w4`ckS!m=s-gwaq!RWsFbSeM-S8$y0J#1Q!{ZoN4MTmJr>cC(P8`={sQJn zh=ZLYhu3mO9L&gd6wPfagUb?kuq4%KW*mpt`O~$LpTuJUB2c+@V;L7day`&oTvQD~ z>!$ZTWaD39pP6#6znc+JYn7i0d_Pf^*p`mE*je@#&*=jYPwXYl1tP{}O@fn?lZTTE z6a&j|w*E%~D%#9*X$1;>v6Cr}WG#!`$sAS8P$3h%alqEXX-mOHr!6Jjap}pzah>iR zc?b92SrrtRvyiS(B4_EySkK1`{WW_O;#tFpX?q!& zyHxscVrHepp3vciwGY<_o}F=h5|@&YzpGVg5yzC%u>i?#ionF&n(b6NGEE{yXHA*>W;v99r??MTQ7%k`c4q zEWkB3Ve`}uJ%y)U9_QLo_Et;~4i4q>O3jK0ryW2#@qqM`!5Nr|DQTiFhbipYJZAl4 z4USM0yZ;Fc;Dm5RImP}cHdm(gEWmz(1_T_^^Et$IASx;z@in)4+HFOzxV?VpqILVl z@^GG5#MlZl*2uGnA+=;Cs`ZcWvP-n1mFXW?_ieqXV?K}tD@hd^M@h-%rN{Zr7BMUE zi~;j1qpxtB>K@>RQLdwE_EM;VS=4YlAgx?xWqE;YqQ{nLR8LvUuv#sRat34c>yScU z%djOg5{*C-3r4{Kbtc_;CYz~?%4wfO&e9})nK{}H+G?)iGgpiWdiPkqyKeKp z3!5n|l@5w}iETL7mG~wl1!FX+_<1jHYh*u?#dEF;{vBpZ0t$)TQ1{a9jH=<;*_TYs z%}mznl7!z|arwua2-1BkkrRfvgsU4Yx_4T`> zCH2Rbs5-cV$w>;Oji~uuu;ays3hO$WXF6v1ggMU#89w6>5}CMzC(nCp?)3&eHc<=A z?S?EFd_?OEFK<|S08{SYbq0vi<|G{$0^9Dx5)u-3+~aoH>4f{VUIj?eolt!LN}ZBh z(7*rM&v<;ZrI_xnWawowS=08pSDJDg>mT(&=Iw?ZlY5`{tOj~K|9}n%%^9_ocmD!9 zLDB(ni{TchK|pG%u_s~lg0H<4nfep4+SI)v#2$Tz$NkV5_Keu$ zbExv88dsX5jc$i+;hsxS0Hz|gj97SO_IlAFJgnJQ!q;ul5LPw4VF2`m9(sqho3an> zx*h?b*RBGb4-0vI;Z1tczf~j@c;|o~NHkhB9jCvyXs#$p9~zNJX+YMpFzO$Ht&_Dp z@_Oo~COAy&*%%E~rAr_iC)U>8XzAWH7^WUY=H+z&e$yN5U7$9QP79ALiRYz1-JHgQ zcbie+{R&Q5{bh7uG7NY}`CRQ*=!?0c0ppF+mHpYcDYp+RyM=Y#*tHR+hNVj9f5w9* z=~LZ!Ci``2mbq7?eiSiSm71sS53__$uac0{2=w@7O)X0LDp&8s@)p zDTA#RfO30S{h%r>CkGF(Z<Ko`|1%t7(Z@-b3Q`&(+3+;A@!si%C2;Z!ct_@+)}nZIk%|GIm&x7zq%JM( zLQ)ddA+T0?5D&lGTK_EMIwV4UEzI27G zDJeASu>bU>q@zTz)IC2pHNpADfh#7sKyOW|CC1_ShH&2+`;u@Ka(LKJ59)Ptaje02y=m6w5`rd%z+o zIH04imbOG&+NI3R&E06wk6K<{hPZls!!*hfmcfJ@*tT|elRRC7OO_}liUv-cZ~2$; zF=BGCJfTqh=HM&R>eKupWPCpvF;bcgn^yp4gDP_{>he=Py>f!%+38tY9gS!OCil-@ zq|y{Mcr!K`qDn!X0p&>W+mOYt3JcW>0Ja}@KXc)gwVjm;3cm%AWp;MAHaY0n+0`{A zGZhnGw_RtRzx>t|i>OB&f0l|tVjMj-G#m@aC@S{ubsWD;l^A^m_U>e(4-)j(O`wr2 zLN@Z(o(yBWSQ*Q@5DG*P0JM1&&MGY*|Eio`LEUWrmjE&QF9O8vzX=fLAB6Oqsb%X= zPyC-RLQ==N>O66w!wlD~EbNg-Q4rad$5ycd4im+8;$eb55c8t{gta)Zp2J$mtwr}8 zUMc3anfkxIZoK1_pCM^&TA0{FuJejE6Z8x+vbOqg})luLmjt)JLz2 zF=G)X?USo1qyKPNJbkKW#1Mr-K|LQLi9uu>enhZ6n@16tzO_B%1XGcbYC7C^S(rKs zZ0|jv=Y_NL^O2~rN>9EYp-l4_UM^aHgye0@(unb`rRHu$(y}dKfgbmCp>=tkUgZ62 z*YDSjn?y_96)?A=X9Zr>?yng?RF_98NI=g$fV(unpz&_KPt=@lYV`9gx@~=?f}VV; zu6_!KnRm|VhxDd*jn;Yk<0dp)YJ^4*R0CE&e@-R6uamZPAwtP{c_E@%_hQMptbh6f zq^$aq^G!ZJ&CR!l7xo1+_^}jCS{?ySdwk%=H{0Cz037xT%v_5zy}4LC?z30<1qBz) z?o(^Th5HnKFSg1%)Q>+^c)^a_JKCRtxL&%Pae2q0n`z-yR8p*+T_KFilbONyF?s#3CSUoWj}==UoEuFXYn18~gm z?$J~u+B_exIy;U>gmBg35{()z_j#XnV7&yICNXDlpkLc;lJFb9fK@scYO$^DDVKwp z?s=6D$dB#~$JMc-wyd{0eaxrY*Sp~HWfQl=sDT0=tSNf*k^s9S zKtFC7%otME$vC0>#^ ziN{D$E7b&pXhDDMKF0Oxvx%pGd;=aX>0h`E6Dbncm+vc0l=QQy=;@_;bGA7DHI=7Y znB8AmT>K2Y7XB@R`2%IO)iD00u0jC;lF1*7sap~ujCW};TuHWivO_*1OrmLaEDYTY zvgFA=Pk&+*PyX$Fu%>!mdKz5hNg5m+>?Sz|@+VMJ&w=~}SgC|0w_g65grj%FQNqaDbRDx=&<2$x zC=Jxk=k#aURIv=~iU=#Wqc zJ|LW7H8f=?!d5l(T5ttSo88&?&Q0^UqUvhb@9;Sc!5WxbFH6hd#}J7Zckq?LG9WZEek)U^Dp$x?l7dV9txRnJs0`3jhUFG>K(qd*QsW`^Sonz zak{Tu)GER%pYgWGs@`P~6xwqi`(lK&^pbk+FPC=UWN1j8DB8i@ZfSykHm0Iz%Px$v z-(pRlXQ4DUyOn6A#++7K3LKUDSKTgKlAf@s5sMUC`f_~hI3z4`lM(Zmy4-=@o;O7o z4fHn{cp{$nJ~2(`M)ugn9hRq;Uj=rZH^R7TZqahzGzX#@&rsejN)`bMB#galt;%K# zaBVd;)ZBppX`HrT03BSt%H~A9sOBf$TVm`BmVWD+YSjHWGMVU%2TV@SI=0LR0G}f@ zRbC5bs)7h}rAyVlH~wmx3JN%TAn8+BgZt>wBjcrkM7Kp(L&NH`$5PKXGQe{YxF>q% z=Zs5RLXgIhykNa|Z4?oGh&!2gF9JdjjyxQIUuV$C+1GoygFYQ#vW3ZJzL#8ItV(o% zII5fda2fqp^2_p|IQyHE?V$WJ3~;gqCs-Qlvs*8f=bc1@2${5W8}Ig3>E(CZCRwIB zCQdcJ3K#U0wbCyDNOp;^n*1<@sd`p=&X-Fv@($`)?T*5m)yvXI#s;N04(*tgtxaf+ zKLSxiASkEn-|1Ir)SyS1pkL*6{qhy}OfG;Y$;jute^Opiv8eJj{M2>Jd}@8t1dfUq zu@(%W6wA3#&hy8Or+lNH9{)^MTZ1`&1=5 zZ85Znk;Jmv^d>aagi6KQvok!4I9n9Dm~Thz z2!V(@D5ns}4T9K%-#sf-*h*|KQ|Qj(;%ehU?_BZm#|&7S&x~t~;u+V)^78xm+`-}A zBplO=Qk7eadIst{Re-r8GJKp4d(mkXxn)Gqhu)hLjRrw$#c{sLxsG$)V!gksRmk?r zJTzAjNvh!$v$^Q-nLVS+MBrjM5F6yHwoRiNJ)P7da$jF0%OfW0`O2N+K0CRO{clj} zSa5zr6HU_Esu$%t$7^mTE+WiQkD?Tg5~_DyKf}uIU+=MW1k?B?1$*4CYk#|0GxK1C z(HJnwlmJfjjhi=@LdLi<*1w{I(s|SdJx9yqM`31lanjWx3~ek{m#$s~$IJ7NT*(hW z8^OuVU%s56uLrpn3;uH|?R(clG-4#VhevPK^dULXsAoZ9Vl2%1y5rIknABFq?$>(0 z|8z)tVq-%`CbDW;U0zZmtCYd+TR+KAwu+7OliGYf{X_Uha$Fk3!N%c0SrB}}8M>EY znrQfk2*t|sx?$O^mrprihHa7Eh`6%Y21B~Vrv84j@4vaq=wFczw)B^WK*$E_aQiqh zA(%1sNIszK%B=%@@Av-bCj|O+*z(g3KsjqaX~P}BX<#9ih8PVL=Zc)~gUcr7inpknSq>OJN;ekH+ItotuBM$LTn`t8om-TUB|%ZxLq)1ta& z^Vi%v`uXRD)UUMLaOD49`iGQB1RPc=<}yJma{1iOg1+3Vbx*BbZJyalSy*J1V4u{1 zn?Q`dRYy(j`Y=i;DB~mf{4T?taHb9jG12H9a0&|>;@9N!VDhLfk>svyZ5`KgRsxf` z<@_%!1BX&fls?tKCPY^k70Z&WTLlbzD+Zrpj;IQz1tXWv&jC`1Q)5ikCox<#8IvI~ zI;H=**8ji2GyHHkzIWrsE%fM$jkDkM<;x6gB`zvDdU6ioa^=pQf`H)QI=k_ZkdWUv z(3OkXE3Ph|md168*a$_&%3aAh3|U$>0N>#jS?bG89;U0vP_jl5d5Wo8L-ubHo=`ZxBVKC~G!@4usq*U9PSqJEe(< z1)}r6F$x-3=|ASz=1>;y(QhE+%g! z(JLi*MV)c&#g$!2h&Sw%3Nm#R#UB%yYyXM(80z5g$F@iSrcr9iS5xai8fFWdJ1pFy zv}7k^0dWB&bo{VH%Y2X_SAXfYv4JNeC+AyL#mCB)TkO7u>Eh}-A2J1E1(VCmuhB?_ z#Ae1zfA*fAvqM0zKAW`GT|S%!+B?nb3H?N~h!J zzf@pbAhP!Apb`Sz%PQwf$Pf zx9{K5i<0Zby}5aK_lBGwJ<1px6M%{~=Lrsf3A`9UK~jjz+R9^I_oSdoTUohp?zl}r zw6IQIPVrIFaP#X=e|*;wE=do}PU=m07@_43*&P^Msj%7E;4QLt} zwDG1Jv919a?fNP15)m{%>xyGck&}EIM?n9+t+^`d7cG)kms%A&^eCFY) z5KJ+K+p~1aUzDJm2Ofj5Yd|D0k2%@8&vGnX7zBl$N-Gxkq$htMCqMr|Ijgrky_}`YT@a9HJU(!`YunDikd+Sn8Pd+J9%z`LpX9B@-=pQYb+2S< z#~yjVYp*R36yUMz-6aG;j=`2ydI|3edlCy~^=w443d+vznIBwm4`ec2O#3fm=N+m% z-(dXwC1~(~!xrRqNCo*h6HmGm<^KmeA=g0TFLnao2iXq*uTf%js<#h3>kjd%d}YGk z#4<4xdDHT`)&RUk&nqX_0kOaavEU;-JOb4@)0b56Wx(L!Xg6f&vGoF+5B-m?8s!AZ_-eSRJ$a(B@GdZ@GAetQ zuWr|jay_as_q|-&_VP(r6~fm-!&ih+K;PS|CcTmIW)z52C`UEVg+)d_^KcT$xhlH3 z?${YGq-!>9Jh~JeFt0cScSqQbeE-E^&3Z8*5)hCtyEW?fCC|uSXqt|+M`R|Ya8ij{ zufV;4m`L_SS4y*8i!+4U^yav z9%LZ?6=Vo*-*y0Kdb}q(=)=*kGy|KjWBiyIIbLH``R=M_XaLVH=d`u`IUF?0(acd=W1?8+3Fr}3xr;A1vZ_X+eUb&g8cjh{B^E1 zI3ifzmxo(*oFgM6e@wTPwRUzkmzv2##9dBW;&;jgRAWI^w#u8SM8U>8B62fTbK$DR z;*{yGf=pYxf*NL)9Ro@`>ba_T;d8~Y(tUApgHaP(Al|Ue&5vAy0B?t-Mig_-jW~Cd zP9dAxtPEKO?p!$I6(~bOfMs##-py)%8N%&v-zJt;H34X)84v-sok76y8r3bqdG~A5 z7}rOsJt!$vMhE=VG-jHaCDXb!O_(P8H%ed|$pOtt;C%LXY(glI#(#hT-c3C>ErOna zDriuRd`-+jODU8o%_-|~;>+Opss*1s?D}beY*ln-L3L&UJ;1lOwtf0!2@ihgA4-Qv zk=aX$S#bY4ERbIvGD%3^by?GM@sqs@d@K~Q9(o=3h4h-Z<|F7T#s*e^|Rb6?Y z?F@Uz1jp3i@~=Sju%_yY!s z1<8r-!H8+8Kl~NE%Xz41I_JIhgG^jL!z*0KUEt4vK%JL7?yb24^0kAbW3vj>w(Z7% zBc+T^%pLup`_CvzqpS%eb?w!Xsw?eIX2-Ue4-keKX{o7l`eJWf92PFXcX;qdD$6T( zR;810?+hC2x(kIzsO{X|qKoq9YIFvRJie z9j-A;DV3FqiG%M&T^T~3M4U;PI=q?wQjnB~?z)lOi;j#dFu_#yI_~gaQh9Hfp5;ZL zF{1=6*3?ftlV)k&a&09?^rt=$tamYZC$`*#UMI-v z(p#wuafbpMJr;NSdr@F%*Bt(5Isq342W-a(T?=i_^9eoi=lO(?vbSw+ruo=D{$*3k zmNaKyTLU1ZC-*-d2~_WUj(<%eG}qbf9R6r?sf|hQ-NNj-v^m;# zf8&)^*@UIFg~tO)lm36fBm7o*jO^_R0bx-W7rd48t7Miy;0g95r2Ou?zsUvEkTG|L z+gIJA#h!tXfmX{uLIxu*(YH5!-`GqjZS!c879Fe#uu_Z77Fhpw8CZW^hTFKhx(vd{ z>F9R|K5c5@e}QeF{>>oW`4t7%GT@h3bLrN^{Ohv3WZyE%6 z9{A~C;-*^|cK=moXs8}~0ZcZ;V?|&Qudu!TxyzsGO`D(R-u!B~^=i|jjuO^@?jwd& z_pG`)OwFQ!1yKAsG$U$D_^^LqfHxmi6O)h9=>&wqkq*zFs-Cr~bJ+KKc)s;__`&R+ z*KKIGleh&duXVd-*c9tk-kyceTS9T zZtUHM4`k`-=0?cR{3rEKY5#?dP+d(5gar^^9aw7f0`$mV@%^VJ)@gg-E+bdg)bx*x zys8io=v!c`^w84Eiqz{guxgvv*d%SoqBQuYbAJ3H?#0D!K>5)0-V?jOsa)dQMPeR<_lx|MRVo;LY%loN249@7=b8^Dj|Cd$!Z}Y!WqBs8yVE%883rBXGWOf{C z**#jk@Yklj^&js4#ojTZ8-Msv3hkv7&l86*CiLxGB_!M%0~&-gU!~*TRmk}4QiDp= zb6%T~T$CRHr6>+3XE!SMtZ%?TV^HQYU1JjvBhQ5>4wgLo;adEdqR1&w8gS_fzC>Q` zbx^ZI13KJs38)&<-(G(o5y6-3(opcXCHtrqdddFB8-M@Qk0p2j0ts`r`b&Z^AZCjy zAq5WrEa(5ifLyBr=h&&{H}tHIdiLU)r-w&J4ThBKVA|9IEqaf9ccf5d_M^-gO$33b03jHi|QC9G`+U31sU{5|UuN>&9Ub@mT}Z zp)}C5(%LN9rmtwvzhrd!=lkP>)KLX@_|^1#wrG1O=>}1V?u5{yFN#QCBRUuYa5`Bf z;QRa7V5d`$LXk(^)c6kH!>FwlhO}&i%Vz+Rf8%fTLGTl^dC)9QJGsxI5p8!)eFQFl zlegsp3JLs}Gcz|Aox5NZC;!vsU#IYQmp_fl=l`)}2bD@#Lhcb`Md@s;&k|O*U4Og$ z7qSfu2Yo^ZY$aiGU@G`TASq8DjFu;aDJYgTKJd<$e^7W4o4ttnfXw@!^aCQyQv8K^ zjutoB6+^)eAQVbyX=TeTX#*C>#|j{fdMaOQmVUH2Rb{gVC=q~Q@oCk=K5umh6u!am zC6QcDA0!A?MhJ@QsjB*YkKN!;-G$qq(TaS~8TeI=61`gd;b$`nM8v#HD_El>0PZ&anIL3d#5Uv4W>w-t9`T+;M zUkryfwgrhrBCi!i#EPJRKx%C&F*%>@mxKH(ht8ngwOcR|Y02w~#J+LUuo1Qs@3wax z49jz3=&#D2QIHlX>c~(cf8L9wF%E#E64|+^zC1zS$ngvVBgzYKjoOJPeiRtd_4zh5 z4{y#gV$em=f?jL-o;e3v<+?|Lvgj~B)RHTN=br&Z?4QW_B3FI z4cK}*(IZm;M8mV zq6X5|4MKR^I63b2Wja}oBHbOPg^oQ{OzJ-;^vt?Rh71oCQtQmaDQA}b6wzf#>ZkrJJ(WIvZmCwF3=*o*b}ff}taWwt2>QkNm%F_Xa*b&8 zv20t;;aYxN?~dV;I~h^W%5b^qO;I7c{Y*ry_30!o7hhUQ%JGju&zLp8;kem8=^GjcJh~&Ogtl_K zqx>M7sGe-DEl}KaSKxnD#Xy@AJuwyBwZJulQSDkT+C8c75j8#93YLtHp#H9E~X z{AM*)EKArcMii@!j|Ox)G9e;xt^;cTWp;GA%r})vT9loo<=uhk9TadpJ)S-J5Gt=_ zuY^@O3z5~))zK}=0IvU@c^7)%3@~HJ50Z)Q>EU{&ndwq#xAwlL1Q}hr?|aeZAOkI` z49DAti{cSnS%_st@o=JKuGM8!I3wI7%Syay$2$bdJ8M=8mwwy+D;Zol4!(cflzTC` zHW%pXWI;Z@`v(b82#M$xcim>QHNWeo!rBW)Z?U1uhoP5vl~`;Qow^SeRv$+|?iLHL zp--2^W5G+Q!qnHN@`v!`%~}6OIlnXMjy6@@8A*A2&_s(l=rDL z+u7FroyVFE@pU0eDlG5M?f!s`u(hMEgnYHT*q^uGfxEO5Db4jI;ypBD(=?G(MJ3EF zmm!WrCew%u;O{G#;JS#T(D9xqf1Xg0d^Qq*#E>PUo35Tc8GQu`^!nf{CL%>=g3$4Z zq{V?fZt%q3pYWXlr1PYnM`=d85Tjw!saHJ<9X;3AJBF?RA5-ciEv6#ritDURI05VGsJn7h zX#7rJgKA3*OFW>5ZcIv(?^sUQ?I3_@N#tTlP$7@f7CWX2i@Z{@=%bh>#=ER(26x&l zXA*067kP0PBss=A0{V6DWw8MpkJUolKBR?;(jlro75hep$b**!#2!&ZUnL|kUDi&Z z-?LBg!&vfwmJyUFvSrg&z~YN!I?ofS&r z@{=LN*)_wHc54@xen)og+I842fg!a$+*aEg9h^u8T|3g2{e1@gM=?GnL0wV8;U^tV zZ_G@0jJ9J)2H5xX$G`cU9j#D5-=4=i(Oo#^>=s5Hx9uhoeUqx|n81|nUK{fwS%g`&J}hMw?C3@M6U>wjK633D#aKWD(7n;FMcw@_fJh`vBRmg@`-Cs1tJa^YWX>UT<}zIsN0>bw(${ zT@PLhrs6e+?y?smBfejgcZ1rae2U`~vKA&V%E{8)Oka>_hXgKY?{2If9Q9--jRO)i zyRO)U;*?9VJa7vgi=jH#$Zu<>S38%4ZZdk*rpR@%KDHCrs2Dbv?`}1T%T<%2?Km;4 zjQBuMyPYpsh&?eg=iB?X8Al2nn-z@LV**xlF}%G2#-~kdF*#`2WBwzfU;qnz*8b-4 zO+xkrToO&_T3x92ENavo$R!6WtFxKX&pOJTn>O_BpKsO4{yXn13c)jYVY72b)W zB#2lZ>KADrAHEymGyA;uvbq@;hi@<`tRcF^h+vT*tM$@^o}AMA@0yk4_{S(tH>_I5 z43RW9!vi@bBP}Uh#Fkfg_IOOv1p>+ojSt*2{i1207BPqV_}6X@-FI{yGBz4zGHOdr z@(jk>td(*dTRZ!zX2nbg3)Ius-@eh%bVpeDDkz)+rg>|}kikM%$rCk!5K4=4F=drb z5fkjE8%Nr5cF{Zz)gr|7+(buKNXo;Pv1wmXYnVmeb@mu8>ERaFJJkCEXGy7p6q$5& zYZ2?TwfuI+mZV~elFpLj3$6B_&M=ekLtUTCaa3;x9Y2l7zv?lY@wfo;Js;)Q=PX z@g;4%QC~0Y`1^gA+ce*Smh|h@9ImT~ssG=wk|J5d0H2{eI{Z#kk)m<6R36AW^~Pu7 z%R0NaM-Ds`=*WD0|AoyExpU*22M%~hU%HP5GNk(M*QBfMuPs9$x$bzQ2pf%tvnyfu z_In$F*#-bmoBvcs>MeejY)gA_nNW$67Ia_Cd^%}f+ER&2{S@3@KVS2r4bkG@c1gXb zfQ1P4mzo$!>o$7nAG5(S%1MPs@Njo3xncOd!_@U(Mh!Z$rJwo~j8I`?yZNA^dy2dy z!pOqJ#6!*`s%_vFBB|_>JC)lF+Afaftlw7@BKEUWW?q!`>3G$wuul`)pmA-yd$&LL ztisl&#E-?Sjf(GW=)XXk?yp2bHw_0{O;A^t;#B-cfGHy%0QI+zA3wIVU%MM!I1~TA zd*;Z!VYBueONnaV0^9~}zN$au=^t8Kvw_Zvh4S-He;j_sh>+g$n8%j8SR|jmzW%(W zy?;$j{OL>ZiMV4`d~XP~wD)HRMSx%9Kr;?eq1`@+-T+G+ZFMD?O(_NW^hh1ieIlWl z0;!aUG6PUgPw>0iRhQhweMi_${3n1>Qt}T+P(2}@p4C#{QOS~HJ zJQTNB*s$p%urnm{d5ei1Zz!#$ z@93BqLT_&|&pWYkgB_f=8*}czjpe^b0Q$0;t2{@$N=BCx?9L#3VC@d^+KXXw8a6RW zJDRSxacXKVuzccLVlghkFUY?*RSGGyUIT@NfC6<9V27mi^+hV}#xH7Wl0d!G{5)0? z#gc>lnwv2Vx6pS+Urb~_pY51mhi3b8fPDw>g!(UEGL%R~#iLGu@T5*!iAGl}IVML= z`9EkM-OU|iGJDDr&jln0?g!|~Z0B%n+`-qcO${g?kj+ZCv)a zZ}*OB0eqt*fblGf#@@pN3)Id{tgHmLzhhk;OLvfPfZ0M!f-sw?dXvjI&^f6P;oUft7&hmg}KQIqatLvL{`6PY13!C5;p|0m0se( z)^20d!=25Zw3eL!jG<;+YTIvU5#kJhPC<*z%i?0?sDUy7x5Mfv;n?VnWivo zRre6?I`e@*kt)jdy`TCw(KC@YM8UY-}-S|*sJtWPE&UGqxmzLhlqBGVH9I{O|r{8{3 z*L&xKA(luD(mg!~J;>pAB8xgyVR%o-Xug+ zI6}I*@G*dxP}bK-3soT-0eFL~-u{nWz5;iMF?gv_4X>mDj!^>lH7M)+SXxTvt*J|ant4+c8d|5wzLis*lcO|D*;n1J z;mS5xwmjb3t53a#Ua#G|L1L(?8TdHawiP-7iusB}Iv}!M?K~WV8Q4iPpfWtRXipOm zyNU?6USRcC^Sf=ohOIUhTXnqfv;*t%C89}3{blvDuTjwkQVNh81TEA}q6@c`wKFbE z|MK@yEu=7;A+nM|p^LNgjqJma$OF)CLA)HrRf9Nm-!R6!)tQ{v@%&)}Q1*LnqyIT- zg_NOKm<_RSR+O@mzpg4k=F<0E_06H-SMAqg94^0;cKgh^;eE!q_AlPu}^X&BW)2`(>H+_sj)BaFF}Bo-PkZD zk<~P2`oPtd5j4kadnLK=;wAD9ArubSFm0Kor6cw0QmZPA4^$Q6c^~mj$lQIh#>ZFG zy^CfAj0(u# zrk{PW`MVjIo{lAGA0`|ex-3n_-*@*TxU543*ua{IgV@~5%AKV}wkiXIJl>A3lca)uA~^Jqfr zkAEo}MUya?;0e44Ci?Cj=fc(Y;%kV{0YI)V&3?;=}0(h*7aZ4R#jrT=*u- z1?o|&F)1O_N+ZJ6c4Q`9w=C!ds@Hg!4(QGb+AbM)K-y#s+d8aznUC|oIrQk*9wG?~(!-Avt#04+6K9@I&J2&g5qSA!s zb4m*$Pco*`BOVs!bA?x?rV;}*kK2u`f?#ybrt{)YAf8`WrhN^!u2wGL*ez;cY zM5jz-enpiy4T?tQd4$od{lLA2ZfOA!%V+j=ZIu9R3n6T=;HVJ9TJ@5;hG@lrm79yDYS*7xrWr(m~rpjjW9 zkfF%0Nwso$~ zOH@#qT~AMc``pV56H&e8K0P@DTi*Rv`bF@QwZ30bcK(C-TzQ!T1wr>QJPJ(o)B8C# z_+ERAtS6mb4(gVYnriSdG9Bn&w7~9dy+7DONX@DJ7V$0~%O2N%i7X3jc2R)7$n`@l zvoLC|yS?@Ezc?8>F3H4EJ(imL-IR){iRW^FZc5F<-T;lu-#}BUMEP$Y!=go9yNpcS zWzCl#HkZ}nx~fu&TU}P41yRMhRTL5+$qkTw#@OkM{H(sR0#pZjyYvg;Qe>phb%AMV zZ#YIg4jo3YY2WTgikJN@j9_M(&5RD)lm#fs$KjDj(@gF|yM0Rl{ zI>^Yp?_wj3Vmn|?Qv_A11=3s{0p_l|McDW;>;?ha&&au;#X853ZHfrW9IaV>E>!_xIt6`lX6Q9tsmAu! z?-9&OOV*Fv(rrg8uPiLYx%I6Fk*e*?59n0rgAb?c@b&qsUJ3cQRjo~#%;YWr6e5dy z(xywwV_PTMN4sMX$Wu|_wrC=7%j){p`g~lf@Ev+J+g>V-{{BPvY8+GSVu~tPA;%EY zn$7CzGQBbYY?&M2TG@=#d&p(B+r$>LBwl*V%WGbnq$5bbB@D3RMIB2?VFMiSg>Z$i zoGL?5{jHTf5LRD<{h6_Q#_he+ZA`O{6>Qv#xm%uO9n?DSKuZ>-Pqa}vcDUK0MI4o9 zCXC6n9AdZn$TX>YVByClbj%;81-aG zj`y9>iNyx*G)dO)mW>}Tj@!Pspy-jVaF)=6VQE(|6v1(B58RJc|L5rV(cb=eEtsBx zVfxtzRJo;Lz!RQ15B@cKT#jJ^DH4UJy4xPVj!MQB)af4gfp5(gCOmJ`-+xPG+vMSt z^}V&6!1gCl5hVsvX9+;b%Jt=rK@j2bdt6ZAG>QEB2e)WM-!>w_=Z{<_NQ-j9)JLG? z3HhJs;m=_H$f~loH!5&TuxFEI!i_@YXwmz>E(xhr=}+aMdHqv+kE?TO;HmIjm;x~q zmnTj~Ri|(JOUgJ!ehR)F?!klbIuN(waAJ?TUb-R@U@v9;FQ9;!49FvDdpG|r0(m#| zts-V}=_ogk3CaxyKHigRHgeK>d9JqvWBs@)NIu?2Rr)Xe^r_Iy5jXfZgER~Yc6~&j zu5r(G!K@b;8u-ot5I7Q5zggk3n0yGgtunhda}6Wq|C==cZx|``zwwbq=AwXibWx0BKb3>Spw&A(qvnM2_^L z0#eT0KoiNszz1>ncF~tu&k>FM?clUO(XMNOJd04+mw!2coN@oBVI1sea462Av6~1( z=CdzcAPbP6uaHXgxxm)o$&GSn_iAYOGkS_agHn z2vyBK=a(EmxVu^;x$vVB94!E60K^c`)zxS)@J#bk* zFj84}nCjD+ZU=_?0g<3k##3Kkzjb&(+h9AqIRd=Te^wEJxG#kN=mZ{~&Z#Mt`-^1} zX@mMwydkI8eKYg(FF@!6I3eIc%ve0M3C4*FMWzY|{YM4F7>j3!UObU*(tHhcLr;F7 zIaVw@lhmh{7$4KpiglxI4il41jYc|-6@sn7jL#LHK&RS6p;}6Wm3;Qh67K4bPeNLg zuG+71*K(750O={}{rm=SgS)PESe);4paKtKP4SWUunBjoo4tRi6 z)A>AzV}zPJLDU0_F4J#+*!TIO|0{POb_PO*?!v^O$p11fy-x-(y>B0H8$ai9k>B6& zw)FvBBb!sN^4@F%a&4_EJ#$l}j9S^`waI855GcncC4B`FcI_6;&@rLMvrmC3Nt;%D z?ZT1V$jjh2nH5L0boL(l9Q2yHQ)L6`rNs-F>axu z)pq0V+S+AF@I2G&w8k(MY3S_NPcteYiU1SVfU@tyjS=lbiZS7S$eBP zyL1Z2`^4#BWPu_V_tlZTtS=D&GQ_n@&@9hi=m%jK3CGy^A~2f@Jav2>be>uAoV=% zUN3TBd5ZxU&Zi>a;@~L}1o`U5-Dv;2Ou5^NxU#Y`@P_%C@{%C%RD%FCHMRGYc7^Mm z*#`$%o=BRG4)NJ$4-(CV`J?W6nJ2|fQXMs|sSxly`VCwidVkRhwVHARYlRt$Z@r1> z=|aLc9Kd7Z`SV}_8xST(%|;K0ikj!#nCZR7PRd6ZBb)q@4Rkz(19$`kUbxn}0?(|n zQDhA|PEJ|7g+E;g1e31RQ@3CPd=Wo@NZ}$hkxl(Z;dVP(xMjf$h!Md|5i1x8VKaEg zL`6+~c6rj&4hI3j>y&J4aA1oq3=Dos2KAC@8YS_H7gjA*|8;t9ZCE)PLzoDH+t;0; z8Y1$aKL@r13jfL%O7I5rn6#J_{2^wUnni(eIMzWob*!AHLgZ>5bPG>;r3MBSo>_=M zW7FN+o6oi1dpahJYDTvy(wC8xG;SvX{LB}Rz$L8aC4&qCUd}59D%1P+ib>@_+lT`4 z!Gegk=0i8+L$ zhECm!yp!~=L8%t!AwmLr?>BeNz`9Vtp2cGqwm(Gz#0#x^O|^e5+dQVG=6;?GpsrI< zm0!p2r--;z9;lb=Kal#cYzSotWXv8mq_7)l+W87M@4UWWdH!^vMt%M(&>jxMqGA-3 z8M|29+6n{eCt$8gBnUk4T@ryA+?j^iPQr&?eA^g)xV`Khgu-mpv|pw~&ldk!Rs8%( zBwh%%-zUWJgl_ z>+gN)6HEyS`QO$Qw?BQ(J`rWTlR0wB`E8Ud&Ojb}KV@HzKs5gnBAye6~VE(^}y%1Xv9IkT`Juaj0u^b*k@#_2JDq~T9Z z1wts7>b)2oZ+n~fRForFhKO`R=mc7Kn-CBX;W?eFb@{32me zGSajEt`E0w2@+{qn&Xp`i&_fY5EfPf0y92A{z~hAe|^cFlm?Ji|F^r_mHFuqu)WOA zoeMpx4L-XmL-aFwPIk9%9y+j$2)Lm2|9S>)GD=Qpnpz7tT*mwY0_{C>A6Wm@K>l|+ zCe>uE7zO49fpumZKBDwxjjmw^h%kgg^@~A!4kT`P$VKn&4@kp_qk2|Quaa4!r>J656kZxs1aa=i>4Z`-#E(7UCS7eWv`{noJu#HYCi3rM0f~( zm7t$Vpny=In)G&lTJo>dKV&bQc{x~IVzP;(E1m4EeA{$>{pJa&u*W){iVb!AtxWMv z9V)-~aa}^Vjcau-Cd5<;%3WAgy_{}f?SNRG{@Mh(#gv7 z)%=@>dP)gIrK3G(3Lg{)$DbpQhd0XhrK2PDekuf-FLTY;3cDP zT2&s!ESRL@Dwwb3?6e*n_W1m>f*;|Kf7)l)Y9%m6*?MxGO8zLNC>)ZEY+Fh-+)b0Ft7M(y^G&uoIWpedN!WT=`%F+f&vSa7iYGvBXqsE! zs9FWZWf=k-+T6++ZeOC^-(*T3>ye&Vr^iw2!~t zCEl#Ad6&Ux^jJxjk(qh={iy2rYVJp7RCQ9pI)lRIdy2d%c6Hm_OHT*MAUl@jr5`6x zlfegCEiJFcm1wyMG;asnlL%IJnIklkIR9x@QY%R+8hK74^NQjIXW9f#s;MoI?(wpm z!7IJJsZBT(UumT>KEb1I>Wrd>L|Q3Tpmr#eGKDu zo|CU&dCYgzYxwA9WtG7oOBD4HA0{;BH-~Z=w_d>zf%%Imf6!9cL|j8_P+Pcd!o+@v zqse4m@{pa_Sdc+}h$d$0VFY$TlKk9juu`fI;#3l8t1(^8Airai)`_ifL_!S=Y@S^6 zk-pfHoAayBtLn`bs#Y7Hr#6sXYTmBZIIdzWIE@r9gfI^VN>Q{0@QMse73skJ`i!pd z)9u_P>qK~{3*49pH0;Zn>SYON*7}z%kcUl*kBfCxMG~TKW=E!enthT0iuWJxi**&0 z_2_xNsS#l+dB-;tRxh=DQ1~C56doXYed3!a|2!T`%(|zye{19SpAF_@V{TV@6gkd4 z>^NJ~%k?yShR?##9@E;0K)dqiYWzDc;iL64-xF6NDox&XH~tRuyM2Nq#X2mOhg&-Z zUQu`=$Y=j`r+CF1J4loygzg_YXT$ko{S;!3a^WIUwLdRjvRB~decy!s2(LRFRL z=-;<^DWs2FLu`hKY`JoDB{mA9!|KDyf5u4 ztOvajX$$vzS;W?p5JF~_A$Tl0 zc864gW}4%@l*VT%0+F3$PkmEzNZqjXoX1r$W$Ijn)<-Mj&)oj(bzR!{-@MVKP#ctC zPjXSYul^R7$@XtHs_cdDwT$_MgM&Y(9nV9|sQCT9irU8o%)IPp{O7`%F1;GF$U9vm)u567>h*UrUC+5LmKZD1#8X4?_bd8*@2 z8M@#-dC#t|%xyx(JC=tR$S(p`C)d7yl{JDET)61)Utv(Bf3ok1m%pa+krjAH&}1m9 zf&MU^b4S%ykammaZ99VQ+}c7^QuN9F5zS{vbjUaLYwTUt`tE|?QG{rBNXQ)h3Is7j zg<{Qa>{Iu~8Tahwokqgr-nEsU#UZGZG1>(kLb-!BSADfe9rt{OBT-Vbq|kwOUU}lDviiTkYC286JCd} zgLL1q!oNV7Ex*)NRa^2oXly*toNnFGoY9>QAX9v~{mB#Sr6mgLcFUz4EvLt2`r`XO zxK!hBcaX!8QQ^(yhD*~o@tl`UD{g+!it;%hmUXaJvg~@~@nJq*7qVQR9eeh?qMHf)2a?z93|H=Ppjyo@ zy@bse4qb+B0bG-m%)9hj|63a!7^*e1dXBffwOefc=hj=2(a3y*V%zFyH>$ZVOZ+0m zzSz@VL_3tcyQ|tJ*SZvOE3x~ya4NAqxjVi0RDW4k{P!xk zNaxjqivzzhtF03!o)ZjrW8B|s)%IXoU*({ntw4}TOvkzgGYV!!3;8kHF87`^BN<0p%Gz;@rA znyS=D$qJVk_}b6H@XjP-0(*iYK2N^Sui}qGSGn%2mRiVUiv|71r7)@$d-uku4l<>p za`R;z(m^G=4jdxtLH_-Lx6+Db`68pXR$b)+;yc%ipW8D2ivFU7fviKNd0`@kUZh zw}!G=3a|)_5qZcwUf$Z&84$W%3)dTXLc(r0Hy}#M+SY`ExN5`cUyso)aunv=yJxK& z#;;Mu;*sGc5_HZEpBwK7Z+axJ=4@{o!R^Gg&Sc+df4udESg%yWQhbbS4sPopPZqY5 ze>7}(_-PZnCgPRz_;WrIF_LkQ@+lXd^%!1VCmZy>LI~F?Ni~kGqH?DHTC?(=utH=v12^Y80ZXPG4^t!Y7+nK;&2Qn16m9s= zc6j>C$yO4{I)4OWgemk!wC!`>d24&D3)k1Tk)j$7PHMeWYr^8wBf5RNt}^z|J-z6* zIvX4;REW)^@MOg}U?N5c*3?NTm+Ha%EApPmirGs%t^BFK`SxBpUrr9Vj@~ zZ>ZZfti2XpB>7u6-GO;Yeu*Y0L~2-#$ufbZq4NWhzdRT8Bw6w9F1X(HuhH!3njCt+ zdX!y!T^ahmR?KJ!Tc}KNb?A0xoDO&HQ4Y=CJ6VAc_qg9W^71#A_# z%J63;$dOb!>;Gu8d*8fCNpupf<|e^77d-kCKy@YKad*+Tq@5YnNsAyCGA%x+n9~a# zTq;}b$XkxvT<%0zf3Ro9d6aJ!#mEx1=RWW~5BWPe+?8*JTyDR_8WQE8&@&{^>+5A?? z9hW@_u;Irg)CVD|p?!*vpVsnLql;&b_NoTQ&S&Mi^Os6Gjpz*SXHFH_q44gbp6C!S zFP=*M&i)}UgYlxrPDa^Ihps6#vZ|P8J62D)M)PY&VM?pqu#TbN^^x+=$gXH|v&eIm zn~CzRKYd4w#rEi7mUAB?+j>Ly#TJ9u!wC8Dds|Qmmmj+;lqxF=22N*>$57Yx$F~b2 zvkp86*V`TtNr)3J();Z9qmmicOQ@Zqd~Sz-)?YM2I_@sL*r4_7lOOs-&uM0<*IG+M zlwx8SMy;9n4y&4upwnF5w_8T)KX+qRO$PZ?$pRl~eQ|8_i(z;pExz zg)HgK2|bvRSUg^gwcc=cmSrH?)wHP$soQfm)44;d2p+=fd|#bc=h}B<%w0j}`i{g; zMA_FT{>0Ed9dZ7?uiN5cuY-Ng>@o9x;{B^?e;Fook&of`NizvAciNlXBbF zh9K|bd9p*d^o5rQ?cf1%=HZ+>5(0yJ82&-|#CseH)Hyi0{rkQYivl_gQ{-rYvFs2@ zclr*=FbAVLq95=Md`W7&8C#sPxcq`pJG!YT61-rTXZ19ihG97a7uRIgcra5HeHIf3 z!6eTU6`<(mT)O^LPVV@gpoIe;y&NRJDSp2+dBHYKK_}r4AF!WFE~>xq zLNEynevm`HVcqvs%}@H&L}PF30fMY%~QQizR;HfISJFJ)dK`~XextYU1`V2I|V%FlM~v?yAqx7M}N zF1z?6BRntz6)nk0T)wGkZu<3LQ*|c%$(gCwe0&NzQj*T5-3r|wJSG>4`4$xdyZ#az zr&uZKTZny#C;FKreI-cpyKl??8rE>aU9uegv0Z-PtK}|ANjz>kw*a42%@JoKm6*pB zp$^o{UMhP)WqYOon4l=C(e~!9#igZT zJyW5klaCj|{^0s010VcS@|BOPqvJapBWlbfyw_Eg=-aTL?-^M;R>Qv}Oitze8jlR2 zjkpP?o?dnowRFAzU{ho7IPosm$zSyl)69tS>=zu2Urb~-%GaLfxkN5EgO+2p^duRu zS?=6egKyDg6_o`oq8z8B1@%y2m&EslMX@pOWCI)jN|tJp9h}5;K+wKSX5t^pV07(m z>{}M?YrBkcu#xWU_|x;+b-Q2XTY+_f5qn+n7#hq(m2;uCG8-hE3Y$$+30a&FAUd-t zPuD=|FMw}vlPUYt-)`^h$DxbmETbJpS52&||AtCH3tW;e6w{_8)t`y?-VSz!>^WNx zi$rczQoWj)&ey758h~%NS>3~dCm3tBKi@%)H?!M{dKg5G!cZ8E2x|n{@?W>o@id2L z6}3V#YGAWkdLHwBhsRv@okejHM>E42mhurXM$*u73Yl+EBqpwyX+uPgurKP>)23?c7 z`sX`SDO?uc<^|$LOuLXNy!~zu+w}G=AZv&Bxbi~&U^btcgX0T1r-+EIj;v%KxEJ$x zaZ{Vq949ImsHKp6BX&oHpkB>Y7;qG2G?b)Ryjef&&&hv(dp)errkMPc9GAiFApUE4 zI;cjaNBxTi<>tPy78RUO-X))QYNhVJ#j(Zkd+!EF#Jr^_m7qFeAo4Zh>)#u+qE}&I z(KDWIC2d7%-XilcqW1v<1ae}QnvG0O8k(9RB0ip73qxougV}}B9yTs27(&9r3c8B^ zzhhr=acd|jDx&5NgbfZd0K=@#f0!a>!qKW99(;xWo^GXX>Z{D4+??Oih))hNY})>2EmF(qZ?pcy>~8SkNAE83UtyV0^FCpo{iANKATdVfie zRy)Dem-vJlK1#W8scd^0(>p_xYFX4XC9*oJk)B&SFRv5-yun3fR`Gl2*^c8@di4>3 zzrKqw_IUA<*70!T&#Si{$tMjnksbbhx_s=sDcEFWUx67WQU79t6E8f%U4_d6=2M?) zu2KaIDR*H0Tp9X<3xrmZuCAqvGdokeCgpCswUYJqDX~B)ENg`8n79ee&UE^tqpXbh zF5$A2xv@XEQC$?6uc4u(T}w5~?1&~4EC<=YE94>~A{=a9 zT-baqYvGK*mm4_92Mw{dk@EBNpV+N_;$3=^)#H*z#A%vcSqUasZG$@WWBm=WtIyBR zgXgS!L1$*;L6YYP0ZYhlV&Y4xh7}jFqJjctU<=h1Lx7Z;o)0$%2Zu3KjZ{J?;uL4$ zV5v#XmimG@poLmGGWMCC!vRqKc2AdR9rshm=)(pR2UjfR7rhQ!PMTTjq40CI7;ttA zwHT1AE{Y9TkcplozMGKn>TGvLK2zS_zI<^r;jL0^Lc$wPzuSv_G%T!`l?!o6x;_Wa zIHM}=y5Y?xW>z#iYn>=MU!AZX3*=ZmB^rdz{r%_;>fh?+>NYhofB({QO~Y~u-Ejw< zl5>CDl%H@~tXjWN$dpoLD=Ww0{|3fiiSF=J(1^eW5MNlqZSdKGCv#*evpgMBVXb$Xdv z6A|}CHE7~SU}H+z$WxA@UO=!&3r=H>pQC*tKQbOP1{D-Ff*Kp4Rd3cDoiBeAjtPksT^Hq^_k6XN6UqfH>F(Q;Fwv|dLIyyKvyA zicb1lexF}hx1Wm2GHoOM#qe@$w7eRvk)Eqmli3~lnC>%Z?pOT_aoFa(do~=63Wh!R z4isjoFyqQhwZ+JxBXw=8Xn4KVcif>TZoL0+yYd*))Fk*tNy)@?Peo0KhIKiNvY?8C z2YVe2dkZhM*22QV@%o!AOB_)hmAR(6Iz2)$m6Fil%}8^UmBnf3eS|ZiyD5o2s3e10d%MtyFF%jwq>eHK7nJ3YM9OVxu?=Imx`I zYhj(CsH}_E3-|b{4DHx=&6AY=tz_<0VQCGP7ouN`t20}DrGCalZ6_25K1x+v)PORj zADff{&J@+0>RY#u*>w_6=VWP~F>^}8!!7fy(NN6yb9 zd$)KE)-`y!M_-?EVF!W`ERq14Ayq?A1jCFi*1&mU1ifTZE7Dud>Wt-UEz-$rX*&(*ck1-0ufaSsCrWe?Ect2BCAdfyZ zp_*g@&L~x8W4(b`BJ_Q7Jv}`fS0mPXIkjNx?RWUv;3GQMfU37Y7osVfJHNobrwD&@ zY3@>b^r96`_lMG|wNRZ^wWRX_A2J&@S?-7HdwHw;-b<4?btRR5F6L);<0Ousum_s` z%+8U=Fnx2CneepF1DUiQLxc{=a3hSn)X;-57diNS9Arm1*l#h@qf=6r4)?~ zYTb;H_&d6^<<{Xbc&h7;cth@0_f8jtxP+21Y3)8wcpxAhlS7TC_Y6n%aUCsF3m;2Nd39=8> z|M3c579Hx>lCw;pbJ&mm;~{q7HzE-ys1D=FSKBwCgkRhS*s{rV-1E6W5?D2v;FE4M%4Af%Lv=0v|sU$}S z7cMDxQ-W8A(={3Rcl*{OJZKCNJXFHR6!d&&Z@&{WCg^GneWcpqN=Hb^N3Q%qB+H0) ztnP|~IjL6ALbmB0181Gj5;xcPjx|@1)&oi3$$(b7S*XHmfT3HSG;m+^AwbtCWC*St z1uKH%cW}YBV{}^JE>D->8GFV?SK+?VZG?(kNPj1EgCop2a#Wh2(d04f}09pcG70J9V;;+H}6NUZ@nbTm4_3x z07yGIan!({>+9RByYNRqHul&6VskJi*>58&D+_Z;<9GVo-{9PH*906r6U3KUTd&@Y z4lvf@iEFdR*nau)%{%NqtRbu?y%A(o_k#VDX7l>~d`9oM3rn=$!)V@-!r!%^sA+oSI2CgZ5oosaKf%jL$Rq2YlpyW4R`ATl-{9!*R}N(%iZ zMQKS%;^x~6=25L-8m54{wHm`{C4 z^CvQ7hf5j1_*r^2TZ2r;2M^ku=nj6rubym0Cr!TDKVBT-lfL^Xv1x(@d_iJhiNUiv zbO%TXzdVpuAF}zHQ>#^L$$}$Bi3mdbsF#QI_Fq#`c|Fxr`fou75HxRuNWENG))!wO ze3a#x567DB$nkvuo6Gz9`9J)UM{0=Nz!$#wf|T9quUvgSso+Q?%5XTk4)*LT0@Itz zLx`LpC8d~d{oA*1=YI$C@A>-kO&=gnr(2()5aH{QPcI1(tYE3HZB8e<3A>b zfSJ>DK1HNzDSMBJe?GY1?$;e}iartz3=D8=FXeOG)g zfvK;;12ci>;o0^d6W8k5nXBV<*cg>AUGxlbJD&ggGXy04gT;pWhnrp4u9SjSdKwC0 z#D1;y9M$D(_^vf~DmZcqikPCZR?UOJe7cuyylWi}oQj)#%Bqo&(wpZCr&>7gNu|t^ z{6z2qtq9?b?1GENC~HE)_P)|&fAyrtzVpe2Qa-R6$>bqHg7mc%XT_{pfl! zN;8vT6cd;FzJGl^%qX6Ck2qlyycuYL9q#c^t(=E=)@S)yMu<_&I;6!_*%V}$q;MBRk)plN1lK(dF#~~ucPi=pyHpJ)5vV2sL0;Q(ycC94a z8x#3jXX{Wtq8VyvCs^9l;oRc&73AlOIXJLKN>e8>X$0Ugs`jHpc~`uZkXoc@EBShZ z33T&YzX2J>gJja7;KKCk$y^qn_R)-Ds+Ci0&8^hNo|gnO+9ye}uSD&V!eW*Z7!MhB z6hwbVnP;Xgi<>BV>#ql{LxUgDcB0;9in|M2L|ND6o$GnWd@Cj$_P%3P7q#N)U2)B5 zzJh9^gqqL_z}OtWceW(O)Qu@G50*&4;Z)7bPI5W`Qt8;0 z0Jcg|}?@|_=Fxk<{I+1rL-=nsCmdzW+ zJjPl=nh`>w1bER=dLzIIwk;aE+@heT5*6MI&o#~4E-HXC%0la6XEUR3(^)#xBhy5T@@E@)ne_y^56RWzjLa(8ivF2^9C4; zx^_=5_5XBG@%y?dM{^(_Z5t;~>bpr3?@s?yk1RH@fpt}#1_RLWFO zPs(p06Gdi&423loAf>4w`D#^JlYJ0363#&{wM09bscAtx>$hT!M+hG5q>5~T5vK?( zZY-6)(@P*2{{7uDTvLC`M9h4|HpV9;i4y0Dqc+rb=J z_8qPZC+xiD#DRl`#$=0ZMppF$D&~uXEH$cG#)EnSgrdE4ZS@kKe}0hzA8x+%42(+o z;wts;#!z+R*)X(j;c?EfmdF^9>vuL!ROj>|YkT~PwTyI}k)Fcd$B#uMM-MqZ?+2>% zQaegXpE%Z>+P5WTJtd-$;LF;w&>mA2uWfBEUM*HO=w2(%DV(&xFvlgh(+yyFHqW|jP-8=NAHN!bK7M#0xv1+NImQGRg5|TP|V{e;| z`*%F9(oS9u^)af77=6L~nFA)4J~UkpIxD& zvexpOvYIxUDzj2l(#o?PuaZk=!|cLADq;pj(m8BL;>sB&zN~JJye53F36x2+WT~OG zE$N?*)ReUsDvUzs1*R`oAgr5X!l_uIcM3X|BZ8U*1bXQB2p+(~s*pPxZJ%cB={78M7FzevTJ1>e z4!ze52ER2DAtIWPLoxKz<39gR;|(=fSJxJ1{KMkK2gwW>rD23JR`Y^idfG9sCnnAjLGH5^?A>vuM=L~-9K$YX;% zcz1Vq_v4HLFLsuIfPf8lDVKi$hlZZUYbUL&{3;Xj;IX&VL;&cDcChu(BaF6qo_B)9 zldg{7mZ0y|DIBYMIh=!ogX68o>E8kUI=;-bG?M8uy%>O;w22Pg2Yi?`DkV#AVaa+g zNk}3Bk+BAy)SKPe0s9iXzfd;>19kp7_+?Vx%Y|Z%D&Q^`72k)ydDBCn*PkWTJUuoh zk2Kgbrm3kJUS7`j&#zyGllh9XRc0~XF_LZWW4)0?)R*Fu@nG3Dril1*xqfl2m-|oY zZlnjI4C^x=p|qN3DpG0LyjLAt_yrd@;|=<#<~g<>5f$2)N4n7()<)m6?Bj+pbemNQ2d~c?g8~j-ss6} zaN0B+N@A`&bhm3cpZ;(=Hoaii76rLmr#La30-Wt@)`u{o&CR;QvG*JAqaW@-Sn)3q zXm@t7gvLG|XYb;o=;aTj&#A|0)n*jhI@$^#5lgqlFg7mkC%7}~n;HgA<|HK%)on(u zZi`F!VvX8Px}A%ch<;ujvU>eC7OvaF0p+R@tg@1WU;1$?H^x|@?!3aF3&~}OTGCH_ z(V8`&g+R}n9UdNDK~FCRSTq8^VJN@=y#P+ZYN_(QhnVZ2KSIgB&D8|(C7~Sk_VrP} ze*MgC#Rs_kGnyz|MhhOqiYvt}Fc#PrPej(pPiGNvU z;nHLVeSwKa4s{#VtNLnrQ~!FuwY@#2Lq7t7&q6{%<(}u3=3K-YIiIw>aokqxmWfyc zYSu7)##veZhM}>msHmvd*=BfWpg=K6c;s4jU%D+tI6AI<_HpQtSM1Jy}ntD=Ae>-&pvyRSJ91%!>331Rj|v{5l=m|a@L;^=T&Jb*sjQbvD7d{ z2=4Y&HB&A$5f~cfU=tIg1Cs@J#QUget---r zwIOAL&18r6gqPfCI20*voN)_xW5{G(@pRY`>QyotK8)50@y!#^nq|x{xR!M2VW*s5 zUM8oO$J2fi_zUpu4_lug6vKn%77~CQCBRGtI$VTsTaQO88eV9;aDyP|CcF`3k zCHxFky^zV^tLv6`#_QoTVZ%BO-p4*ti{%V}DXTTqTN4bqTBf|9<9Mm9t-UcuHL6G| z(;OObk>!~>BAnDnvF@DKSFPAjqzCx=P3JN;;7wPov zBNRUHYp~GWV@ZDAaaIxU7}^7K0s_fs+SYoXo9(=M(AY51S6$?1ICzgY#F zLRPc6BdDSJeX+CgG@5e$S=bneH}T*)7H2(}C%C-<`!dWyGK=!!EsNM!!BefWuC09nqe)B{bn}LfR8XdaYJxd5$)z~@=gjVDS9V~W{i3%i?2s%%mc@3!UH}gu z?wG|zZ^BQs4NR3ORGku2%wb`TrJdoPLdPQ)PNVPk<$T_?u(3^$q{Yh%le;==M&Xjz zyZfP=)=iCrOUh4pF16*U z64i9S0ybet@W5pH$B8GqdHv&q-aI`zLl5?AnLyP_h=PH)+Gbgr__RWg1 zk&_|B-eiKr;-j=eZBB`e(+=I9S8L&6?$#sAEQf_QXnF(`XIKY$=t}AKpfX=w4W&rx zP?tGA9TOdDsCl^R6U~f`larj(=r${MXN&g_Ym5iHkr1y}X!>nk(Jm%Ydx<3Nkq_t1 zkl#f?m}57UQ7vu_NiQX1QUQ79Cq!#RBn zzYdh*|9g>?ltjyjeh*`XbO5+u{MG!}DI!gVY+DdZ(XIFCCcR$InN$BZ&4J~kHbchY zr`2$aA*24-2G4~2$yqvj4DPSpOGN@>C8W!-jf4Hl4!s|(4X6&%ZVihY+3|NIT$ z!Y>ypabX07wKz`jd9TPiMIWxQo;V*&x7U)x+vm_gEDqrB1yHMu#dDP<+N*`kokGTq z*~Y@XS+SFl>#QPKI6vI|lx(BN?lPpmb42q)PgVAg!I z*@HJUCUhE^PN$9-+e6w+MR~jEG&aC7u~2JsyU%Udw6S44hd<|)gEPih)*JwKWdf}_ z+r)bS;zS>>$2jV#YggJJZNqZF0y4>_A|oYDt@#1k5jflAR<<`bHkMpgR#emlJ|9+u zPQ&l1k9V7*C$oBxdv0B?eeUMdQ9%xRA1-Wt{8RKgoK5D|nXt`ZG=jC#rh{*IL6T6n z>l0X|yfOw5fb4vHXg=$+#l73NEtIXL7KPzvH|&1Sdbfe14*xwr!ot$Fx9EC6T?g>m z&YvW7T2@P^K>hO;RKossqeNC@#fWEt_kC;n?tw0{yV)TVW;pG;qYGGj%3^Pq0H#x$4{gZ;j`|8YX9EhAa%aD>g?n7;m3DkUv#k z2hFFSJ#6FR;!=dYYKzIw2I#UVX=$Yol;rTJ;YX>&SfWqCOBew7<|sfywL=J&m5de{ z)w@U!WVfP{gCBwkej=I@pBg!M{%tw~w#;|zm?oQ_gKp;?SXkzMYN)GfWM4RA0C|XE zq%Gm@LFldzwY|I;Q^1+D+yzQ|-#GQlVkR`VzL@s?meAFZ+1K?{g`%cGed~9z>gX33 z(y^4x+;aghi-l;8N z;=R-*h5s?9UGgTBf;iA2c_}35lr?l5HpyETQHH046xzAa0B#y1QfT9|0adGho2oD~Uh?w9za+ogw{A1t@4Fz4lz-9oN zzU>h#g!`5Bqu`4hVu#@qwdv~WI#R5uuPuTWTeT`G&fE~F;lBC*&CjP#ea18o{xM11 z@K{90d0gsb6W`wsupOmqE&IFdKx9xO6Wcvj2jh@}wpL(5rQtseF+0*#H!mpf93ZhqU51(W6ml8Wg-PySDrn^_T_Y86qiddt7o*x?n=v+xj(f6|kCD+jbqx6kM zEfJCBleL2W(zj*#V&?BrxQI<3(Z+->D>;C2gW{m|(>_1{6MHynA}y)2R3v)X+gj{c zGvz}nid^0ghp$m9L8lwyX=0t(>{FwSKi7!wgn$&C_8Oss#v_$uSFPv|HJBA>M(BdB z9RznLiW>a(ATU@DU^RKEc7ze#et{=SW!jE%g(ywwFr^*Yw&$vxgs*>jBgGM>t)m+h zyXC7ccnJA;%VE5?5y~`4*s&g0nU3xN`O4*<=mc zO$728Q4~?{2Nn>|e%y^K4?P)TO-^m6O8F?cVGd|I0l}P;J^-K=MINnc^1QY`JHb&5 zq5imkK#cKYcT5fYynn^-2RivX@RABtUD|<7Sarh$urR>d8pnu5I-W`qI;-2;vwo9B zJ3j5G9r-gw3}+kB@ysCX{G`jnpar_Q6S5JGLt4xv{Xs&OztIVMXXk60A+mwfU;JyD z!j{NrQq;iF?AoyYIO~DMXfl4m1lB+vbS#Q!#kj61Zsyke1DWn#>DNqLh__h(P|^zE zgnq%wRVy>!TS#UK>;eYiDw&~Fbi7yw2Ctt2ak^30Cxy?fi)MG2*pspLC z`+%g)VMArxdW|o1y%E2|2vmkx0CSqrl{6zJk3ArA%h3GeOt-`fhi>jnD@oT3XO{dD zENq|uUcs?FaZk^pct{>Vi0bK=Gj!7~%l1qPS`F$h?j#K%^=bYUyQL8~<@C^;x=32ejb@t8f{6>3ONY*rGf zqch7u;{6mZp{iJe{veH1&xplKbhp2L7?eH#rucfB1PKB}yp2C5ZZsF!AJc3}?u1jD z12mg&uXV5a(p6|~MQ%JriHB7iycrBzW=nh=p81!-xK zE(Iy+ZV*XDN;~$HvMaxSUa*FkN^( zgz15L#N&d#rz#urS_Z7TQ+u27XPf*t0^d8AjQf^-cE=?xYchN<5Bv7g)W0`DtDh(GeKE&!Q$I0h9Tkh*(5m}EkF$K0h zIbLQox&ZppA2M7n;;!xEi|X!OeF^)v^2tvr<(;Qo3Yy;mml>4PO zGb)gCWXVdnZsL! zcCq;T^u+Hs9$Gru1KxIXf7YJY12`x$I(p>!10n)qx||!yD}N0CnmBwSqCo-y6PWk( z1z5}cvX;ceI7Q~mzZt)L0Gla@h=~oY8~@XQjqh)k_m*E>T>Kgk6AM3B7C!puEOR|f zdwR}7F*@)w`8WGOBi1==gUj8AV{JoORvaTWM``@x#bJ7IpB>0kOkFH7#vNFKM8{SI z-T$xu#|uG1LBBA=H2bnWs2HMU)a@1ML6SH ziuTsKcxQQ@ILI}awKk1>i|JEOKDx771uv%W-7N)w31Y=o_8ZQuS55kj2HnLu0qk20 z0-;Z*LZiDJY*}jNlsfyz`oBdMthUI0&x=XccJvf%x)^_VhHJi~Ltt*Mz`>VA7F7;I zc=m9m*&{BzanO0+9RXB{qMK5@T0ufKOW>774?~n1DVETx%vtEk<4_{^U)sUU(){^v z&8=0erywscW;3lygAr6X-uhP|gmOGmyW3CTd9>PK`58O$Z9($6t*3t_ues0WIQ;pj z)j^B>Sbsw`dNoyua%_44qHUMyu>>3FU@!XFCVx&}*!Ao>vu`dNoB-H?yq;F1Htd#! z9_uLQ&rhkfI;_?&7Gdd%vO#LG3`VdC1e|9-8bt(P)|Dt6%=kfWZpBV z5KCO6d=ODb|JZo3V>alQmx0(Nl65+grWhHm@E$_>q#6AD7ffvvmxfBQtA`e56DlKi zkArFnunQ(-nT_R}MqO*=h$dA;54+*8wO9Yt-W}4nRcGr7sygxTZsOv7d9+KFIch3$`|>&ady=ue_OdVh1H(d3!PjG{)S=qFkpE) zF7{@-Nvdp7GJ<$-~t^(1) zd*WQ~HAn`WweJ+MXUa8as!m0%H0~Uh_X_d0=S$BNl<6)s|AMC(TZ$z_93zQ~j^TxO zo7?5ja@73;M|3mvX+ga%oO`E@+r1oTFM=V6>rkJG1t1SXvKY8MhAQ_QVUp_A(W>t+2r9MWQqfBaMyrq~H8DOV z;i*hOX(o!j;6hOTt6Z@67?PLT7MwQtvKtD>Vw8<$%!k;1?H`-@boZekblLCWwYD}3 zAzwH~s@F><)o^G-Y1W2;=@Fe@{+YjB0EJE19^yIlwML+Qxd&MlKP6d{N1bG3{j)wbC{4@FN>*E_B8gfSv{EeUJ;98#x7mEZKGFT&X8O0S4B@J>tkwd zju=Q74(lCN1siOzw@7BfUDqV_yc}1o#6KQ|l80+MH}EmMq3<8^ue*ok!VrSGUFz$n zw~qZMyPbRI@*Ufqd7cx6DQNR+=HS#559$LTs+!xfq31Lgm=e#{Rt(FLVb;Rj7ZGO? z>Q#hUl*udFDHtgba<^oIZex1P>c$M)mwiMKi~oV-Ch+NY0T{r&}+;^X4RX@{s5tIdy6G`t$WIxbX0Uep+>@Qxtap1kVf z4E2fj8a0O8k^)hXgIOOO$R{0Eg`!HPfeGX-vxGorzx?s8HLD($d-(C=VO7b6@FS{X z^K;2uIeC*rNF22ehGP^8brG2|=Phk6lhX8@YN;!Xo?H7j3tDmeU5uNb+VEjlGoc0) znW>*cCA%oOxydCq*)2q-Q31ooD>wFse0J8b2Gu178xA5p?Z-_EutG-bp; z3dj1iR4P8X>P%q0qw(9QS^Bgo*0DOAwy0pRHpR(RCLC@4!z0@A`5nUQaNntENMJ83 zu$Elhf8H~->2oB{EWMKYzIJ4J$atM)G@Uk~a?hU(RCWdB1_@gQOu><`E0e@_kr1T- z{*q%#>5q=@!iEu8DWBk)+El?=2sTE>1Ke4l70A4LVT0H@kMaLFXq>15vO#jJqs(ID z2m|#g^>ddu2T5uLL2N#e+EAG3F*a`B_uSz@WlanHGWFAw65)>pjZJM#N4ZB{3}#tN zfw109SnIf6bHBxuaIGXNim*8igZA*YjrOOC&QO;dozG7O*+Y2Q%u1U49haPu zRQ4nJFXuAT(_zv)?&!?9h#iiX!v0bZt3x;V{iqDqV2`CqndON-kd9_*)KlU}z9cf| zRSW#7^JM+CS<{)otNF-qlumT+(B8x8Y@XEO<zC{zW-k$yq&A7}^FX5M+M-I3uw z93mIlJqbNduM*7kAU(Re4qTl_gdd!&lzcPG7d>6In#99SK?C7j7}O1AWYX`?CRKWf zHrD+7nnpSlrMK2R`ML9e!i=j0nN@YfYbnc6XSiGtX-rMW?}9uoy{<2~5TT`g9T+Vl-0!be=gdmFpjyvuT8m2no26mBUaHL7 zY_b3RIT-B*EO{aUvve=m*Q>2f`hzb;OKw6jVaVuUwt*aUmuKgHN=tV_tqOT!Btj4p z5@uW6En}ji!Rn)rOf|3O1D{l&)6U=Oqxj~mpvyJRp0paC?G4`mYnIJl$przxV-ik_ z`LMJG$MAUYK@73q9!F1M{F{j0XI5%7WD#e3xI1`atSmaOVMcFT>7jX&7(F^xN@ddZdZ z)XN*&@&Y-Tztp}?vwD1mpzP=5aVx#EiI3{Z{Tz!v7ZkFD;Oo1Fy}KHc_`9fIA1N9~ zb(-ug;`^R!V`JlWsG%a&X$>V|%=JPP-XNmJZ~)K1z~BuntyJ~m!U7f$YE_v{uK^}I zN+ex{-FUbYP#6lz%2e}IR3Mo{Z_e`p8w1d?63$ViL09RkK-!*H8R2e`mcxcKeJ-7P8gO*QFVx-&p|g1 zoZA(i@sFNyZ+Di9b=3*7o^(zk1H{s(Vk%$dZBrjJlXSF`#D_-1w53H{Lc6%OxtYMT zCc4oCG&Xs+_scpCG)5NpFRQ{NnbsbRC-<%G9K?S~-Vb_{WgO7FeMdGN`&DV9#OF_j zn6@27B^)I!j%)0on@G3(7`7q4O?5&1LS?a zSwwDbZtK=i(xxk|PdDJ-sG&jtActQCW}dF?G*7T|(2*caf)JT{52fEW?v3m9dG8k& zStfF302hFec_`ik1_ud4!x*&Er+OFC&(hK{%jBEvy{29MVVVZdXSgkThxIbFv<&Ty z&Zvgg4zp*SF1Bc=a400(5`-2Rb|iP z#v>YAt<`A2>u~Vpw|o0lC+XSW_@en&3WY}SG>1ze7omg8!wqt7R)kI%sHkmwoW$wV zyQ3vmPatE=Bwvlt^rB-g0~OfHF>IMGFPFQF(U)T!aGf z@1!#KH|uf&jCh?|5i)qF3yYeci(V=8lyl6V$al-$E<}o*T;H||5j^!3n96NCnM}MJ zoU0MHs5%M6P>qYmr1xbH^;jBhsBdk6FwZ(fVE9IYuoGxhfTPfyn^`U|x-J<%3Vf>{z_zttPppo-7Hu&@{rtug_dwNCxdJkJ2a1Z%?E zPgXmyNk~FbnQCD`1&$%?01tr>Q_F*GT?v$4v%|W7y&qUlA9<;1y<-=@Z~LuEsm+wh zuVIJ9KnT-0dc|ivIJ*-OX)+Y;z$ib7gmm!8O99F7x5V(YRbgu};oRl~wQf!%Z;)6W=${_}m9 zslnU1M=#4oUd|_?n{yCNsJ;;OM-$U3A#iebZMUA-4nW4LNxgnRklwJVv7Gm&l2-jT zlKM#MVk2e1iG)-m=Z8R%IefMB`>`eFG-r5RxSg0?Qd0M63ym<^o_!Z=>33pzab1>+0W18Ei9Y&&(#bg>OQ&j ze>1siu*5Z^3`+x*26-ZE^xz!NjFo|&-e&zTE4f0l5*Tf01G?no+F z_Af#woQlvo!6#wh`)PW9yv(|zd+~w11=+;Hh_wJ{Q?ze1iE*kuN!4!R^V;Hos(~f_g=3ht%eER1Q4FxQH$z*4gGrJl> z8#0eA|{E4wG1hr<9KH5UiFCr2bRt2%PdhNtXm7qTqP zcbNe#*$gR87V)_`Sd%Yhn3&j5G#LDtW7Z0o^v`lgP?|+YD*-ieag-3ehHV4o9Tq5no{DV4+;ofa!{kRM4WH}sL zO0Z=Vnm-dy@@Z-JoNf;AZi8DX6m;jZEObOhMCfkQa3_dC*dOM*q2~ZR5x`I;PQ_Ze zZBL?*$uHo2TO6!esAROkfLm`~ZRB>lpFu|aU=P10H1Zu~l>lqkw`;zf#aW7$DEb)V z(LE`BI^jh7Ys@0>!Q99_-@bn$25x&>v6k$ELm-rRL1fCNpjfSGfgK5~y9zXB=GCj4 zjRsYQoLAaIX6Ccs2M8E|2BzeyvqMq=K(WWe=bPgufA4z3jQL=B#SE%WftC435%H8c zV14o5hzk$>m>WUwkR7|yuB!`5q!Ahz^%uH>M$SU4ZweHe3J>*r{_!%wY+!w{@;%rhMQbkYpq({saGTi)XBmpa7 zr9y@LD`)`3HjuAgZ|XyA?uQ=bv{fx`bvTrA0Qv#&hg_T>X{nMeN3AQX$~N5TTKJVy zWz>n(Vk(md>rNd{lpn>^@M+v14+ZO3GsXyrU;h+G(%4EBAU?ll^2+JMu|(v)X}J6L zr4#FhZ(kv{VaC!oXzomK5Bi0%d0%MSv2*3^inzCTX7#49febdaf->@S8;gIhhnc1R0}gQL}p7c z#Kpy-4J@z-hXSrWD=+U8(?|k4((Uc-4bV0FE;cx>L;c089RZtW;-fb}B-92}($-&K zoQ4uPZ5!_HV#_yyChamWFYj!u9x9FFaXLwNYpSWKS%}RoU`raBsc;kq%S$(oMRj$@ z=)g3o7}kI6YGia})nZIV^@mo~0}?@9jr~{z(g-AEEEZYai#nZy&T%^Jipm#HOYp@s zFHk`ker~ZPT?$?G$k33aZ1Ll^!aIt+mz_Q52k4CJlzTkDLx0mz**xQ3iv}w2>Xy0q zud&b#Q=F%}F0O1`r94fCaB+S{$k~X9fQGeEC8j@?Q4}Ff^ zwSH{bji;jfN`wq7z?~j8lbXt1U-ow%Nh_o^imSVx6>4I8J)U%6$~h$uMhHIz z$|P~E?w7PkfZ^|`ZksF{nC;RJz@!eU2r?l|^L}x|3AiUKK*`YQgMexZC>+94uXGH*I;aRDtPyi;xSTb352zn0(~K;Q!xHskw#9 z%*Yt^SOmLVKgZ{G)iq74a3_9pm2|xIhLTc~$=JZCZ>3_!X!*&2FuF=D5etlzcA{_? zf3y4bgC0ZlQ8kM2kT9})uSQxJREF)DZSBtFb4kv3&T&d`9}NvRL9lFJBK(m!C&H`OF#+Uf-BnrM^tcs9?$7y33Y zS}UG;Q|xcH?d@>(PKVozEZkK}`MY0~?ZZsUs}GN%2{*GNj;;;QRkD0`07{5?K73%M zRQT_vM@4gUQY`;t#g8IGIr0@|x)ZUmhv0Wz1Qc|KYS%SPrm{Qg7`%95d3b-rH~CiZ z)CNFQDlSQpP4|Yi_Yvl^J0!gOa4W0)FPEC5(zzQlJ)Vswj-GI1+kb4zbE%p2k1qT$ z#{&xu$e_6h@2IF&%LkbFS8dpahljzY7W}amPtS>oN`q?@I7GBoVC)JmEQ}2`!e+6x zv1zLq5kh5VW}clcfe1GOOBhsldZNA$U90RW@}W zWIcr4+&JCb+~k(Lv(-|b$IseH%2Bwu9Jjr70y6FXV}BZ`%lK!8uY$Tdf^-%_OR)}( z)ep5wlLWM2%b8m7D`vI zW#x|z{MYS^Lo&Caqq>{ntB7CMK&4u*kpg{yZzUtplr1KmTbV zqmKH7SU+twgO=46s0^I({TUqD+1YDJzz$8=yS9yUZyFMW)2*x4{tc*RCaMY-qNcZq zb#@l0I`3A0V@FE$<$YMTwyNb;ZIij3ze(Fvk8jwVvH5QN>KvnFW{7PRRD~3}lKNLk zcBIB`AHuV$-7pJf2GMA2^NY+(@YHGXLJ%(P?ZJ*PB~|Rmra)<_5c;!I4G&xC0Mgq% zv>Uk(jk^$k;an%9R-x0e|1Oh_+#LOwg`#QIcg z47)8ErA(o_=)d_=JXSiXl2x|ClK5UM_N;GY^3So_!2n}aLS1IGos<-^(O|sy&W;HW z-EjuxtJ#hQhr{;6n&oidH>is1Eek4yVBb_lS1w>>Tt|Fp4U-eycgX&68(S1az-b%L zkf5ckPUTy(-UCvX{&~aQz2!VCJ>w_(>3@d^Wd72KR$&s9U>uA%3~De~aq26N2@DHw z&!5~kU{OD?>Rs_>+j-9x+{N?d!7?O?^@{{tuyj9*;h7lWfxSIzMsDrv?J#m*PBZRa zhLt6oGPWdcK|!1tW#xV@rrMje@6Z@>9UUPq%cZ{uo?e60c-&sl3HW@Q*(a%icx~N9 zBxgDU(jrvK!9}4ut3$#qIh$5e!kn2!QOf=u^XgbG)^I~`VUhLL2jy%V9r+}VYSY)( zmxVz$@D3v-wf70v`;fS}-M8wK4Meac+;Z(=h(UBdHq=1qgz#ylnr_AHC^YY6QN~hA>?#Xw^3(v> zhGw0Gbg-%2SlzIW9!^n}xE+@K=xxZ@T`@aFv#3|YP)j-u`_BS@Azxggiv7&texbFv z$<<7)3SZ~)=3fUA+`~r}UN$oB3(|1xwn#RXWOZfgYe%*Urh44tqGuSq{e+P;eqJMZ zrbB*|To8!bR01eHd2PGG;0I;o;0DyK#Oh^j6PBNCi`=k??kwh1h9*+;2+}rq=ID%@ z8ggA4n%;|bxV5W5+`XbYm`A_$&wgU1WVFH2>PtKeEEyS@DQ4ulnWg!M!==g6$*O41 z>3XMj`_XqM$ui}PfrF|FKI+k*Fi=op2^+Dob=k7GSz5^fBnixMsKi_rk!`Ax*v#-Z z_kCZ-D0q?+W5Y#!?*{($H481Bs7`@>M*U|46r$6TyEy92?rZBC2qX#)>IU1fvG4Cy z?!*wwdIh+Wh*$UaC@S0v^7Da*`fY`46(8f8o__QQi7#8PT{l=;#iDm3Uq`Osp#h)N zwg33&Zumi!0l3oxFmv=jJU5?d#WHEr!8NVjWO7vUSVh|ZndIw(u`MrmPZP4~A4v(( zDH~(^wTMSY_x%h})TY?t?H1(}op98fEkb-@dTa$_to35vq<@BQYH0#596KsAbZbq` zIf@C1eV?$G0x^C_me!!UEreOK@9IvNt?sU&LH>|tU-bAn={ae^NL*li2rQw0Z%U+~ z?P;`b!`j&NL+rJlub{lTzC?5h8Fd)?fTHQi>OZ*tn&RUz$Jstilz#m%-zOPMivJqxrf)w#tA@|jv{uu zU4UsJuX(keW!HV)Y!m-BC!e6jk8-d1RAdZ)!oLu3mj>{(KVboS89wTCveS&j> z439x+NwbRzUoLJWhXNXn@dc5>_BCL1PET#`RS$N}y>+OyIQfVu*B&NQ?V@zl!qAb< zB7e`@+D+~T&g?4d>wyAxI}=b)4NGlIxuoWTd|xgr#N9$!x7w(t#q%@9Dlk_cxU%5Y z%(>9+Z(?L+oNPD-VT58O%sw95kav8_QgjWhZ&_#e;su&Q8rr?|I?v;)h%QLnu(Bqp znduh+yhSH+odf}#RWhCJ*AKXzDVM89OE=@CK~Bf*#G?ZZn=dBQ0%SgFtfsPKJn0bd zzpBBgdp%@G9GQAE!iC`Jm;7keK56DP$M+HK{TC+IlPi95raJ<)ad!En%9mS%O~zo| zv6#_X9W67nq`SKyz@%xmx7_!OYBn0vpulvh^A_Q2yi|elTcu9YE;)fy_^YGEkRr{R z_nz`+lbitIMZQ5?xTs`!99*%w=a2taJ)#OgpbC~ULl>{3e)XKTl&JO7e~gs#j5qXw zg{w(4m))G}dU8otZ@aJc_&wz)FZ%18_K6kLO1dD;bF)+ca>y5S{%?%4&+dF+K=j@O-Zo_(6;)QZ@L4YDthhYE7Og^rWP$niPb-AXfQ=o18I98 zPXZ^ca8hz|l44@ggesu#x@8DF6th-^4;B|kUIlGcOxv2peD!J@5_$9=1B9~W{{GJl zkY+7e@(&ZFKp*nItcea!=M~2apgSW`_@vykP&rFT0k?3{Z;@rK)AFV&=Mg>htPR3M z{*$EzCnw?6X7+K?80Jzjq7zZo$%J|-$OBDHYdQ~=mU8^tKi6$XataMEoK;In$Y;V% z(a`>ryVWs9bg2bR+3*b#=4IX_{jg35PdXyuQ^0NdGPsoDF?~+obB*aKt+);~Dr6bB304uDt}yS{Y++N&l|exuArbE1m&|pkJ_HETu^Gg`q6x@62)w)@b(aBc3(mu zkjofGvGgeu4!zxfe+UF!IKF=Uy0MTA#mp_rN@{C)>MTBeLP5kNLkpAe1?>oLgo)Xk zn|4&@=-Ez?m(huUujK^-#rmt`iIw1^z`~$SkZ*J7ZI^%@Nl9D4s(%{JUcfT09C}3R z6=00<`}}q;X-qu;P`bUe`4Zw5SqC^&ImdOS%;x?0lvY`|d^tvqO#*NOzil_}iaYZk z(C}$~iWaOc*aDP`$MSFL!EBYZyb2_zT55%)mF5+SKq~CI#un+@Jy@tNn5F=vLv6KH z8yBXcqbHw;AJB&0pWp&~Q_SdSSXkhtqp|PYxK00F|H)PT^=2bC4GuY0K*H&E+m!sz zhvYr7*PX<4F1YORR;q4OBdLr46Cs3{nlFj%fl-?=<>Br_S@ zCr1{1*?w0(+YKqgTEVDq1<3z`VM=dGJwZMQ>yI7z!FX0tCRJ6{^|BtaDDNeeOtDI2 zT>=gP_LMF20fzUt_ zZ`x-8WBvNMJt3oaKiB7MSWOGo1F_HJ3chX_-*c|(D=g2zGdJP#Dswf~eLJ>lTP@xR z?>mkE*7L=bB6A%SK|yWzD1^sl&q(K#o>g$^exJicJi`~okOb8?tZ%~@fl=Bw=+@Ip zYB9U|phL8vr{OIe>rn+acottJv7^5&&LVqn1X^5t?bqmh3d1p{H54ow~SOqAIa}Xs`%qFW{qMFD>67;+CJq- z+NB^2;n5dP;{M9RlE7DsX)7G&hADmw__%G8tz;*O?T8uj;S@wruzEZ=RmBDNdUS5r zIGudN12BuHds1NGZ=$M6!A^LWl_0Z#R0ka$*H;}EbBL%w)uVMeG~<*@l2-ItVcJ0( zfD5NLlcGS;68ZSwbz9tn%t8gC`Gi~lUqm9O3cPJ(=NyL9_&1x<^U?0{iPWS3>B9j%Y)lSr)^ zS}4*A2!&jm+7~B2x}zopk}@CH18sN&zQ4rl6xY{LjH&kx|1-XO0-UwL^OFrk$+7s# zKf$)=XjP@&O_eabkOM1w+DjHw)BW&W{=^wo50STkH~i@SSavS0QKV9+Q=vn4ZqV7> zbqZhhJhgdnkgOjLjZB0?`nqwa@u#I!eoz|YmVqo2VsIDoh>IK3Yp+LMG_R^ms!0K9 zlt?DVR*+NB7;oBozO=RP#+gRjtz0Qt$tGD)FY#^|_QzEHYag;w@(ZF;zyyUWC1)U7 z=}g#<&Gj!?FnS2UDB9F8ZA{7h>%7gR4ZCTI%8+pkn+wDAss9s%Mc5INYqztL&h}%cu%_}yH5Y)7_6K4bDitnp! zo_k5r*Xw_3X*mza3Ccg;?J+@-*AHuQGNv5~5CLHv7aH^hJ`)`{)h71TR32>$dm$SI zGl>PYpM+i=^W>s3yBPLEdCo535(X_aSVTYYEBg#-pY{lqiXSm#3~%@Fa{jW`wtmWL zobJCbI!E)dvnJ8Hm+@i!f&7CB)}-1*w@CiUwZXL=iyNl?RMA=u-j%ZBq<$&1AsBNl zvGJY2@06dI!Cws>oKpWh#lP+Iu78iA5O`3ix5-TFbZN8kyiE=;k|vj~H;jzhMu+tc zb#3Y;9sSB?=?X$t;#kV?DwyQMzcx?snbn!tUB%NtU>j1R#n4PWBX*amLvdP5$%4@B zx0lqi1T<;H#Efcx4l0T>sMZVf>opMVP(y+vqbre6@frPwOgo+)krcGu?|x@feA84{ z_d5x+evOBhRi62(jCG6+>+txP#&>$zRsc%MHqz?MlF|G~`@(=Y&+u?YX5E57*lM zh@RWKE9_ssg^suYDyMLr*Sxr&J_yv{oI3Z1-K+cWegSj9fjeDa?ij`XYjyL(!iFh@&fnb6XXlFbJLF!1p&ja z;m=p$tVsoMnaZ-#F^|y0Y!|u{O-k#M=`{6>dU$ZssXEHeCMa7I-Re+!N3xx!m%zti90{}sp zR?AMjlGPHog<*lnqH1c$rqRo;*zfSv8&XsIw?F7hs~f$gqC#(B(DErPB&m{&Zkbq5 zEMS&QyIErM(o)c&^X?8>8O*{d)i~llcYre|B#*qEvV{>|f4DXUKp)wt(G0Hn$jfIVU$+5}zN5+w%6$aRW3cmSdoSZzyX2n4ffiEyi1A|9$HEED_Y()SyeZGT48xv8Kaqo)UnItttU{z9U~<8-FUHEmD|FQHq++xyJ;{Pgr=ZMjvMjDcAE zf{wwfkiu=T&E&2ywzciWO6R1(S9rj%_F5P>l9QB#Bo`=)NtTB@7IOqn;qWh`aNm=J z@#Nh9y;RoJh7f@{2EaNW-!;V-LHRwQ)O>tVM`H&M2_Kp&kioz6O|0YmQ55A%PS;ul6oy#i0Q*2Sy!{aUR`;P8kVvQTJfvE;AMqM_wYf?vScl2A4g2ikEtqjrey3?PH@U1nX zkeM6&6%Asav$Q4ARaLo6%jNngL{Ib#xYbl^?1ejR#N`CJc8k$J*2ErkTE%tb-xZDY z6dqt6=7o_}sfs&FZy~FR&J`yhIP^r{_SGH1Vusu0*K3g1vo$_){Yh+F0^ZG+{FdA2 z>FQ$~=F`iuu}BP@2V9Ku2X<_GR{O9;$^x-ybq9cBrBCv#CYFKD*^Iu}JfR~E9DfG| zh0QA36s8T-cGn4Oemh@)^nJqHVOlj;`YOZT_9KuFihM$T=_`_>s2Se(3AA+Wj`C%9 zW@?|q2b=P29Q>pg)SP4+v76(B{8s{u+V0z3(}~@wzDj&)C(*=7%`fWQ4BBV8na8w# zY*cqLy`&fvtR)5!@n^$xS-a7Hot6*jroWaj0fgE_unCM6%l~H*^@~?6<~PWGsfft$ zL9M3B(^G9yZrhIsjdzsSSiUT%l<&bY1o?0jAX%JGUN*}eiH?tkCf+lr(ZKD-{ap&d3dj-?uK^y3~W4fCCkTx_W=;NHp_bbcpf!&-qq{?-H z;{#xtcRmBe$+&H*lNc%27)mh1DbMrrs~TjgaLim|Cel7HOqZAq;x4U_zKGCF?PzNo zXPIB|^*mbi&V#fBh*Ug<5N{8+SD3}EZ2P+Y(onIT5>E~>Gc#COO#NJB1n6Ms-TH*K zUoVPy;{527KFR0dq?~2b{>ubXHEBPa2tFOiPqF*|`xd5#_Tqa9{~e2yDk1d-~z;%w`h=-~!(*=kp0Ke@XSG_0< zkI;m)wyj$flKmswsP@J_w8M>4)l$u3!mdgw%F`h%ooz9tj?99_Zoy5?)Ct&Sx8d@i zMGQKcVam$NI;5RfHw9Kq%-m`f45G8l@WU)X`(fkvjEo(_DGh)b%)25{(9-gOws(5G zW$nIdG&;c8uN_iE4DZ$9raej3gTJ<(3GJ-0Q*;Q~y>=O93hhlSr=#Cw7K2^InHWm? z6;_DW10=0ijO<0zCX;`PMfA5<3Y}We9X#Yd1E*zqLwCQeT69m}yQ3LDkH@t#=K+U_ zY3}sGLM@>}72@9x#~ofz?wiT0v%Ga|Smsq43LrNf$cLGj8gm~9?U>iIQA6SBind(aHue14?f*Q~jV{%ix&TYlw?Dxr(pK zkX%7WXz%MZmc{nDg}G_DE24E(iWSM5z1`s0LD4-s&yF_ZXX?0!>Ctc9-7=c29t$Q) zpbzF|CPz}lcq=FO1Vk zwejPhYjBynpf@XtcDc@;$e&$SGK(```Ugi+l@8(h`7*|(z=NvXgtw{16*>&}Od*R& zgNlD~)AvIG77ooKmN{Oy8D;(DbRh*f>T-{e*k_-+1GIQMHu>^3`~-Bj$`GS3T_B*e z3>p?(SlHg|j`S-gCFIT@G5(7L2oeW*^WG^9SLyZjh%z!NVv^#mvvvE%9903)qTi)H zeF8O9EPN#B?I%7_20Ex}nw0=XsEWI~IKZ>r?BpfL$sEP*R}1Ul-1EK(`ZVFazayrbG{b^4|2?9ACNd@x1Dqt8sXx==#YlTqw+q2& zr)~r@&#h*n5Iz<&bMMx5zi6;cFJ$S^Y~z(nV|R7ozZ@;CiyY!ZC-4$hk=ajYmw#@E zTPFl%JFM$+S{o#7->sBO8?U4`Saqz3z_C~!(B9nNukO(^cOY!bwUQq<;DDs<4A3-! zi`l=OI=r}u%gMk-E;MM=IdTUR8>_V0Xfr5-Qs}1 z=NKu#5;{3%srAn@b1jbjH`Aye;X($jp1&fR;97^coCps1r$z1T*bB8c@EmPY*W3>2 z-twR&Y-xZ;*pgvi#y}NzoLTZgu_SXks-)l06oRDwln|KPu^Bz*=r)&H|F14Jcx%U& z0yGx}+*ieJGukA@v|XgbzTsbDT(xgLVC9+NG6^2TW%YB9dD8hZ(17L@{D~@^#1#$d;#{^8AmVh?M zV&ZK+`UUI8Qu7g%DeYY?Iq?DL3KWHaQFgeS(88h59TO$XJ^M)etAaOFH~x^n#k=Yp zd|7P0#WKRV&dmoxLd_jrKd~M?u(f~fbV8|bi%FlG5Ea?38wwauc1bzcj0zk;2 zZ&T0M58n{c{VV*|IfSh#To8$3cep18Gcyc90rgpGRo_-QZs&_zoiXuWw{zAlWr?@8 z8}lc~1X;zqgkp#+3UdFU0p*T})`}JA)J=~S;%Pb+QrfoWdc&x$>?TzXX>dG)v*JL$ z2L8B?n>9#snD*=q9XT|k#XLN~hYmJ`}GVv+I2~k#Q`Ug2; z9M*rItmK^wXD{}~O4pezRlur#t~{-M&h#PCS;~SJ&qinM;oz_&i&|GE=8-)EeevQ5 z1P24QVnX{xYkNb;RmYYWw?(kstL-Umw6NVJLmY6QN&G(L1mv_eD;`{mRmDm)HgBqa zdGx@m{@zV#bVF}_x|dUYIQIjQ+~mgtx9ETT1Zi*j*qk7;*7vG6a|5atv(ssD4}nGv z+q0>JHbQHSd>;X;N_3!Qr14;8bL92^_BGh}3+^vk(edcHsQ8yA7}t_J>+JD6^!T^# z@xgt8%^*wNdsS8AllWes@_bq=UWxHt>88nR7@*E&6&s)rD|zvxOLX5%vgl ziV;mX7meYs`hpFVrtAlAY8mtQ7|)XHQJZApaJHcx$sUXQ1azJMSZU&vLteeeyk)tPRDgmEI}1{_j2(>^BrDaD~ zY2@$oieGS}k^HSbkk*p88~@GAqop(VZ|qa&X_xbl3Bw}SfUu5-Gp#B^;qAKng8$yX z2?ZZ_t;s(}8JX4CBhRG;iXqEE`XP2$+y7E->Iwg+6-4e3C4f1S+WJe~*x*k3*X>@o z(DL(#gIw;_t)%o~dpE>57Vtc7L*E47+r8vTs(aRX^HD-H(}5@Rp`qH7{cHI}6BSp! zSe{~@W}XO)^@C6%v#7aJ@+kk!4d}bTHwSvmi9bi{*1EVJGuCPr_5wEMHW-UTy-SU{ zQQ&-`>~g;E=x8M_<*FaH9On+167wp&zSfE z6{M){WB>}sp{ zR1^qZ^@43*$l3(AvN7Sl1#4O5B*`VD<&rMS?%h?^$=X%cki~kMT@Wz04tHjNlV56W63(~#KN>Y7jeEm22~v(Wv&y{EfB zhzRO;7mAYze zs68*4mSoI+F8@+pA!b$7UgyzjyrX-bFPjbvB0>3&W&B(7c>J}3W4^RB9|on3R5LiM zu8z|fhNcn+y^pz+ zL8u|A#aC(de<}>{CRfIotG_Ki0nYL<$X%GvEJQ%XadW%vEDC(Z6kRF#+NA`kfD z+g0D%og~bYo&K~)ZDntX0%dJG2L`T!g@~E7nUWb#V<-1H+?#A38H-s}FLq|y|L$un zDx!a`^rE7E6na{*KwwYvLa;?Z@Z^$R4P%wsk>Y_SNfv*D6G24;^q~~}C{Li3(r`TF zqAjEDPMWIT0FOU(ix;3}{Kj<0j-|dQ*Ni_Ps#`tQi+ZmQI{m=w>8M^~#Lri?8HtDK z_?j?709zZhuu#|6zU3%C(Kc-{MfSFawHkB#8HjxM(3o6|lkv$4s(Tgw-_EG5si3Cy)g{))`zJz| ztd{y}{R9CQk*rmj7ZVk{{{${K5bFI>!iR$>+>6HYs>;AwA zY-3k2fE|QadL&xf-_LvgrPzu81^LYjzHi%S87Z#Ka#IswajBN~N1xyDYdWOaonlQK;AMb@}+=us#Qp-@wwNaZ#MVnuJ9dJ<9d8{ znn;I}OJvcbsBGwla84hAlW8limLQb;bc2=As13HTG^YbLXDHCVNdaMJbEG8&0`|5d z6DRW=#bj=Vp0QCpfsU%da%yxIwVPcKyjEQ#CnrU_N9kW#D1Lm#!U6Dx7*jO0E4z^pU|s{iCYoR5}Aag3aq z%ttGEg&uNe8K+N~d3F9)-mlqk)u5mL_%YM+DKB(HcZclW-h0+`OZaQ5jgtgkLSY@Q zYVGYsLbPU~_e_z8i2$f2A(joZ{c|p;_XMo`pCWAuE_pcC?8sP#&{^2|noP4*=gHdI z{Ueo&2}Mq9pY~UqLAi7GHbWky>kS`ajK>a|mz_5rL>xd&qk!xQ$zL#vKEA(W!>4%a z4d@aa1#}c6!ald82=-}sX-m4JQ+t{0`SEyhJ-I6-PaE%lAp!|072V&M-r6#Ru}v`E z=nnLGlxNBq5z@4H{+f8y3yG)c8?1@>P|12x$*vt7NTQe}7=K`ID0APlTsy;I#!)y4o_5F#|9-g|F0bNYBM{^jbR((=z9L=n4zpTXJ0QA z&T_?!3#Kf5%hL=8N0f6w7ST^Xx9M)m`&Yj-t9bf{BgLUpTj*R^rPs27A#{DmCu1t} zbW+VKT|~6ZZ zxseYXd&2ZUeOTwTT0-dihO4)bspPl3BpP*T7Nwoe%&UBf@wyF)0SZD~qW+htU0hjd!`Dq4Am7~yc;(hP7g?4fN@01|y((vK?^nx* zhF8DPb+pko6Q$f14-`qH)=Vp!U}{KeeNQ014NsT;(0 zB-~=rDDWPD=+O!p{ZO6-$?Rxj=H#XBeStele}y+5Pi$$ee7l~cR-RcVKEes^;4w$V zndd5px%@utKgc8J8?N9`(S)ejIdSC$6PV??StK2iJ8+VWbL%GW-W%&3 z5m}|NgFaUfLA0@K!JVI;55GWT7tqt(&MAP=10=e(RPBdcU9lI02bgChMRf9<&nO<6 z=j;!bBwNpU>U>ynq-()JVPa3*w};G7&FKS#v%mEinpxi72wq+^%ym_IbHhm zj-na9IvShVFA#pRU04xPv_jsMVm+nw-tbP9>pbt29EguT6M(}e5QZjSkp}t?UKr*@vOgf$e;0lZ38toT#uv6^1ilu_%hp^pBb4~Y4!N#GONddu|aeXri|p8=E$`9nuBbho)WD@4<*{7(~A$A6%D6F5*xVd%r=)czNN{ znU}AE8v=4*KbJB^=QVu6Qp$gOebLI?`Pp9|w|4AkvT;qeT3q6(@@Zub2iGNsml|;) zMehs@bw|LQv;uWrA&T;~(tf=a_0(qWuAxqTLc+`Y3@^2lRE8Gk_V)>7#&=J8PSMQ; zPj$N3S5@!%IrK~vp6~CKNI>D(88=j_Zr9%UPl#&vS*WlGH^n{)?P*va9IH+1{3)zp zIIvoXI-&!S-g-A#<0+@`++2mq4IK}9Q|n_c`>)QQwE8xAqnkiWHb6E8)hyG(E=cQN z-DWtZ^|;Btu5M>kR(8pkefj3QJ5}o>fbH*W(DyH`^P}a?WZU59$*EkdG{mdx1cuFWr~@T1f$74>@)VeJxl zr_5Q!tJlIkt<7$_x;>4_MyWnWo4Hejn=Fo_lc8?8d0@))fsnrme2j7kcLb2itsnZ-G$W`Cga$<)Izuhy1^G3x$h5^V=8bkGv~iEj#zoAB5cyLi64PJ zIp07AX|#qWKltr?EdM%cptJv+!Rs&PG@Varf07)2-pfk)t^G!@4nk$uv%UR7Zd7bi z_IuWY1I8r4lMQ&ge)M6`3x9zqI}WAy1D|ZwK z47ZzLhI_>0Qmi0HlPBqa)vSpLO7s?&?1@C>kfG%Szx2jdPd?b57rZvyG3BnatG;o^3Dk{K>cu z?0R)tyJ_R3BP^XKoB?qZ3(5*0T>2ncK0U&t^->t$_T;vv0ytK(cN51e!6o0tFqsS% zj#_ZEePm`nYGi$O18DwAGwVKJd)uB`g(DH^LtE~>zsEKc4F^w5k~~PB$sxF+14qt& zknowY1sK$(ajS?^JimG4Jg;}b&I^-nn&@XGCMb_AQKHRy=2oah4rftfsJ^Zp1u5=X z{Dd=wB{sMTMb*z7f~Bz9*$zhxb-x%02R<&Bxww%2vHtt1P7`RSi=gyRJcZu*>KPrW zUWl z)iEWYKm5J7wx~CbU8-kCN3oQY+&x&CI!QJRTh=7ovrPpBs$4QfFA1YIrnQeGnLX%d{N?1DB05P_&V1y>S#8=ehK^i0sB(649Mz&dKImAxF7Y}AfgsT z2+_tjj$m7o(eW1RZIo$F1>fJ|$D$6F!T!#MS86Tz&8JUboJ!vM=)q6Jv@0EJx&-j- z0^LLA_ewZt^cWFY3~_xYgKRTD+yH4zhx;+|rk%h;=aa;g!@;qSmAaKPJ^ft{P=Hyv z%SHkL@4`0Oqvuyrk40RY)D01~#Ke5WsG*x*XOFdvuE^=;y}obUHOb~w(>DI(PRQVl zKU5L3z2Y3`@Xm-gs0aScU6CY)+>MDce@LjePj{#y`aTTQM@#h-rU*Ej0p_)#;^Q8t zE?FuZ4v~bs(+`dxKdJ>XL_~yr9P|I-W#!rE$WCoGtOo!^eb^JxvxdaRg=Mn>D1|=S zR5T`$aLEg|;#;(_|E0l}s){Qcn*xRL17#dtl`pf!=#0YxDdHI^g%JlCrpt4$Z7Q%qs+U01Y(u|Ik2t>kfg~AX8-?xsqGN{rE$nvH3pxvF!Y3 zzDjR{rbod1z3e)xt=dKmN;Q)6(VT{RQ_t1~3SJB}Pi`~3HX1hj6ur{jc^*$6(YzA! zL{6^3`p6o~neLC)tzB@7&dbjuUh6WDHK`Gn4h;RbN{3e^5&e%V(vBw88v2IYx(q2X z&41|~y!ZP6Odm`+NOp7m<_zE$3;;PVY^I2xw_aO?e~QUHbuUzz|IdBB|%9XrKKCTC#qVyK*Rh_?uYZ#TW_Sm+W5@^?$IUWR)ej0-W(X$9tW2$yFq1OA=jl1xfCVKSCN z1Q|5oaFl-z4wmd(K(lE1(~Jn%%XO4<_p{yStMgpFHV3B3Gh@fUYv@P#%%F)5`%I*l zk+#OpxYXd;fw^x}dkRo7;!lfnixfezv*uA3_hN^Q^8+-ywk8KotOYW7!dbWfrY{~u z1ke?}N)~rp*xfC#Jh%ebmHhx-;I__AeIVoe83#w?-RWo@cPb#=lh@yfHx@`T^|-ur zsRB6k#2JNzsFGnQAzyr;2*ENkGV;(K;GIL>mw>dw#{ln4H3Gn?VPs@ntehY% z2i>~+Fmm!001lGG=`AM!nt{lpct1a<6Wr(uyd?&N);F4**ogU(wOaKrMQy7HSWM z4kVxv=vwXQkfHj7x}{(uCuf;i0+;|jZW+cQ-T?ciE|71>>o2O`f!_zz=|^kXJa9){ z7;CwmjHv^ZU7~9{Q>B1vz=&zXbpLu%KNN5e+I=5I{e}Hk{}diNaTqbCx=y*d7Kr1T zwtu#IRKz0!Mj~qfi)L9ug|id(ez>S6=PeRRtK>t_B;^RZHJ|@3&mkT0xuAeArNFSC z006GhmQ;TLtK{$dZB**Jcl~+^``UO!uH3ICUM*A0H}{HAEUPBqeH451Ed}HuFjzzW zd(G|b(%4qgcaY(-^vzkx?k_N_=jZ1sdA@qzVyJ_|?}-AOm$6T^K7RBBK&JEn?x<{l z^K)Cr^+39sT{}K1$`>e5;khI4&KHY`p=y3#ca>6;KeMu{__zvw*`t0&AF(j@rknpz1Sr zmH&o60BBv;|Gn$AkcjF2$2Q%KU+V*(rbqodOMVu8QVUfosKpEoNyJy6xLAHMaJcz{ zZ~t-?w5Vw=l+-;pv)Qb(h*`#fjV}EcF>QQ?-xb0W1JgF5Vd4HIj~Vi+wz;azHz@6c zmw7git625e1+EuKRxYa-;jup^)ztnJAhqCZXtA4P?0^0d@Z4vBm}mu=R*{_>2vqAy zw^EL>0v#fJGb?s5d@nkOV~dcUj_+Q5-3?G3kVpvFl!TVqffSqv4ne%)X+?86Id5ho zis^Ri(~7o|{0=&N)V_W-u;|53v~ZQepO1AXFhV#;91ks4t?rZO<+1--N8TSeyZ_2F zu<~!3ZrbkBo*I6Xq1PYt5mSCAr%e6X@3$c?q`sWI=&k}~Rz)^jZO)$VERVq>p!jIo z-xi45-HkG$*_EFO5CyPDmMPnkr(bhwSM`ZJs!zl}{|XoAdp{qXHXRaQDcIGIIii2H zwDy|Wda~OS;68s_Q222|m=IQfh-wS+^&q_l3P>KU^D?IuSena`h^t4jOEhM0lZ?!Y zx~%H9`8nkPpot+r0EaZ+#Nep+Htdr2olmtHkv%_;c0-KgoS3zvk)d>&ijX^@F5nri z@n?FEX?a^6LL2%_4S@ePcJgVOG-;k)5$nohZ&m7kw?&RLHoATVRDiWTJ-`g}VzK!1 zyuByq&FGi-Q4U%-aOe>mT1ULL1*|p_z-O%NxZm2*s{Sh`ADD(}3#lgslypF}%%Ap_ zhsT&TD+hzm7#37=DGcmBT$1BNN93Hp-llQd$Zc{N-i)$lh-`@i5KLdq<$FB85&}2~ zkNKTjs#8ghh<0D6j|Ck13JWdBJ?D6%3=X~wAg$g?h240ot+=s94s%V0}l+&dpB59LgLKTTf%Zh~f0X}Zphs|0vzl>M;?FHCy*$H@$gbIu4FM4b}GU)jU6IP+T zjyP=#!pZkFK8664*uelXcD9J~^){r7P2b_28h|8v(CoGhV6ufT1AO2cv#uq!q}u9@ z@{sWKTG+XhD6dfo(4mpr4$+)fJtIIw8vWt0`NXt+wwNM5c*`MkTM3Bc0F)bdb%Ups zq`+O^yF7yMIUPtiGxhqeUn9?7cA8QBdb{3d8)er$$ZP-;jzNt;ZyyNDW#e22034DbSy*ZQO}+`1t)6N^_tmSSX(m}--X|DVO0{wT?Bp%bZg$|XkkF#n z28qA55%FX=)>g0+v&}QUTa0=C`*)LAL~U=ZsjQ!LKE^nNYf0dTqbzSpT}e))goCjW zI?f^wJzK`;ZLlz}y$&u6L2S#$z6JgRWH4aLxQ$r}!~>{2P%KL2e!?SnD3n}DL~vbJ z8}WeaNy3SjmOZly-s=)i-u3@E3r7fI0Ej35?ri{s!CYZu$f~f_6gt5BWpaUN{XLN@ zCS}J-neljQNvi1Jq$`zjbuIVwgK^9bmHz~@@9nz+8ms@lZL35fea~ZS)`!gq;Kcgz ziYo$O;{-I9pAW7V+b0&sUo(%fBma6T2- z<-egAUk^gV+}W>g0am249+7T@z`)UWj1yInsUb{q-(c1Vr}G+`QD6-)rRj_DeZxix zTGRmuOUH!|Mh;e-M*x{wPH`(49t1~_q8?HDU131~h>eoa6CrQ8R+5_9$n$Cp#Q0b|#CL4H7Hf2|!c?E{u-?OKYFkPQ5f9S#EQf zZPpdeJY#Yp{b};>?c3}#@tkY;m6;6vgC8%7h~XdxX+Fo@S)1LiK3jw>{6@?Mea(_5 zol)^zO|^WTxCC}!{K*oL1wTR;-$$MVU!Kb-@FA~G{i!Io`TGQb3;rcB${)l!|7plrdJN7QdaS%W)Xj5IKNIqMM& z^|xVg4-r3A%SO4JJGml-eZ3uQzRC3ZJap5lHkZh8U>I#FeB_7}j*AAW#V-qu{1KVeF z{^94&eS%KHNAr-|1#73z@)TJc2e=~2i6Ct-m*^j%?LBMZP5qm$_;ur!g(AuK|Nrc#rQaH&k1t9$=^I{ z65AHY+GtLCNUQdW~Vn1bR%p&L-^G6srbjBANPQEy_MuV z8|JmtgGMB75*s>|hf3_hYDj>}U@>0j)skalP@NjZwDvvW8Ij{k_H{PHH@t!=|sER)~wl?;!+sDORG76uvJX}Ye z*C=i)jj}RyPDP^%)aD$-k_+K*)G3)1%&dX1(RJ4m{T=!?j1Y(Ja6!!Fv$d@|iB=uQ zC4KFoLT%W2BG=|}my)P&X(Nn4$VlUxjw?Nc-(K)^73Qa=Ri+KeYn63$NE?|BkW9W7 zp7q2$Mm6$2u^(C@3eyGB{|#TumXZ-lfKz4yGcnta4Y{>l@UpPF}x zhz^=zFc)0<1mb+Pvfhy*Ea?-4vNr0tC0Ec8KvGtmj*xB$zy+MMAYCYFNrF&>{(Zk8e2;-|~od!E= znh0(qh}7*^SXiWZqfPnR0U_{705qNX6CBn~gBC_=yPEYGX!9u8;gL~9w=At@w7%*k z9%R2mI@kP#%VDW7LrDEI*d+dNXuGT;#SB40$9rkBBDa9I$2q~~k}iJX4cQ8Yc1h5p zsgv-z+=UpKYBHRd0{yeCY;+bfptj*)E%SIAD-<=OQCTq8~wZC_!X8iLM|F4(+-Lt|5*N3~rK>L65+y!Ra9B$o1mX z%r=3O0o!DqXGwTL&G(gbst$V}kPLBjl4?jvMLUWX;=Vs!OG`;>7FZp4xUuY^)F;;z zwDMu*5mTB7DKHZRoQZ2zMRkAf7ShiF$l-oNqXOqLnsrmZ_pd&@!EF#iia)_QsHGl~ z^|=S6$f#sp{4uj?zKXneo|1Wgd?2KN!j~I##L(>LC%sUevgmJpw4w`u=`k=Sbuls3 z2;-FW77N{Almu>DsQ6a2-G_<3WW-e=m9zi^^{&PBy!=bS*hcwBV-t&oeh$kw5wb(m zJjd|-OJ}Dg(m$jJEt7xz4`@2r+<%CF1zy1r8Na=QuHk3Ks83`mnfeozHO&06JsA7Sdso% zx1)EzDF3YPuq7CkATO)u77W=MB-vf|gNG#hu76~0LA18Ca1A|f2Id@GuBg>EP-A0} z!_n^Hi(4;u?(kGc(&*B6K@ZJ+(_i>hO3DjQ$$*3eTstrj=wjcUnt*E|uI+zhSb4TT z$kQwylSJ!z^^ti&|68d7U>?f?gSWfdsG9r%zF04Mwtc@M5iau{T8oUF32h%E;L~3^ zkUCWFqv65b<>ahT^EWBdy&L0Spiz5aCDq$b_yYGmov)-Mt zNU*kK|Gm`9w+B+>BtyZy9J!svvvT!1)=AE;B4KHT_1f>7K}Ij&i9NhxS;wZ5tahIrIV>N6rG&(K;Nc>Y6zzi)uRw082x^r^s( zRbE@O?~8~UWZ&)DH_?qjyKWKp7?!IV zBowxU+mZzq|W)X7quX!4ASFLE^JMD(7FevlZiwGYcEj z3Z&i6zZzz`hd9t~JvPpZmPng*#sHRx!xMz;svm2KzdyFNIW&vh3-1NBbwl0Vi?ytr z)b`V@e*V50x_2a~w*kkU{?-z0K9~FA-+MlUbw)PGkT`Ao1!9nf6{VC<|2M%NGOCM1;=9A31tKVTsi!V6&%4(BO@XWF_t*V?V z1F8Bb4socS3C0U7#j8sIlWeVdP&#r+#V1ob29mq@L7ke%x~BwKNl4}fZf9|0+^npE zxv)+G^-+g*XPXR z5_cBG-Ti-cy5FUwp?;vGrZ$rxWmmghddH$cIHf!i5C%2;29%po1B&Wg4k=Tvsl{;& z&YZwF7PgnLt&V2CHl)O$-1T!WYut$K>)(MyZGeA6%uHn!RM@EFX8KA4 zt-m?=mX=0b+$@I1Uo`BluV%IiI*h{^(l>2)tAz&K=e}r6KS}s^H2&b4oV>Ny$Ag~EII{@oR z^Ie1Av>&B?)MBm{cxZ6a1PaIYwp-DM6vN zsIs!Ml>B@G3K5Y(XXRavAyapYy^U1(kK67_5z_jlY%+Nbn&3!XAa~N#IJ(5-wEChy zR|mZAIvWWIAuKDeNb7f%UH$hE>gn_PSfIbO;EP(1_;?zCc>Gwz^SbK{^I{02Xy`^d zwbk`q7#HrLR>Kp!p2~Yi84GF1O1egtziQOj)`k68x9jW3=e!1q&K9*c%?b^_&8*rB zs!y)6FNPx2*REbP#@`~x4t?kZ6wbfJgb0G)lWYhAt(DI4*YXX_f*P9BE|0#iI%XX| z&IXnT!W4E0;VGQ2nLPEjZgj#t?6R_eXeMQ+c$o61RK>3YtBk_LK`na z%KpnlXx;4t?M_x2xlTz}98O7Bfqr_?{d?o-NeF_Pf;&+RRJhY9aI*#wXE%jRK=1TY zU|!4(4FLoMAg8L@?Z1{ea9JfycUAv5`AdF&M?c*wyNiRvlBT82=Gng<0pQI z^GzTSufX>cH?ZG$u=Lotf{{6y;5 zlP-aTg4?#?U<5IJ4b>FU(wY-z$5>wS6H5^hRv>n8tn633on&B|p%J;R8Lg#>qEV** zzLApj7xP9Z9ps0h@H){QKsH=dId9A!cXSw2h$GD&@bJ(Qlm9tRYsf0S=ZP&X~tD z1%+`Fp$oy$P(OkdFyAErAY6V^oXa*TitaR~>#@bJ7^KONmPIMk9!GynRcQ@BG?vAZi#N3I4 z;I$s2qH-`+)M63sMl~ECDq>bmxG9Wahqg8@9FAgNmfkSlwDM7)Dcmnxll24ZCMxz0 znXl%V8UgI#!3Gf61VFK~E2BwQ)8&a&r#H5u*e!Z)r-qeSENO<( zkmOsJAE0mQeq2W8oXD-&d-jH+mL=TT?GYgZ4)yPfLMzoK5(MV;c=ovvL1iiML_RK{O4r=umwrB!E_{~31s0T@EyJy>;`JIK3 z2VE{{{o+EAXeD0>)C;TQJZrL>&-d3heRwYs^6r0?c2bp_Q;;5E_+2=zcA&sL2u^@ z(k}hzD=IUzIienQ8Vwi1XiDO6QZ z>sn|KbPW^;r`mhUvh+=rgl+o1XWvEy+WjFKzKw?Q3Btpg(HArQ)s(B+IOr9guImH# zx@l2Tl1`mAtAT00ZLeqNd&WikUmp+L>?MByagb|R^)x6-jWN_z@WGHSRSNOGNc65X z{!;%X%$@diaN$C`KFK~%dI>&VS$SkdKz8wK_`NqWuV@owL;jN=_Rtsk48qpvB9CRt@lnAWp*MJrtGiQYNWeREsh7T z;PRF#0Xt&$T@r4T{=vobUZs7qUms4SauD@$@-&R^+y1!MC5GKXUDuLCi) z+-Fm@+yc3@#(eNJc4ML*Px(o!2hDTINq)m8fyGa+-oWXnm%3c)w97vh)_|*Q#CkAD zNmLpzE{RITm&5l??(-%aNfO))a44DfaE0Nr@$w(%Bks&r zg49&TeI;rF_)qzB#1R&KB8WzRFlbhus1JZqhZ8oZ?ks0Q`cVBaa$Dm9DI*UJe@oe~ z6E6Qr!&h{PiE)nnho^jppDQ)Pp^&W?cngakNBNdrq?yTiDC0Lgc&X~QoLJ;Se{DvV zxy4@oVGT#uTIoY}jQ796_!u`hT~W=#dEjFDDe3Ai@yApL4%pJV)_E)4@G`SjUHw7Fi?S&K+X~!XzB@F<&N!!PJ=} zxcNVYV@?ev*RMt|9RKdpGlJZs@bRjit2p}U^>G##<1)?>k4z@g8L#pBEILdG^74&6 zON2%zTt?$czE3W}TVuI&L1+%EQ;em}l_hegMumeJ+lc*uvgAjzs6D&18QK zolDML_p{HxFM>OMz56B~j5jO*=~UC6_itx&Tp}wxc{_9S zqTwL8Ua)k-{Ctz;vFS%4cl2E0(yCZR<+D;QH_KccQNu<$$GXA_dtzz{>M1;OW{Hct z=ZzJ_IctQY9!-wzDuuIH3*DXIMgI~y7Wff?S+z(o8 zW^}5#KCVZm?d5mXUnvaSj4q!qRZN|uyi}m89h6VR>nZRilHW`{KcYqL(?Xy+I&bzm z6T-;*;vCf`j^dcrPhV5LS-O`0slY?UgVT8ZX)n(#qLRM1&i%*dKvnAQ_>xVGpd zI=N$e3VP7XRUgn-)qOs@#jx-mJ;L8tme_gj95eROcX+nGYj?j)fnW6L`ek$L*eR`h z%ouYi_EhG~)Y;fbpCeY|RR__2jm7$YQm5{4nK6&U4Qwf^QR7F9v2lqP->uC-qRb$k zcM^v`YXRZcIA{8zsW~(|8?;|UJQJw4*aaskH>byKH%YNQ@SSSv}r`&(2p^p}K zQ(#v@o}i?w7w!^Ag@VEcp=5t=HYUfh)blItEJXNLS=f1fW_TfQ#VX`@2Slk4*x-tL|A;^d-J9 z|Bh?zy7m+*lf0=tbSm-hJ~r`x!TH=PIyyT4jzulbemmP7<{yaycGSN!XJ~;{Ecxk` z9CiasC3H6u8O@j-JNNI#zM{}w`(2k|GT;9m*oo9k1KzK{Z3vm?csEA!)&IL2|I@J{2%FgQ zZ`7@U1T+Hai3q61UqBVWPMsO|X?b{a>pBM-bwB~@S;_xA;=k#5DTP0UVQsuFy|S+J zNC83Wgc+M7C4`SgkviQoKqIw(sCwZt& z*bV%J<}aR~;y0GOx8r!tSZKzpL@7rBULGf44Yk3Z0B(F%(>52eQar>+-lhz>aV ztkT5HvZCGw@}w2a+4*h|1!q9h;tZ;uIRzax;)`TFD1eSDg=!Xt~x zs&=emg!$h3WEExIVNZP32lb%Zy(EvpL1H%qI(D$ec<(NO%e{L(*0zqV$*5!8hfB+L zG^|Q--`n@NCNA<+*<^y{JW5OX0MwF$?P!!q%L(Tk;Z)(_q1<)l6rs@f2M-Peqmq71 zAhc2-Ll)w{3L6hN0pi4d0oJdJ(Dz&#EdN#tz&rAX=i=*K_v6;RMcd??N7V6g3u{{e zIXPSO8k>WQ`hwBW29b4dZ>;4)u0~$~*gmfArw7T81E!Ml~Z@ zr3a|tNdNmpt!1VW3rkC$mGZut#b&|XeEE~Ld#@aU5U+;ua%TRVkVQ~8)YLjed*i@01`QZ=r%$F$X1H1P+~Y+br`6( z@m#Tj!7yPwonV_Rpe0R)oxJT_FDfEt*Dk^6e#dNaB)CXm>sqll85|R1;#y?X`gH1~ zty|@M8-Yr_iU}k3lR&SM^^YlslYF79sC*x9I)OkhuI|F)qoeP^&X*B(ni;_cVr;7U zWALLGp7gTL`epITSh$zINblhemG=DJ;$mv(*{;Za3N?zl(@POb9wvI&)yy`fxTvZ` z*69uBix(X~4Rc*wL*U6=gZQu>*N)XA?xOtyzJ5m7ozy zyROWvvR^B4J!Y|uTNQuS-bn(A|Yej{xTVe=B?2^be`|_)_VI+2nD5)?rQw#UECBf@P23MRc_)1Du)u;9Cy2(E{ zDgi?!c{Me{1X;;WYwtvb&^)9Cpv8sMbV}ovn7r1RnfC}a6O6q9F!Uf^=LTPqrOC)J zsm;sQcsW@DtyDwz=8e0oENjDQBy9ZTWh_ysJX>M*;K`4OtbxaSbwbwYqhuD^b>_we zPsK_rcy!~rhHaCl^}+%PL2^kRKnjBs-;eVy3S?%$+pu2^8zw@48cMVTy=V% zFr}qRD?X9)V-Rs>zm39K{xV>H9`bJJqvvdTsHp#9tA5eO&FXm{UUFMj5)2z}UNa57 zE4T)@;RTMWFcCKc6Utz4;KPVom-XNCv7Gj!Z)e5Ku~8RzTmT;dcs-om4k1=5Z%w!r z4k4rypH6K3sG{=0z(zx7=1JmL<9U9%&Cb$&gv3oaw)MB{PzzS&CQ|2T#&`|bUJwDg+V7gKCczku=Mkx+l`;ZIS6UTsYZ5&%6m(5texZrJ`LF# z&aAF>7IZll458~CM3g8sxHpKMYT_2uOLPtw5QzzDPO!q5+n;7kmO~j(+Y)H7PPFMM z@?^WbuIBP`SDytpFhJQnWG1@dT;s-dCaag%;C}U<>$drH6a#GQo0ubzbn8=UY(c0QdM_y_HQUfJcTzc708hPqwJ^1bLaP~KANu_Co9t!2cef0$pfdpcQ zR&$;7P<3>16oa#CwK6}jfC^MU=%yIu_4K^xm*bU34(U_HnLo*ToB4B-g3Cesr)`}A zXT%xcS3c_!cW^VTX*j>Q+Oq1jSl%?<9MEgk*I!uPo?91q$D>g2(!S5)4Jv;p5!t4D z1v+u)sh<)uE?;-Hw=XwR(KrPd7>FOzdcTY4*cPQT0w)^PJW}(a+1!mZ@T$+RBDpM#kU0 zV=i0RtwMzCK#)$fhV?&J4JX%+oG)CMSRX%bIt_V0Q(Spor7n7P95GpYb_cb;-k4rJ zl_L$&v%*w5VotvKuGhM-w-*YB?T!fAuCcqHY$LW2C9b{+3L?%fPFq*N2E*yA2mG6* z+-HQ>jekI&?nKR(!az8SwP*xvVIFE^cDF1o?I9OxBg^IDSdvIwH=YzYbD4%ucP19g zW@oid4k3SBqobmx*1lsuG5xjYdgkXMREEVw6=mA}^Rv^1RiU|HM6MY^v+R+NkFytjUK=CG{d|-?}^#LViDDXA{$KS++p*9t^##^PW`KbX*?wfcQkyUM~f~w34)tRc|RAoOl z)JQTqB!9*s*5b;xO0X6Hm!n0XD$!ZJ)}vSF(?>;G$m!^LNc=s~oTZ=$)M`8+#*|P9?NqvP#o!9a84sTsn@QuL*v7{PgL;&l?8=*j``k z$o{Yu`nP2HyJl72){q}RhV_zG#}!M&uTCq}H7~(Q05w_*8`=pkR)dwq=rljC4g-C$ zjOIByb$eQfPsb|R(_J5GI3xR{jrj#HE&6nh!s_xS?1w)#wJngYHi!RryXOFK94Bd? zYFCH1j7Cy;e-EGhd|#$>*(kACi@4~p57k%rr>xqQkLMvW8yVt3nlO={d2ABAt|eLR zX`vaE6f~rU@ypXZXT!li88cSh^=t|kiN^Cf+YXkk(Kn7W+P9g}K*V9wrg}orQpDik za9FVeHpTmh5tuw|EoL! z9|R=-f4=!^b6`(TPY=$Hdi(ox&%6g`4mdTP{&(|@bVqB1>I}1P|0U$|s@S>oq>{P2 z=1@gl9bYL>nn5#P6?nf>Ya1>96T|T89$V9{U0V96URMVo)M2x-X0cJ+B7NO9>|Bp$ z|6}zKs7|QdStGvXfBJtkNh~1E=6`GdAK$boJipWH7TMF&qpYF=q+giZ+1aHO7r&d3 z_y7z8%$>*!K!_RcHkQA^hw@t3kxgrumc`(smE>(>X3K9s>W@Ez5@9 z)vyNM-dD!esd?2?F8xynX1we9Of!$Ktji1RQ6lg58lMVv0F2I;RcGdZd-t*k+jiIf z|5oDD>hlQzEbz-WFkW6IT{KFvtG~B%jbkP};pcrKBBGgGFfJ}`xVtDRv&zrKrD0gG z25uXhTA`%P@co@RN8;k*App0S!p0W9yz+++00eKz4)1m;{aQO)cLcCV(>-|bt>QU& zMa+Bx@&<@iIPA`PjSeyQ*MKbw9l8gEvIutf){WzbSKEG!oL_Lc2M!MEN=bRoWMW)g zQ1tPFmb5JCr>AE~=*i8X8QZTobc(SfBR@}8vk}nm((j)hbj<9r4?`wP>~TE3yzJ&% zWrs;_TfGwZo@OLPE+`!vH3&zfR+^Y+IXDGkk&~S6(wRDoXEa z;N_E$x3Bb7_<-t`jG3@V`-jh;zne^~P&!**NM)uJ=wnD+^LldB)t`)q7f8$?F z44amge$w~WChR1L-Xtba7B*fnN%N>h6id~1JD^Zve0o-Dkx;HjX?b}VuRZQoJim!> zBOoHGf090(ft)Igg^!Gk2&^6s7_2wV^x^@2hl=M6KO>0n5SnTCMuKT7nT8E!qoPy+ zlj=>x#Z0kft5I7gLFdKMJrffPsiq>m3P)|aEB9JK5%VMlU{fL^*-DLVlt!Y2*1o-c zYaLpLh<5{v|6k0#cT`jDy6$a7ks>I9NE3ko(t8J`cLb$(=_QoV2}Pv}NbgmtD!l~) z1Vp5F5D)@Eqy`8`ON0QP3BK>zYwf+x9%p}Jd}o~b2Ser<$slpgXFm6J|E}vsq4b5? zOwHkVJ-1_Z6Lh-y8xAh34OmW(SXMLwdh`CkG1p<{@ROq*Vz9ZG*1|8JmDN=z=pRkQ zG_E}tT2#zduh4rlF{=W80hkIF_Wu2K^&Eck1#(Lx=l#9Cj%FfCtL@W}>x87A`EHA< zs`U*Fbv+Lu%tkhB3%_ipe+jw*M%8E#Wk--QjFTk1SXx;RKcH#2&&eqtg8t=h#XA$K z%+B1em@DdM6x}iQgfg1d(P@K^)4~8JUc}4M|2jIlGY0*%j_hH7@~2ww6OhLfRWdrd z4@e!~ch_IPCbXTafJwayclI+CrF`MDsos$-hGPP@r?jHJ-&$Nl9U3cM!JeUQnt@3; zXXD|{g1m7Kp6klv!b$OtLEGOF!td73>AbDKrX?1?ynILM)q7{CUAMx3-*;(~&6dcf zCVvu`0~DJpT^b|;`LtTC zNI{m;y(!GvENfRZd!haM0T%oo#op`nRBlCbdq9k6^)RP|D6?|q_W+*-yt3Btr=Q>M zK701;z<0jds(TQt@EoW%ztz|@69o2lB<8WW>gi8eY-LZU^9FIYAQ1Hh2OT$uN3CvA ziI@lAtl!5e)p8rE=EU~?IF#`% z`ZN~2+=wtkQI;9cdkqww&<&f?3hcR{T1?Yem`cF>-MshjU&zQ{9oU&I&b#cFmtBzH z)wh_rKC=Z@5e%k+$SPGtd5Z);g~ZqdXO`=QhF{4VUT4R|zwwLa*4Wz`h8E58^nSaVLCpi>R7{Hher-CpG9?Gy;NT` zZMPcUlceG{a@-)q6i*x|G59^{XpJD8ycJ$}iRTU1J5AYl6h+G~DAJPGPsJ!-6gA)? z$#;NuzI;&oRnsnWvmg@SKJ6@gy;%Rf$r}9-h{Hv1MHm74uU8OewH@n1??K+ z)5BNN9+9C>&@s(`+`~nT3Z9?)iN*52Y#?=QYrdWU`puk445A)%_e=8-xbbN!5z1xT zR!C+)oI8dzz7aPpd2*#IMrGnb&K0N_`~95AA~F%&OT6H)3iNt!%~K8fR;Mn(&6)aZ zz^ud0wXYPS5)uXV^}0&0AOU$4ufi(hZmtXm6T8?RnwgOS2@Ml$v+h6c*?L0+gay)`PzGX&^;q&CR3bieK`1- z95JQ`tMoAzbJ>2Mz+Q}**-!7En2TNIUW(Vs6?`n=56!UhYn#q%X$iorNm(A>#e{Ox zjVv!cQBo@5mW%4ff)hOGcHs#OVoLY(;DPv?mR&LI_I!A*Jkvv(^%EaZ-XF%ODJVn= zhvmL7KO*%)P5pYxrJ_(-J61cA{F?)<-PniwefsFfPGE;oi^ccwJicm{M}gR|RX)ql z1{fP+uQ=aCEj~`)!ge00{P^9KPpG-ncomoVp;<$yL zQ>{xSap!Rd!!b?kUU_AE=Y#^yPPDo2mi!LR0|)${$jyCXnRMW7T%KjqBY!4Qn$ z_#M;L)wP9BBc;^uLyWb5)2u1+e3+dr;Kz)~<=1r$sDpT9rPr`SM z>XJ#jZ;cgwZ}CEUBOW|c3`~3lHs4Ot?AVp|({gij^HEIJ?0Wh5;;*U7U_+(a#MrN< z7^6}-V>PoB@}{F&8>e9}WbbK1)*@PYx1wx*vtlL4Z%%T8qtM2hlhw`+v$M6tc~uRW zMccz~Iv@>Lh@DoqPba~4dFC^)i8`o~U3Ubli2ooDm}eZrkqW#lnTwiSy}181Is0rA zw9z4}(x6_k@=NMy!d@Dm7WorZHV#2{*=49CYA<_Cc1J(xg<>O_t5$3U~fT!orMnS zUr^hgPbr;T@KvOYQd9l;J*3u4lm+4AYSv0=w*1iueX{QKY70F+J%iT^f0(#XYrVz_ ze_r2`uM-iO$nj$N7J9B3mx=SVm+RH7)e)Mn0bf&$Rqe{Gr#Xl+W$)@Edv?oSDFYq5 zk!;rHH0k_k>oDN!vnh*}GW1NdQTX@7Qb(KXtZ40KuTn!>)f&BZIx(}0oVZ(9!Hb%* z8@nkCYhb({-gX)V1;tzNALL4K#QM4! zbl8SHU2KJny$L*Dja(|{b)IQ4t+YtdjVcT32&{29xUwH{t zR^~5@CoCME)HQ=V0Y`?Wt(#V2Nd2{3J3F)^KcVyIh0mu!<&I9GHZ7-+lom=n+IH|C4^$tlOz?_aoB zzt{xi6M37Y4YYx?#0YEy$27;HQK!@i;CN%D>B_3Gkm~Fj$*-@tvO5tpi%qwQjD5u;X^y~0&O}HmzH7tx}#lur4 z4&fY4e8|a~xg`1N)zxhuy5PNr#r5_4oS!yxI`L+%GZQ=8&fj>0P0zyU05-g>JsS!& zzqtAJo3+sNYJNo({DX=}j7xU51z?-Kn0$WQtZ9On?t$kMiVLXGx*3=4|Fx24!WAFX z8SGb6pq^XhJA2IfSzEKS(}#zJ%@h*{LS~nR)geOrvtl^3N-9Yf><3&+63`l%l}Ev2@C7|dG;kwI4U@+Cxc_T&qP9bkytqJdF(Ar)VAt5xVghR z`-xm!T-+d#Cdl9Fihb3+$bYm;Exe?zT997+OEdcGGYHC8{g=k)e?2pse5qMU}9`0U$C){F`zR7dQ7|Ph92F_A8<= zdl%SD@vL~w5bDr8*SsHQvT+=u?c}trYuG_jLk$ubVr%t&8*O zkCf6WMllCqsHsHcw{P~&$W|gaeARvTD>X1_-12LWHNvpk)CJ{7E1ex18Y+rR=HAV% z-w=LRQ9&xLx~o4o^HC_-u_s8dw~fZ z`R4Uxcg=9@aM+cDhWS9P2C)8&88a*Ex<)3=y?bX3%EeM|J|p}K zIibC?W7k+wsV7ZMjphRu78T_7KAILNZ?EtbOJ$Yo_{`$25tN%k6ki_KY zKR;d<2_A7yvfee-_0nh)v;L==pHuM4#6-OTY<4O0qht0k&xjv%^Y=_Avr|8~iTs9rdIFHMM?n5lMofp{aS9);154*fT}kWE(wwU?`oGbJ>-L zr?I(t!-Mfqs+*I8nYpmrFCMjtSzp9}vt)kN?A^T5jY(_U!$?$M1Ykf%D>61}6BUe~ z{}M)|FvAGc8DRyeJ)|kx6%9FZ+-o&)K%QNBYeRzHJSvwsKXCQ=*z{hTGPzLku}t>a zvn$1#8IeCDdAV|rGUE5PUUhzJ{(WEeRfyZBFTt78LHgx+M_2i`*1!hB*@NqX?_Bp% z!A9RDJ%6RUL|&l+IxA)KjaMx#8SNb$I?uEY|9v(tW{Hg7Ip<=>E{n;%w=fue$E9$u z%BMGKYqA>~4F=Ms7369-fnS}bT=}mR$%lkEtGzqCl$V}vF^O?RGTFb4jE();9edS+ zaL{9AHtwr7)8Iu>XOu{O^II2vrbH};7L1inC*?m>Ik-bT*_Fd{)!)IES(O1ZTQ0(D{hAiz1t(mh>!4pxeqYS${1{*mZnamEfd%!K5SrW;eA=j@`;mEu_5DX}RfIBD%Z2zs)e8VUxBLQQS(rxa5`2cQyPru1jJt=}_4L#DEMB|&AjX~YF zL1PZaFuSyArQYp#wthez{b|&y+Z}6?8&nLCBOh2*S`aPJY@eTdd!13bP6v&BVz`#;wLzz12{356Ix`DmUiU2ddrn5{5YbZ^{I*1Kd2>mgTK`Yh0&{)|K zez;f}4AqD;_r@9m97iT*rchyaa#C1I=E0KVWy3aF{poJ+aa-4x>bFp6AunnQ+tA?i z{rdvbQAYBf3?x=bnku&YV}AZeyz6~SdC8#+;k0EHq@bXn#oi=c6X!I;Akv9&s`q%J)G6k(0<*P-dtfc$-`>*kBZtVI0_`)ugwx4;JEdhJu`Kcp)73{>Qpo(HkT4z~A?_)6ryp9|F+Ve9;~cxd(Vr>ol}L!N6TGhc zDV{zJD7rvj^&G8o`OJq{Jp0q!*h!I7?B@I1&912gp<&UfGya}U3oQ;K|IlULfkssC zI|<;~A8SNa>m;XM)-lofh+j1T+J&gG%gFJLr_u5*I?*VP~D3#mYSto=d?_5&| z1krHLu(`&C>U$K03DHq%UOBoG6LZ&w%r2y2f&uKr%e?S?^L(fbVZ*H+mL)(mDmZJc zsn1BTu{}Ymy{f5Opx9$f__T>$uza;>3AD!*QW^1V7(?4hCPtYq+RKE@kmrx0HfsX^ z+|8F2Y7&>yfK0eSm%~*eK_cuB<1Ja1DP={Z9shg`_0u}uMkr32i?_FKXHlu3a|r~k z7$vQ%=7R~DuG><)sAR$QVe>@rPQ$sfnpY(E_HW-60O^LbQ5-E5zM!BkA`|;dlZnj# zajRCN)mEAcbDvYcz~A4f?)pPNota0#UECEno}WbVmYJuc#dNol!d1c8i9=k2AUS)w z`2r`NS#1C5uuO=h?QbV_Z%#h3UvRs;FcDcEgo%Uknj8{Luusro&UMh%_ zb~bZWRE6BSm2~Tg9V*G|2L*j5{=x%w;i17nfsOKxCKi2Zcbnklwz8BQXze?{#-n`}mI!h+nH& zxIVsb^-iuh;1AVM_Y~AoDq7QR)5#_l+3SHgs?+p6&Je(xVK6)e-iP?3Oc+!d8PwQ& zgp~{ul)C)#;>DxmLoMlYrZ|;q^WD}(JB=Zqo^E-p!p!7cKx~mz!Qkp+V9&(`Iqh&a zUlw4eTb03QtR8IZm;u2_%O{YbCT&Q9H7KV^xYlxwE?wkQr5i8NXlEPu)`?7Qd+o7O`+aq_ zfOX&~YyK3+vs${jo%Gy$TR4+1@FTaev=Tz5l4QkoPu7wzpNZ+9?I{+P(B{tm7CCJE zhCxK{_X^Y%InEGlg4`N;SI}gFUp1MTKE<7zbmWj0!w3Y?ClSw^-xJ69Nx-+hWNRqL zf5Lv+ggRHsMu1YyswYz^NsMEch&;>-saEaGed%w5VuW4_tBdF;Z<`v%nQnXOrFSLp z{GR`f5~=s8JO0*tr}I`S=E0z_R+cy%>RaCLAV^|cFT8>6>XKhLgGvHcjm<-%30KA< z&5u75-P>nzQ?AyXk-srICfAampFeL|$Siug$;$IX<@UWLM{B~{I@g0fT~Qzu8Y43D z2dTLtNoZj9Rmq=PyF*X@Nj}5)f-!HUrPW-FrP~t5BhtQnXpriNJ@ya=NxLek#YNX`0nfqetZi{P{E6B#wL= z=CZBB{S)!5T`czVlFIG6Yc0_kN}4V`Z2AbK+>L7PiVCCaY59k#<;Z$Bb_G2uJ1QxH z-KMN8iSR?bc}-Av84qqM(dN2g1%=D9?^;j>1N!<%)=5hUMR`#U4kPovqvpVD8+gvu zMRMW4D^EJOHbA#C99DeB!SN0?TdkgX*?f4rDSWN%JXHpdsOYc6J>o!2>4`yK3*_pK z$8ewt(Hf+_bhAV>Ei3wf2KKgtRt-O&v54)lD{jN2-8P1BE*mt|!wy9CR@QKbB4o4_ zZ}S#VOSPU{d(kNH(ywXYS+m|#4PII@4PGq|U4-@8J*qI<+V(gXSbS1}o>}GL4GVNe z3uHnZqs@+^^8eXBeGjycLV$c#4~#10Q+Su1TI>2pv~Mv3O^MFr-rGWtdhe7jgFdNl zKY?E|;7&jxpq1DMDLE;nwndJuHb~N#dnqvhSLn#2$KItH_mr@Kf6hH;2vk^RSbGt^ zx~FZ``e`^@%oM8M?gzD$?uMnZz zk5-I{4sN-j!z4Yr1ZTa{4m0?48y@?Q9UUGm@bI*K>=3ib5iK7tDrx7aY%Ky8OSx!3 zRpZtJ@uUtHk6Q6tlUCJ`Wg|qgWKU=b3KxG~NItlCo!`0)!CKeZKgJZ%bH^L$vpG4^ zY(L6BsLfAYNpZw%jHtCB--YZQz$6HFIu1@%V&Prx_VXy0t~;Oflb}W4eznh#WZEsO zK89jx9cn&OM0;n%aCES%fsz=Z%U;x<^=h(A+&T2)XNV#pUN-9L$&|q?a)7$wXsjBP zWWs^yw)x5q{~^Q$mKhV^uYUqk(4v<1-&?^nxfrHVJhD-Kj^@nH@RN;bO(_j6(r+^H zdbkk}B~atjgTP|ES!8tHra-k-Dw2(fR9sRqDFNL2>!8@kDQ`kxR1uPMmCQPno7z!? zX(LoD)y1eR>2T@B69-@fE(5p#;EXVvT#g&-`=|8~2`1`~`j8rg6tkL|aqpce6_wXO z?J#P^if7cn-G6uieLu$on~lP%%=EdRkS|y^kuq+iTHV(d>xW+u)8x;tGC^ngoVHNf zI}O_DDb3y>{+eHL(jr$iZAZ;-c%uLk_TITP5TWCli~)n4I{3!BATid`VpI3K<$#BT zy$S!v43mT=4saYPA-6uI+O>=LJD(s2bxZ#6M8i|tB>`rAn*LLu5zyLg2hR4(Bi1ep z7P0d)QWxrrzOyTM_?g~#>veF@q{W}yaD387 z_6^%+>DOkWft50qIB=>aC3a6QNgZhi)Lp%>-c|J>R}B#`m)v`apdr7jXAt^mjur1J&?>(mAtY?b zqw1=No}PAor6m6);^pg#yekZcWXeDPFy>83y^)GYpF*^~;w|}WW0?oYeVo;v?S`vT zqSvz04dGnMXzA4aH!)kD67d`oBCgZn>`y@s)juJHR#g-=*57#XDTt5+ifQX~NBA{& z*JzY^Yy?BVBcf)X2keaulAaV=lBbb>A?kD7(jRA?SR1OVef=EB4JL!-iU#;@1c z9mi3I#fYRTprX$fK_Vo;dDD4hby*mbCeIYqF}$kk`p!-V*y#^B*CfVV3N&Fz0fi)! z@u|9Af(fgbBf3VHjSp@+jJga6N%BrkS+=FNw*y#ct`ZPf0D_ump!hYwm+?5J_cdj7 z3Ai_{@0`egy>ryeqtoaiM6Fhr<-EE*FK`>{tqaG=G6D)AnKcZj%A6M#5n-07jekDe zYo!=hqXDl0NS~$j7MfePW|?G=2PtWBMRsegy3h17V*-f_6pQS+(>BrQ=~~3_KjA`; zY9}0x?UeI2>XKy3q_%PO*)Q+sWnm=7{Igj_gIgbIHTh;7n8y9B2HLQ)ycuyocME)X zkiG^X{lw>kKRjID_;Wd~-gSoSJ4WdkC(p7Y-3PCJ|Je6XUO~ZPJ^A(Zxa&Y=l9$JT zGOfA`#WBb$yOG6aJb7lM6aMR$0btX(^9S}Z^RfRUfLUKEc8(0S{SN``o=JBcO~@!{ zQ1_&rJ%6P3$=CC19&Q`MH2s-<4)Z7Qm0YJi$%>gQ)kE;nuKz0zFqtB*+#t=n z5ic$T&y|dRVA4RU%YHmWbX<8NX0O8xqY7C5l$xf$&vv07=HqShCHvY|N9Ry9D0#}s zO$%9j)AHTB>!hTD-JSYcIz3H*5Pq-}(gFgr^ov8W*)HZLvu<3O5?S6(0^NJBrp>4S zMfti+1N%c4(w=Dp0}tRko>)U>Ru;$9#Iht0VJa=@o%fXY_J*kJg-Zd|<>vxlq==tl z?d0pH>8@Ey;uj@WN>DC}7k@cIwnz6DMIDN}GiIBAe_Ghu%&^`qUaI=<)UWrR(y(EM zJGa9C=7!6*wfTD>t*EEGNA+*sU{2FkqbU|RVl)(rugQPV0f^xagH5F}260@*FsEN> zF`V0j1LD(6JZf91vAx4m_~aE2w3nIrl*R7HJMTczK$o6D)UC%Fbph~jAVqT%!kj(S z7YBFw1++XXpK6-*R3|xO8cBe-2vD@o@=5K=x9)T+_;B3<0B%1qG0C6CEw}wHfWiUj z;QQw6fuY~wc4gLZzt}i88tAGgu>!q3AjDp6#$X(h#o%HP?LWHNX+i~Hd?T+`nB5XDLFNH1r5j5Zi?Gq zHFJlA-wDcAeoo09s1axllAd|wGnoGIOys$xnIj%DXzT;T`k@)=DDFlA9wHKxTi=fZ zPU?0FMV-w{_Dxy=_(s%+`z8@E1Yuo!vsenk5V-W11Wyn8q7t9NVZrjY_f8k~VKaq% zw3@2dZ(5>HV@T+iNMB!nUq|I+o8#r>DM16xOi?pAY+_Mqyya(WzzM~**+mjJQN{Vj zjuwE^25}7LF~P+fAa3BjRJZ%U1W6h=<`Br zk>1xcFNKA>U`uLq0I^oTWEMSr4LfNA?YGj@pwu=v6U;5;Z0ThL!{ zOlU;bTYDN6RoUvl=$J+2yT4Cytsl}%)mY{qGCw?vE?R$Lc`MOodN_EOnpVo+1j^78 zZ#EWmtE~C6*q@7T&|}{qobqcc-gTZ=tVoflK(^vzz*_sXxZ~IfZg4DyB}W&a>^I^{ z2*1!_axzVsJCsw=Qv18*-bJ$1k;>eg?Ln>tlMLUG{Kj9tM}-03-pKk%9Ci*bPb-p-%fyzsa6|)4svs= zT2UO8;8An+fcF_dR@y_9>P8-Jz;E?7_&;br?8xTWsH4)@M%WeSx~)0UY!=qm2Fi1@ z*3z6@a-2^{cB) zqFVk42}~-kw$zhOhkZBq`8U6Q)t*_Lt|%yQN@t^PHS|Bx%$3xx^h~uZE@H*j+$r5z zI*zkUZ|xjnFK|IHmW@9LUCN3{#V@PWpG+=qoJW~p1O3Zcl?x1j}=^8x57GQ zA#zzy1`<|LUsMkbGK@QcJ?1}l_tJgijZGnDljBf(r&poQ&DQvq`e`bQ+^w|Klnt_B z2ob3FLt^_G05ifa7b~{1j20+f3*t6yz1KY^aIikz&5%`sTT3B_FGbnu>!(#{PAjJN ze&MgHUGkwGRa2}>BnQHw$~ zlHG10p=h4@2*Lz^rw2lBIk8@UWW1#<=`=|^9#m8;6@ezCFpQwEVOiC>D>GSU)pj^b zfu0!i$?_|5+s0su=ssZjQ;|w4b}om+#aSn*39zWB=w{?-kosof90tI!XnLxqb`6t1 zw^(hZmZtuB{E`avKwP&uUgX@%Dx)fDsHPyx%F6WYSnKK~Bp{4}Y(GD*wDKh~OdOg5 zl`>;(nIC)JFE?z{2$m6cg`Ijc8|nuwIqIL8JNieutNFBHV#+h}ng*d^VP^c0sbyt8 zJm9VL{jsCu{FES-!W{4cMy*QkB!l}t#eep*uy{)uZqv5i>;tGVrz#~E*&%A=GeHOZ z=eJivLEJ;!j7o%IbXpqaOD_s$q~|@0f8|oHdaTZhd}mB|$)-*E)wnSA?D!6(v}76= zEJ}fWwD$*10S^&t~_wf;VBHas6w@E||vpUdUBXOO%}RKvnM zWERDnN>8E>Gz(iR;ddj9SxG3U^)xDu&X(nhkn_sU{yy>ly+Rwe`QH@UuWJTJ!_MfG zwJts!Ko^k2IQ1gDJ3EW2eEr%72T3$FHTAjw!%1^l`|m>fURg!Sg#pI5e{RY1PX+u4 zzfSqL1?R6*|K?0&md=G#{6k<+NkMV(r10|O+S=M9E32f6;J0=4^&Nn5UaI-o)2B&8 zR;(MT;CL{cGAD;h+kF0Q8-9GMrqVXgCbxLS7Af%O0*lkzre%q<$prfTBN3Td8&6_S5ra3+fO3$j5^VnaJQt^%YWY!(z@=8wkLI+w|ITGMZ9&8&nyW9qx>Qx@A z^o6nX4wIPY(0VoRAu+Ieu#60Vs<3KicMS*c7>9-v0Q}9Y@SUFFHj7j^`6^^@WD*to zv+4^367+?<@U0mp7gqrcW- z(q1*7=iCJZ-(Mat)(i)X=$dJtmjK4n4P{+E=YUryAR3LSb3T0dOiwopeKpgNnQA3_ zuoH#2MrOORBjop9W?IbeNJ5OyEEuN{^}GUP_1ZfLb9@4|{fw%3h%;l8H#EHZ>e6NB zr$?;#d-U}FDvI@L$XauOJVZ{#lDao3&>IJ4=D1|-GNO;0e#yaZSBe-UxCuJ8Jr&q!U=*itmq>` zui$#{i0P^2MNFXX9#E<`yI$=c{*n@VIMF!Ee{^KLySJzCm!D=7FLZtt-V+Vs!l`O# zJ4PomFpHRaTx|SUb371>XOFwnHHNYO3|Bi(#13nF7^&ikZg#!JT@?hBpBaW?6RmMOwdtIeIx0< zTSpmD^p2BK>)+Mafb~%&js2w^=17C>;lszCo`o)I3t|mc$Bz1qeT^;9}_uk;}>@pK|R$PyyNpc<pZ_P0nlH5a4&!qme0W6I z!8g~8-+>0d21kxfVbEjwM8a^eyPjGW0 zY9Xti71Y2|@8;?r|6Rx%L}cv}mj6MEgcQN+e|b@WG~&YVp5rK)`_J>#{(j@yS< zsXVEHy{izdc)*!QUj%>K<tK<9le)5BLjEpK2yt{8Q{#D2WWWl6*ve%DiarZeHpNTJSO+z0M zh2Z9WM1byb6~Jsf)71r7y_aJj^rLhW7xxci*qh2u&rE0MCA?`q~7X`Fr zUh-M#EV%3zTZ^ERIdURx=2xWM7&s}TVG;415)(@c&9>?t6{b+$pjm?$O^s1+XE1mo z;VtbvYnTNiSS0w=%1xjjx4Sz@+AnRJDQW%_g%`h(9Mi}WX3VbM?+v)T?N1K`rrRn3 zD2G$2nAxkc`F*22Q7L4(B3mGSXuM{gu^qIbH}O4B`h>HuuV2H(yE~x(?fZY|r1AeO zC(e(Y;_6mGv2NTTy|K>s8!$RmIpNH5wl;sfT9rAhi=Dkgcc%!?1~(2-55F{{?0nnEP4-k6LM!ZjCQv-31qM2%HzSgErL%IZQl<_WT%1+?ga2j;?4DXF_y2HzX)tMj?(@V?~9PIo=oF+gL~U*|zI|3e_S zC(F`5r;}!_;aHQii-DTU$LbXA4aQ` z|Ln`OtNz786WgXGb;ySy;bJt9ttGbNWD=D+9=V)m-D`|dh3kvoMXF$vH9HeYat2z= z%qV|J5F;dys?KxU}KGD zA5ZT9Ur52!@fenWuJt(_c-eF!dAoH}_T7Zr!dvt%Gb=#a&L~GUrlUg2rlx5#kGKTP z*PjVMNC;WuieeaGjgCU)(M)?g++bpErTG5!@C{?-#szCOz<$LdKR4GEY=n1?2VBf#!4QACGod(peR4-xJ z1ORYhY{O?TlcYx~FD`Ta-axj{8Mi=Ya>gwzFiSZ$oXZWZOJ*vu`WN~Up;8(zl17>W zmamD2>Nu{m$two=dR6UzNqJCCJkNRO7Wn6lN@=!cXvx?oWwW2 zIOK3M#GW}|;`Jb73%SkPpMiLex46@kM^IcDwLh_5g-Iz+4RFzq2m`a)1f8MLRyTo_V9OsmarebgO%? z@e&~SS9)@uT3`qUYgZw|K6YBYRXR&a9M5WNG##Xe1jKaBc!c{?$aAc}fB-qw%sJU% zjNWc|+3{r!0PK6&W)+>p0IS<_D;=cf?QcySnMA^t?)Meh0;M#Va~*> z0#8|4NtAhwY#Jl-_;X3##B#rMAD<&{T+yS4*2Z*GT>U0+$2W#bx!(Dy@2YI5btuwk zxtIcaPkl^B*TXK`<^apwfV+pBjcy8k@HEK5hyA)5C=E*1FRh*{XeJ@q|74(s9_@>1 zbO}x>p_^jab4A+5zBJ6MOKNCHGedANh4%{guo+-EUf5XkQEPB+AN$Qhht;`0^||%m z1olT)k913?)&nALGK?PwzI&@2-N)Yo%a#F9I37pG^*XtF;yF&kwu0KHmFcN_w*u=^ z0-=i<#(mPgd|DbBqsZseG9qLBQoL^Iu-Eag%42SURynM%J51k{kztr4fbX_cRecGF z)m*Pm11B*4C@g5m?l5$n8QO7G3ICqzrS`Z9=LEp48%KXCa0`;uStS031u$Ktv{#y{ z{>8W1uZ1*=)OSgkVJljfe!;uS+GgQ(=RNa$ zv@xWib-%J?RV~(>~P^wL`blw8%u0Z8BV^)$;)U21AfD-;j(>+S{5Pn>+*$MA-pQ#!Y6Cej;344kCkkYnCZJp# zD1PA6j!^8o$w@s^AYJF|AORx;%B|bal?waGVZO5TxV^tSF9w=LJ5eKde_v{h21<-rZH8+w%#&K zMa)&Ewa9>ngMeP>9TPTrm_tNqHPAPQA(wl^T|ABdD(YcCF3)p(tYFLD)&q(=cMAHJ zKKW3!#BqUE`u>+Mn@BXc)!q|p6j)@qul|J6-dkg67eoP_}o!#vq5^E0Ms(O=}b6- zM7pm(6Yh%9n8+PPdT;V?lT5iW&{7n>ao;o`0J0Z+|JLm!nHZEu5R8)y(~T{q|itqE9JzbkhTWOQj3CXJfyU2)rzBefKz|;tGCj48qL%X5@24TN@A1 zBCXS}YFR-$JWeO<0a$uAk#>=X4=(|k1_|O16{a|7g4zcpfD&egtiJvLFfz3R40+7T ziY?%IVB}-JNCKL@DY8xD@T!SZ-=91!B?XOVegrHp%$cw;zbdw=eD1$hUVt*Aln5c`A{cIPoUHI6T2&G@trqYJm(FcZI-n>CwsB2 zb?!(Edq#aRj1ri4a_0JfUsfiY)jJ88tmY1Vf!^G`BQ@1NK@SGC;ZJAC^gIXN!1dKp zWT@yMqMWN7w3@muJskL5+JKXiWZN5i>F0T$wL6_N=*W|_3!pPXBI4FsC#Hlfvi-Kw zU$Z!=AzkLHY5vYnz$Bj}jjW4gIs9slYO@UJvC$Z5s`8=>`H zGWL(iG)4?_v&+s;K{zn>j)EeyjG^N%s*J=aG41#`KnTBy48AU4tNz$sn=ikhKu}FJ z=h=E5V5nq!$UQn#ljxq9sCafGZm?f4-y<8b8(wi(zyUU5AOJ`;q=Jbsl^fJ3CYBNJ z@Y(vAb)jBuQAFkbWPRoc&E30i_do!q5ua?qh4|R{7Z&}KP3otW`FhuP}B zUcxk6OU^;+WSc=QldR*Lh1a}_375tMj4LEz!+)+|c?J?-&IYg)CUwBBZXXa#YKZ2HBaot|~RF)yYD=B<0I*n5)=<&-|&{chQ zGh|NxVCNBu@rdOl%SP&LVri7LD1_NmLJ>FgMbyQv&}aeYfgq%;1sXVO35MC!VzcIFh|26b0nibkK9%UOMmL^ zyZq;aILSvXSaC;lRqh=0L2DNW4HBmxKI9OZ(w+MHsbl;ykf%uVv_$>$S?gB2nqUUF zHH&7>Z%{-DTeOC%j;LEX4(8n3<`>1pQ@*75vG( zt@3zxVhT035N?ycimI^9&C&?h3ECUHYS0uQ1SGtY(b5*?B>&!D)!)a;k0n9dKePDP zZ!7G{!27VD+B?odKM^)M2KG}uPZQ(x0SvmRUvFLNWtjEEuV12r1Bp2$>KTzE@fIz| zxZt(&Xn8=@oFOu)c$jL!36Q)yyYprud(I<3K!Dibr0rR^TWRE$yF1^^OQXqoeUP`u zhEW6YYK#321o6PI2TO!r;-agIj#e8Gu9WrCD9?Sr<^;7i&-2$dB^u3klkvQT}+Tz*(q-^%@#LqV_*pcH8tknd%m(^*meuCcXYd zDwF8xESc8XXT;7jH!LS4yisHZS&SEB41n68JgJXOWh}$DvrkCWckO-bmf%SCdB<+G ze7^^LHc?ML9a9t+zQ2_M<740;;d3Qv%@)=+KmouL~RQLLiKKhrOYeSpMeIM7)BiYvc|5tPG8P-(0u4^NTg<=N; z1yq`J1p(;_3L;H<2a(=u=tZR}3IfubbRqPTNFY?{(t84-cS7$F_@0RGTx;%c?{&;y z``G!RF=d#Hj4__OT=#kToj=$Z1I&`tGj~ri1J3UcC7rPxuX>XWMun;Re&b!Nz7r~_cp9gFA>AH>t?I)62P zGy3^+OW!bxaJ{vE>1)DcLXTaV=T=saVb){*BO{wn+!jfDc#0od7!_l3hd2Qp`!b!p z6bM_aUs1Ysq9F0F)zt$Ng?8^kwqBOlPy&8kv17-=$MgSrON_2~wLYdht<>%iOj!Te zIuhdmT)bQK&KI79vck~s$$lo!nvpniSV32Z;$rAErp-1%rC+7^A&u#id`{ z+uIjONoxS7@M}UskVIgG_?udP@t@@g16(5q&}Kc8kzvEfDBWpN=Km;2Wf|YdOceiX ze!4D~otcx9f+thq*{fIKoQ`w(k8^daFTHrdh@Y3XW~qFg{z8+VUmZ>R%s01^6R7Wm zoHGqN5)Q)zEf_AxbS1|;nGF8`JGThRFu?DM`9k_FJw3hmcxD`!{0)f5Mt!i#5{Rh} zY#J{dwl%*XCN?Hhw+?8|4_7AyZt=1b0YOUtwyLVSD#HAm_m-@=b4(#EtjigQwR@n+!mTwA;07 z@>@6Lz4EF_ljR^pp627!I9O4TlV;`6yD%P?w(zWmV|b7HNdO;cG=je;3&S zQHSYU*MApxB(_N;v=l4-j25=B6=Jz7(`2cja3w-h!C<=iW{DTwtku25NDc~;x2b7% zYvb425vS{pi(vUv6~W$sm`dhY8E(T>;hA}N;u`+P=SoB2@SRpsyYYv!9Y{JlpAExi z?plRUp(Q5rAe6rf^cezu1JH~NqC`re?V_6;#&b&H5nUik=O5Dx z5<6NqCWCWkUYqt3_eNuS3=Gn-Qyf7UI%^B zKbP{e-Hmf^I%P<~<_qSrD=Ya1YJ??QPoi(!aL8CY!5wqC6Q;mNMuhRTGPrgCTf{q# z37n_i`xQe~)iTWxA`me4-sNojYTUwY{4zI;MVh(}ZZ(>6p%T!@BsRe8x>=a|OGO>g zTS^+R&Gq#G%o%5;5gRkBnkCyRXoK6eTUWnd(5X9Ukk_U^O*=-#JDA|j{pr_bGt30u zf@JkZ3rn~<1N>!JcfHXgmM5>6F;xK+Rl_JD!LMQV;_!Q`o&aiN;`AH#o@wb-Kx9aD zv4TRZ&cV@Ua!pG_mbJ{!Z#R=>UQIU9dRo;-3FfqTv{O%CFz-3!N zs|hRoaSPD=TxS>dAFx5YE_Zf%O|rEAXp#On+Qz~=T*=?`88t94koYm5Tx5qE4<@*k>JhvxxO zl?Uv!`g%Wx)KyK0Xg4y;rVkI*-n(sFmwJ;mF)^XcboFe>Y7vqcJIsy@Gk#)tDIg?{ zW@UA{8I8W3>^0#g8}pE2V#45EUOr2$@_^x>MlDP7%~#3;++kmuA$9Vr=`y7Rp#DcGPtT!2MX2l%*z*_C0A3Zu_mg zL#1xvY`{J@m5W2nm7K|F2uA?oiL&APzA2HcPz{Nk?%S%R@IMRheHzJ-cx!lp}4J+c`w z!%`t_a3)Bph{O_(k(SrZ4lkhRngM&_XrZ&f%+^-u(t9EzO1rf#MfA-#t8ki7@^R#$FLW4tYA4L}c;&26sz)DS7UTQ6C?z2otNcVe(*nCdpaO+RgG zH2v=NsCya8QW-ICkc6w8u5|WHM?wLrnwT~p4;s4M;djkJc%8_1W|rd_ndEx)sv{y~ zR%AhF=#E{KeT9&q(6)E&*xo@jg!a-#@ntD)&q3`~Ai?~Yk(p_BZEvvph~;=6lv`@c zOXT8ZYv5J;grz*ZcGa}hLICkyX0@Ne-;#=3Hs3)H#OPM2QX2Z}H>@20 zp4fs)H+4WXkCB{1Hnf!*=1%`Tvzw7d08WKBLok!9j0>qaE4LUgT7^M~2s)`1Sg{%1 zGA*~hYNwd2Pf~6iHVp$9%_Yaf$f}}8kKFYQ08RydP!xeagB7#81xgGfqa&P}A!$|I zIXA5sZ?qNm?~roVf0kxmd|Xl$JnOT*ZjV}b?Vg-@z{1iS(gt+$ne{U0UEStp6*4k1 z_cr=+j)>167^zh9&7#J7?v04%M3qL4^k z4z7Ztjdj84&g$+*==?)fk`Y?BkTO97>)1cHROo%UTAZ*s;Y#(%ifF-dBpW#;D0L_7mfCgOZ(lzS&HXj90Ts{BpD4v>n+R)>C z?!PM`iAjPd@W~al|I<*+1N0r;7!UArn>%>Mcz4aus1Zwb9UbD}Xv&e1k@4wir0f3+cmwGFe)}IE5mln0p)s?v>hah@@$&L7ZPlg& zk0fhrEX>r)b~iB-RL4FwN$W-LyD!-u^t1OW`n3I>oK!CVAJ|SeDah$@u1w6 zOzrGA?;Rd4OdVT|!ft$#le%-1f#svE2UGO7-F@ zt117w``_aE{$imI5O+Lc0Xa9l6WcM9G&ttP(HrI^_Co*f&p@4v&%AUZymE4&ycOjY zF2(~@I=~DiVIG*F7|8)lx+NEZdTh;Ya`N|=rkd_8O|$p~23W)Z8G|NCZG|)7UUXe| zz>}7Ni0`$A#^mCwBv4YnVIHLa1wR#J7hX%YoUC(pZW4Cf`lU=(`LI zw}62S9e#pndAZ~zO=N1X!YQx^@WI}qLv%r$Ut8`t$6Gp^AQA}75rC-H(tZzM$ie(s zJs5WxHWX-!Dj0|WWqg|MeR%9UI&zxqFV;T#4i5LD0Dg;xX*@8{UvK>{Yx$aPJP%Xa z3%|fv9m-EYANM_@j10gR@#rG|%d2S5s@QEZ@v5^YZgk-Zt8hyl#}RNj`* zQg|FkHFa9M$9`R2na#hatr9cB?glT)z6KmDirB2VK*gJk%Ql$8CgTTsxI5c_6$H9G z3Z%Ild9E(CZf#d+K`lp5?*Jv)Qp@|O0W~ma_kstaZ0NYlJ^B0aRa@&C zCN%>!p)~;Tym$#LL{rHu4@fkN45<)zZ0T${&Iy^A3#{KIvTQjh_G}rYP#|%Rv5o-j zmq=(lR6g1e01C9M9rxMsG+=H^%SCr9Wj8l}Q85so-%q=b*j4UedHG(K-P86Gw?cw= zu6gg-3s-hE@_+wRuYdVP3AEsJSkf@zgm%)>RL(0XLqhZ;S2xYC-@biEI%aTlyx(1K zqU)|;m` zjO~xSJPC;0m)PplcqKcpq0r!%nj44nngAq3e^YS7k}org)X5DDOs>T!QpaR;u_51Q z@H;q0lr=d3uKIYl6rH4_BM%7fznbl&rBs~(nG0f!nG8~!Yj}LrRQgZR=>xc#HGg!CIc*0R1LfOs?9Ls23~a1o={u+9`Me{xw(tK zetRNL5*}_kLu_EXiE#P`qkN~3@Z`%a7A^gABO)VZ@9t1t3jxkWT_{ulNZ^+EKFdn? z$g-(VCUFb6|E2tz!L%U5S@Lr+Zdp#N)i>X5l5oy9YZd2vMkJ5QQbdcdNjTCyeQxx# zrH@ipo5Ad`KSq}0nOg@C*L+1AIh2Fc$3%x;UEMEsgq=x&x*)L#+x7&EEINmHgE^h0 zO%N*SCgqkCrAT}HXtNLV;^ZoLOjQAWx*U@+!>aFb=E?p0vU8iIu6G3miGeUD7|Dw?0CBou3;uOY;0EY!&os@NAK?~JH@&^0ZQkhyX%bN zjkPb+2wKc8EEkQm=`Nfu^-j>2b6Oy^%S&EC`@FPFdJkCm>RfWq0s8rNcrxR ze$|%1UhGpf9i5!s8PS*dOizhTO_|Z35J_N?t!^||h0_2AD>dUXyw?_I{$XebTk-o4 zz14I~%Y0*;VXK9_9+5IzuIr$5AE-bq-j!Uzu~&!Eb@mt^9PGVm$l;~d@bdE7-o~_r z%?QQM$;+D{hV{C;huvBZmpA_w6>EZnE;a!ia@e<+?=PxDLgcZeBmLPwuhY`f!USw- z%1_o>B24YZkR^7)Q+}e+S8)womG1z@=_;7kc&(`S-W)*C4#y5NomHabe~S}0UARJ1 z3#5-_H?}_B$Z~SG)rQ$fnao~7A_f63I=F_DNx7oDoc_VX*K?OH6F&u-3egogR8~%o zR$!zJe<&j?;M@g+#c$Fu0fYl$`VF2zx^47s+Bufu&Yj#thUsbFDQ+gYgzrRZEp4OwrQns=t!4*C(E?OKPj&b|2h%wGOMc4)2&h z_7)kWFBsO3cD6Dzn|CZfjlAf1KQcSC(Y4eYHl@dT_PeZ9Tmv+`sD~AMIC5Y*bJB%r zR2m`gIlKQWyBFV*-eINXw<*1ZEd$-t^X$4XEf3bVE)``ag_=*~mZd|iALPEqTV=M` zsc=t6Z~cxkP7sY4^-3PYq-T|qMuR@ZICDBT=PqN&myg|V=4KZ&>z}R;m+0$PYYiTX zoUN{vg6j3Hu$VXTn*+m04=yG->c9%q_AWLBC^To= zySg|L7+8G(y=0X*bK9zN0-5LnNpthq5G%%3*`#l59@PhtT==oHRLq>36$T-p4=pGd zgj#3pvHBZQCH>4p%JFRFs9MT->wQc}aMa300!Da(Ktx(%GM0hu1RKe}Rxx%$4(5~= z3LELKPi|Yx0BFimkWNpS+f-v-CWiz>v*PzLyH=%a;Jc1y;S>Q~8ze&_eCCq@i@{PQf)308ik#&cpw|7coiCLf`_B5qJ*7@&Q?&!=F786m;ibN)ju8e+bFUWI~r% zGViN8EcYV@_E#AkJb|04b?3prn1JtbrhYp&&3eKglgewr*+z#z)NSLj!)C|Q6rfh5 z1KW{M8tFHvL|EreZdSXt^EjB0aB%3*y>4`8ho`rq0pDEUQN(+s$+iQMQSpf*WARhDxj#_knevp0xt$Th$DU`9PtdGFoQmQu35YS zDnR)nC<(-{MMJ?B9QWB7B z`MrB*fT$dbG1HAcr`9wh3784PpRV9}wIJ2_^7ZSR1VOL!dKf*ti^UVODEbMz=i&*R zp?`NXS4T%j+_t#5gx!h`ZKgszp}M*{8v1WVfA-U&KNh>TyW86Y+VGA#I_xI0$sa(f zQ(9U&xfbSx50_rb%Rg6kWNUyTVtTA%w#`Aq=ZAQKvIt(#+(vn0S! z<}U}Kq3JC!J<+J}ju;NO&cMht4p}W^{rK*xUV%6rxq4BCu>AI!s;#(fqRM!;n}=i}x!bupE4OUg86+5fTy- z*Bax6rJns+L2(f}EQulXb@gFa>0IhTQzRk21?^ea zVJGM~yYRaRAMepqH-oFr>E_iSLPkz!V+&n0r8(clMJ>-A zo=$*{q`-4N(}$UXM&Z3c$?6Nx!Xlf`U|RBC+&6vr+e-aiOF3r;XAA%(gk+k|!=fTp z&DP5S)f6PpS{IYVP9C*)fWm;*LrP%xr1h9ah>zTDj^v>rB;5oDh6a2CD}*Me0_la> zbEPgvix*7WXePzCbmv)P-M1l@GC*HoChr1sUMA&ilLfrz)=#Xm@qAQG?aN6qc z#>x=qaxX^sO@xZ$RVM^^)k$g&Lb71-8{2E+C$qkw_91riVRncuY|=tq9`~>s7N5Y@ z`wIygiWL=smlkx(`9TSd)@J2kNFMkLuNXzq?g2<{m2D{Ga~T)t~_qB3m-%P*z~& z;bWwUTA9s4BJ26eRvj-P;nGPJG1d+|O-v6ScJU1cx+hnBg-r<%|5CvY2=9*&`3YEfbmVu zcTc&`6#TJ%+-be-UY!xNR!G~HDC$*wxnX-S`s6*ZU2yU~UEQg*jGB#DcHG?cP>OqM zKmM!Ctf-|G&{cT#^PN~fbv+Lf=%7_i6)x~=c!FPJqa@zctGzJXrvPwZirmMBbSrk> zf*JRV7uTd9avY)$+jJ3DWzOkQ!d{@Lov5GB7YQ|Eq-?{b7+nN|Lftw6w~reKt3Uhf z_so^9Y3V5SAlX@{ZAX5R=jB<8IQ*P;W4Y6IF!QUvAvp0OzouvF^d*g=w_idgjrETw zch$!Ms4qaoW7n`Jef<`Q-!B_;Fmvw2uyd&|+JJDFB$+!QHsP1+5_WgX-qZ6=RKecU zz+_Gq7M??u0-)kntq*DYiWNwT%|JU&PMhn(6G;QTUP;j`QS-_+yAiSUWW_?t%6v3j zSL8smLpUicTm7lN{3h}c&m3+~--O;?=(-BMH>)RW* z?I5Nx{x5Stdi7OzE%pPA0EZ|vg)Wz-Bxc_ejE~o~v2R+msHXNjI_P%0qPIREZ#=rZm%9T?;s5AZuy@}K zJ^b}t|0J@>$+1PmBjWmvt*XDf173m7`KLN@x`UoS#~JQR!1>u?v$}tiy`641I*~2VF5eq({=dyU;${H@=W%JyUmFBCQf(Enn1C`+ZDPy zaQ@+4%XSR6kC)e39wGddxtk`}Mb7^2|5Tp-zid6Q^&eUf^e-ssL}INTw^9GALY*G# z!o$i2Ep$|;79J7l>gsYGwia|}KU?9l+Av%)_r}_ML2q}Z)C++DdY04%S)ZlEUAzao zY^?A#;0_yYWxI+c1+f=vZ@&KvMto5hRL{2lVxZw?Jvae_Xy9meWyQo}M(MxJW)oZI z+vv8L@yE9Ou?uK_1kmlSx9sifi`tC%Jub_kOU8^uT>uyzIa{^8#9u$ybm7^v_Xh`{ zwcOn`6a*Y~x5`HaN)+na+GKooo04=J{Oj(YyFj!s1-%!$&*kIRKHYT5j^~hlpIcb? zCNS6n-Q}mR-@LQ#s2X-W00JK?W%uyGD|FIQRhJI!188F?5?e$x&Z!iCUven>9h5*87Gj50Q4JYeBivS*hH`L=nJb9B|# z#zxZZ1tVd*=$2@poq*C0SaQ=7ybpn+>}b2`q=ib%HWFOQ0bkp2G@w0*Ke+&t{P6{F zpWoyGGHWcx<#4VTmM<^#?t+zt8^RH3Y;HXNlAXxzW`_PLZ3L`6zUL1FNyTZHBj z56z87-8Z_8wT(6Ntj$@9={c9b7hi0yT0M;W8v9i`e5tZ}4ihorAgLsU-& z+tFlwiiDJ~2lRDbf`|*|J{u=%Dd6a6bkdIEHdS3!JkkgY_0UCzfnNjRuJ`t^E*LnF zW(^e?G9T?T-&?X2a?fW^O86MrAF=6UW0T*>L_rR5!J-UBWGXz?`79L7J6Ed2ECN3j z?tY=MZeVQiE|O>y^ta0Yol97-BSsON;TdfaF(9=Hj7p83=p`bbRvFaK&RSmCCfnYj zvqf66se3IX_X|yXlON4>>QAEu=`c{QUI?kJ=@Z(;cijLwxXA;Bs zim#|^KYy{=L>vFcg%r_#u)Ad0RKMQ0leYSNP!?u8wotB5Ly$^n=cKn--XR7#uOP~$ z7P!ewA7yZ$FjgCqSfSK$L-%!@Anq*J{bWH1DtO}NJMi1STa`5LOcK4wN5QS6t2=7E zg3QPD7pj5HO# zBZ=0ju<`wJn|}ZdQ7)y~Pl?!;ARUgUZ-lxIsjpfQ)r#KJS$fK<@sCk|$rWFi_mD)z zJW3P3&FahQ$R;IruqH83rcIfA?bTA!;Y2T=>)PGbOPH$kp%N%@0Bb@Hnb=Y7Ze>?4 z>2P0P%tkq@)+b3aTXYoi{NbDTtU22|n8rBsp6>;> zxuGQvo~VW1jgU%@pOkATzpEln^H&eEe2y~2XnmFqd=fu-w?ep%*Gca6l5GKjp14VW zknHw+h-6ict2W(6UXsQ6ya^Yw&C~+D_~_^*dYcGy-BM8=wl)$NhgUvu7ab(2UR6k1 zX)q_J?PbwcNESe6=>byC)(6+e5>b*(IXq<>6_R0U>Z;o8R?J=&hFBjbb|;-4^VwXp zQcI`xXK=P2Zt@H%Qo3291(}%>(`2{Sw-Y>%5oMLd+!-P*Dt3bpP-3`Z3aJ_GY!`u#i1`OII=#x3?f8wnM@g?ukv=uan**Ez>8`7FiuCN-L1bTu4Zpin+F< zOk{|aIKpK|>peD9e=%9n9W*Bw56|#qj!wmOduO+^E@viFUW2#~dZ#BdBj6gPR|E&~ zd(xA?&uw$0ocgxMstDh@|D08O-1bM_u>?y_g28~hj}~wXqT!H*Vsbvuz1J0+9YR)M z)?%l-X|qy`<|89v*oQ3lc-A*Rn768r7kTO4-&V8}v>X4Pr&GpM^y|nQ9#{2%zfww> z6Sw1HJ3LV@b=?x1Y8{m*Xl+}yA0ija*A_w}WP@~%c2`tW<~K)Wern~Rt(*O=Ij*|a z*6roNn^EdMCQn?esjRV(q@Y-%+}wlo2)t6=n-#AVitRNxbWhIob7%Hb@$cN?oAG}a zFPr8L@flm-5!(tTVkJCT^*LVMVHN|7KxskcT>$yAX!YIlT>5yZBa^LUtG2uEHR=|F2 zqFay6bP{43<$J))+$4q08ULZpL_;FRyX^?X$IDJ`{$39cZ^Uy$qQDrJhN6Ag7doG6 z(|+XPjt4qFKv2K>5OeczmmdQIhV{RC*n&5zKV=&53#;3XRkd~W_i3oH^JIv$?qB=T z++W(b&@g1AeyD4)WiK;Gd*91F`ar}LlF(cl0k3GotBWJ|?}773qkIy% zn>F0`l`Iua<`u!6lVd3^Z?!?2I+p|WLeb-2Mxf<8OvkmAtRNza@nKRP=$F`qS;xmO zRaGiR?C#W}@_;E>GME&pslzkkNT_Bqelx!IZh zWl7N+if;w}JiZrY<^;_Q9_Sn3hlV>dil(~Z4&+3kr7n6BYu3F#?=enR4KVUpyuM{^h5-Qs@Wx z_y>Iova^eNl16V71kvvj60B{9d7L5GGXV~QU+xGv{07q)>_S3lZf@>;9fCg}bX;;< z?$3ptfZ(U1S0v#><){Dg=bqGNAy}$<)fAdsxUuo+SNKv|N=j``PL9{%*f(I14$T%w zcHP;|wzfz^QJb3&_gnGfcn=Z)sm9XkXm*DVzeDV-feonghOXtBZt4C=d7NcyfkkpY zuTI_~5b7U7J{q+ywZ!6%_BUZZC$)uiU&ao2BP>N=3;BZ(8m}xcnJOn7tX$FW4K_7y zk`+^fDmM3XI~?aE;g7l(Jp!$i5;#On{C%OI(vSnBq1T; z7wRW4xEe-m-^Rk;pJnIS?BO*b`bbqGT6_is$i*{kd8MU+96DRs*x`~+V5(&UkYL4V z+uP&(Y$40T6`g7YdZus;N~nlIeszB>tz1o0(_AKsz3iFG2n8%LR^v9@aLz_7rs2hl zkBs*5{I(@0>($4hkj1`kgfli=!-Dp==#g0n7E>~~xVV%jGbjI%cl|EhY<;dB+qJpN z+%P zPqT^zYgt<~2aV9sZ##AX1+!>V&n(Pey?{SfCFN^o)3LOw-D~Q`Y95Mg?*Lj-JF?OM!VcK`bB;Cb|#u7 z)(&&j5OuAs(3z3(BO@h)X{*94XJG=LfO8uM%?-!$gld)50`vH^Q1y;)UIKwy(JcTBjyjq zJYcP&2d+t!(;hqXD@#?M+Gx;Ffx-M8M8_axYyOdt>wF=W?8M{~F$u0x$fs%mn89JK z5phe;z)pQ?nfCkPVZDOY*s*VtlpqAbIE||Ng$f3P$f{AVs}y&-$GY)-S5@a$gv+W0 z{c2Sk!U?7mUQBMmHQ;t zHSfG(7Ta33&F_5!*@f89qDeesf`I``S8ypVmtjKUUzNsR(*tvf*#-j|zmXA`nxcK< zD^%oTTV*08FZoqW2H!zah4pyN@o}t-C~idb$Tc50*7iw6p&aJN4VDI12MVzylvi&) zEY%AqsUZ%(!6awNjApFlp|i16Tp`mr8oyxjF+1i1vB9t+SBOn`QPP^lzyF-ri=zYDmq77y&0kv-!@jZKstUK zK>L(M=~268bgI8p4*9Jy7W+i|NqL8UxZWyGji0~73e*ddlG@YmB#bhlF|JcIT*W!J zP(rzbJNSH+l161*)C(~}lEdn{R1Grcy`p43oUffQpH_7hJixF-v@|8Y{nFvJGGu!C z&@pzf01cv9tELd$dz+WHrsx-+Imjtso(w#aWjGI%5^|rRs^@ok=1~4fElXZ&#c1ESYcz+eIVKQ$!Aq zn?&piR--$@Iwm&zYlQ??515EY7d6&iJlPTSp$J(0;Sp+sVe#JhMumyhn?uF%E**`y z;>N}h^BQ^!IxMGwv9Z+6GRG|K<^Hjwj>`d?&zrn@(#=`s=04kDypH!b)@)%Eiu z_~S<_z9&h<>#7yIQ62(;XdBo9H8XE4A&_So-+N-}_Py8R=Brluq+-Q1$)T@T?+oUR z8G$@~qbuWXH~qQq@6R3%M_CKydcgB(J#RkjcPs%}x`%rRl}L}+-#k4MpQqdE5pm<* z`%FHMrBs3k)+niHO#7?&mz%{CQ%yB~DFaT&C^}4h`20*9_Ss|$Gwu4_u-?osftR)s z{qI#CC>5v^jV2`UIWwGdlIA3U!r_E!=mZ$8!!}hx>Y@GWdbqq$s{w9*C;vA@4~XK=oIMEOsuTa20H$m)k9Pg;LY^2`uwI7}B#bm} z!N@6YYQz`P5i6QPbB(iP(mqM2KGN<*7o37OdYBq&nIk@--X+77x z(YK2Y+V`m~BSssmC}9P;(2jad&0%K+*Mbn^4bvY_9-!c3l{=Ce)gz{bN}_7d6xtv~ zPurM2`_u?Mg2rUcDW1_NXlo7{{zd6M-yn-rPb`B77uUO}YOAj{Nf!)Sq62nWJ1wdq zic=GTjsAmk?)NmlnWn*@cXQ;&xNt_Pk?KEwYA+9KicIeYu8R9lO)<+4fx?^Hj*XR7 z;XU8g!r>Az^NuORtR1_Nt?^q3Qx|>fK^(bknnRP{GSaP0?KYoN5aqhm7*CI*i_9Q* z--0gD5S@Z&M=+M`o-I_OCVLGhdOYM;nEQ*X@p;;3g@DaxgN&()WuWz?_FChOn}Ozr zGYXswpbosTbneB3qpHpT?|GUN+=a{g7j<<{f;uX4x_0U(4&63dnmiLtju!_{)P!z# z(9=+oyO#MN=F=|EjUpgLy;*FWf>G*%gW&~B^M_qQJM*6Xq(=R!bIbc;?gLSr+HT$Z z*|^(0Cg1dvyT1(za;0s)-Hu+e+M2IW?s!4Qdh3=qEl4oR339v11Xu7;r$8q$2{H1P zjz`r1t%nm~NfJ16zW4Wx9WDNZ%BKd4;YMihxad31brrB8369DTuUPTrdnaunqAc;{0iQzBlZDzT z+mqQj+B)E%km#DRAM|$na)=X&H7&1$ALZ+Ubk;kCadD0qOp-_idhBFWAI){V$mRLV z8j*7E$#JjPF}E?2c+ow77qT?aE;SD_bk{xZrh_^2YL#3s0DoS7f4I6$I~iU%I^Esc z60WbTqjQVUyz*&oFsY`dx|j$R{*p2BK*g;0=1sQ1>{)tX%Gb+hzL;`h{%KRT+fk(Y39gZ^QE|G<9nkBjUJ-~>P>|zN656k945|{;Mrx;)!6WdmD)1^u9IgaM?2%rHu@y87N?TJmN+Na-? zwOgy(Daq@KloVg12RA|Hday2&DL>R&Ww=UXjeO-Xl-|;7b@Kjfl|1^Dxrf}B(6!G# zJN_~hiXJK#Z6Xq_J5RcItw+up;t=mq;R#Ij^j~ebF~woD$J+J_t^ZtyEUc_Hs#hZ$n5xzi@-$0Ci)P~;K@T3a)^w7- zn|1hd2+TSUtxZT^JA_u(vVmuzYF@~%I=aQw*BO{(fCUi!u&3{{9k;vuW&Vo0oIt5V zf84L@n}@=A#}0Wj0lPl}=WKm;qjsIXq}!IT`=#-Zc{XK@3OX~~t}P{$I{A0gvr*+e-{EA} zZoOgk$I$2<`;Bk06FiHar9~$7IRaVN+SWg0!6HYT$!~GJcp)p7ai^PIn>yC3TsS|Z zhdPpjwb6o)J5d{7c|g*`G9^PoBCCYjUpg;3RZ6%yaY&>^ZI4=)4^xmJLxzC`t-#RIY^Di}?ojsJ}Z zN-4T8%F5-T|0{i7_b5w+C}ypJwc#LW7@E>C#%d$)YNiuR16?0gnuCzX@HRXF?|fGv zm8kEyx#3A|1}RP_AjNO(CyU}~W_@&W7fG}a zU&+S5g6i;(yo;A%?>!W~KsBxR=LK?e;sa#m{72MEb`E>(g^i7kzgF>25R}@if0kJx z!rvW9&}v0KYCp?Sq!D1;_!hLIu$}m&p1=(I%{~$m>1H@#s-_l|n3wY^_s<)?Lu5LT zJ)T$Iv@~C2iGG>qr)}1ykPxeM4`)$eGB=eVGVzmHI?M`RC;q4U>y?)Ht@*Dlh}6rmk%Xxpxu{3KQVQpUF0dSzfkkYiU_Of(8~B(CQIf zj+3yHxL8A6>z+?A@`K?Hp{??yso%vvyLXQ>LvrHtRqwLr$|8YdH|V`f$loEEosRmG zAocaZ)%Qpu{%$viZAOpWBhrIs`=yh&+Hw020sUwtf`QJ)#`CNDxpV7J?=o zb>7{6S_!)y+Cb}6FHx&b#YYiL=@TJE(8Ocst0(t&Z?ADidX(vutH<(Z5O^MYdMT$V zK*+CDD(-!eBxv&GI;{%X83q#;c}vp2OM88X+_nC?<(howI;rgGCQ2z5%K2IM8iQ-s zN$)7rit1~x?h-_i_>Vof7`Sztmh9fuK=wc1vE~cgx$)muog)3x#@UE}CE1?kkm;y7 zJv5#|yTw=f=~>SOpX3u3CjIiYt(08USp8x&0k}c)@ z!WFOgzIaO#y^-c1Y`W(6=O@dPcBoaaZX&5#H|}2j`>8A=lRP4PUN!Ec0=_zFU#{|d z^JmMJ->!Ss`^dGItGBfv@sGS4$ji8Ir}MJ53_|v?GM?J~Qtj!(?2H6~LC|mU#X%z^ z_(#kdlt`+>f6^5a*SMpUu00Wd@TXi=dY&?H>}6@f-xnb{qdn48!SZo2<@8JPNMC9C hdk(cT@b1Rp#B$mK!Wq}orSTh;ej)!nU;NF7{|`Fu@_zsT literal 0 HcmV?d00001 diff --git a/packages/azure_frontdoor/img/front-door.svg b/packages/azure_frontdoor/img/front-door.svg new file mode 100644 index 00000000000..a1be737e469 --- /dev/null +++ b/packages/azure_frontdoor/img/front-door.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/packages/azure_frontdoor/img/sample-logo.svg b/packages/azure_frontdoor/img/sample-logo.svg new file mode 100644 index 00000000000..6268dd88f3b --- /dev/null +++ b/packages/azure_frontdoor/img/sample-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/packages/azure_frontdoor/img/sample-screenshot.png b/packages/azure_frontdoor/img/sample-screenshot.png new file mode 100644 index 0000000000000000000000000000000000000000..d7a56a3ecc078c38636698cefba33f86291dd178 GIT binary patch literal 18849 zcmeEu^S~#!E#4Tq;}?6chqwB{?k=6jc5D4>l%v(rleJ2Y%tW zDj9g7px}|*e;{M?LDwiK3@FNS(lDRTd-MJYIyUJCN948~OJk1M(DrJyI#iV;P4k~& zFZo35IfQt0RwlUN`48^6(1dv_wm(y1xhEdMld=Y?!%u=fPT_*{3( zwBwz3#qR}_)t>C*jp5@U)Ti~B)Y;qq*TRxZJ7ZRN_^A3TDAEM*@7Ve%(Ro7=1%1B< zVj6GBUTxXev>_^SFA zgKZ=g4aTS}9>Ofj7cSB0WO?gQ)x=+!hs_)b$6#>ScFZ>XAoIX)%Bc|BDC~JFBk0f0 z0NY}6gb)&!qx^FWC(!ji+Kl$V$2|ocA=vN0TM0Y`U?tX+T)c*C zA!IL(T2Vm%MCLa85^if@J@Kkprx8QN5!6eCR@4Oa5S?4-4|ou?90mFCM8D!;n(5xz zO}-*t!TntN>|a$s(kGQg1P-U?hqvGF2_fGvd&~yZ_l3Qf&j~XWa=;>N3#-~#zjzcc z*m18L`A-K2o!d@J>a8SRbm4P&-q1(H>|JgIymDbnJF&@008`=X!P?4DGgZb>voUl^ zNJKgPR4S={)3vuk_{n@=M8q;;aJL>q+VLdTnO=}`&x;1DKjJA3*f*idS{jP5?+;!W zn-^7021Z4zv`Aq`hmX1aid997RNh3fa-@PG(W7TzKa1W&5^y3|lPeETP7j9qXpo4)7%(W0_2 z^Nmq;t@rb1eP3?%kOkH`P%!zTC7ZHjSfNN3*Sb#=3#jB*KpNGNfnRZ{N(6DrW(;B2Bwom<%m?VQP%K+ zsFeF1-(DY}oP@)w^Kw~gPg03q?N;)Ec6^|nikA34T~RynX*z}H>R~qgT$`Zbhn8wzZs$j2fsGN&rOK-mIBBvzD@a8FgbLpL!h5N^u&0wG} zq!#md3MHITv?3@$37J?lc_5*LWJTTjel;IiU-Yq;(g9I^D&KN_NKVS0O~GvB~FzPM6}=4d%fG4Nw4pZshcyLqK@`b8?RhD38haIyr@+8+0r5TC1*C7^WleJ zZN3_ngTD#RQvNL*;qD2H@cBWJbCC#d!}=oKfod5SE9a?!?j%DVt1z@inN}Iy$r+96 zM@P?AC+(`cM;z6J94BYGJ;+P-N#yj$?`G26ydS&OVH?~JY(N4l()Fh+x+DoJ@r<+i zhm^ck@QP`=fLApr62@KyOef~}zuG;(VbDQmw|Wb+oSHSw=%w9R)=et0cY*~ytX)#M zEXlK^p;zM@vTnXn+C1vwP)~TJv|TvDE2($;;EzC5_5IL#H;u z)#CO8)TSzbt8)wHB8$I8KcIojx&GoE)3QNu{CQ+_xBmQ&`mL5-u=BX(hs^hMY^ zae!!*Q;Tr$@(0~GoBJAohGw*d{l8~!aXop87aaSUb2jm)Tk>#$1*cdo5Sl+?oD!l4Og~yX+soottl4 zp4OartUuAN(dD~yLJ}`A1*!D4-|L^hM;`_DM^1KYs-VF(}h(BjRO``b+xV~%O=-)?p z7ciJH7Fnl?V&=ay_AB{oQoa2iR;6$^tiE|-eRCFy|3F@%j#6gUxkZX@?K`F$u#;T< z4IZORpUthmB?U`;zrOkp?P(Rvd5TFRWrBJmVg;KEZvJ+;Q}FRY%QZ?c^&$oPXW+C5 zdN#c>v%U?QuE+hMQdzxS1Q(BT90;29qu#^A?a^)Ui;{TJ;%`nLgm2ew$J4NvREjCJ z$`C7&?tH$CrVG@M3J1-KJw_*9BKeL*JX{ zN+Vg_TXb9^jJO$ZGkXO6BBFDjt~w5`w2TB*z$&1W5Il3IiDs=ZMDt|9iRtKET*wF6 z0Z+|N87p-5Fh)^(*l>OVr5^aY5LW(@PuM>Qo@&)yj6XRkPm1>eTF#Y_c*aRF^ZY5A z9FAU7lKEHG@i{wJMPg;n6z2|69d-)q9@<7t()d-zPy&X zdXG7{Uw{k23)CzzQAXw#iqj<1u~W@K_Ljc#?ukh;fRKHeJ2l~Z+52b2n^bGiDF2oX zm25FLx|4AP8>rAi@koY03lrtS#X?zK591c?2iZ_jjc>0y>q9>fU<08o6zG%z9WK+S zDwZMW4~28wu#ye#V*@#5t^S@NiAA`3{SF$xINmc_WW^u-C9M=H>RQ1>WM=|R!660{ z6E6%DwX`eu<3pkmz7Z=FCRd$(vhDkc3yMnSr)5C*aho)DZ<12$`$TXj<8Z70)|rK7 zXFD8QzksfWZU`qL2K8X{C~TcF{KVW`3Y{IMb&)T9%1V`tv(HY1 z+LXkLyM|3mtLD{x-#hOw-U?sr-iLeHFA|=-sGZ4#hX)atL!a91(tWJc+og&5W}VfZ zpgE7`{5D`~?yGR++y7~xA&eU0N*ZezDjF$> zUeK&1aTFQRg*?v^Z2e7u<`lk$czR6}b6Cl-qA9%A`#A6q0*zyTu)X`3rhjR86NK3= zLdw{+-F}+b2gxd-qF7>Rla}dFkj|L#c|pg5Ni+MRA|BZH(@ME*o<1ijKcoXb%PVfJ ztp_uf=G%kvU((pHcw90Xut=}atA!giM-5By)f40nKp zv7Wdb{;^<}VRvruH~rYr~wEuYY2ov-5Q|p@u3Da9+z7PeIpBAwi?RxnxN3Kt+N9L(LUS%wxY` z>e&1VV;{CYw8DNRlvBH)>!I49SU4R!t3I4=y;mCevPZh!-}~G+F>6hcL_Rli4r zC4(WN)`j$>^S=~GMGR=^)A6wrqi(-x{xK37&Vx!OS6t=KQ2JVZo#GrSODtTe=TVh%*qfF%91nqsMNLNL^Gp|_ zz%I*HUkMQGqb!1eh{{bp|0GSCDbkG_D_d)8<(0r<6-%Qi7qDa7xZjcdZ$?Rth9L!f z$erCcs3<~mtupywbaT8NWZF#v?iZkvqSz3@p`RiXs7P!GUa~-U9hEG(NgI#3BzO-# z!9JWf(;r!*A=@g$f}>wi|6Q@9z8AmYf~x8G%sp>C5cfuJY;hs1o3Ozu^{pH0AFbs%yU)Xy5>Cf?qXiHn*-PAfKDRiy`U0sFSKFsgEZ6_ z9#ma!<#Izr^}_z*>PRSt564u6We*XmZUx^jv*dK; z4zyFZ*ZFSE!00<6!|+#33&R)@RA8V9YRjp$HS9?CGq*xDSDRbX#i;}mateEF{fqTI zt?X}Efkq_Ap*_ETgaikOBbQ|;47}hwX44K`(DUI@C)QiG&6UJ1UmRn*Q@6%e`+x(gpQp74O{;yli8YLCV}qD z4gIyZd_(8ED~WWaeXOb0^r=9=AiDT}by~+$KVF~M{ywbQl zng-h?a_E;yX?DCr4|_h7JMc7>xgWf7Ek-VmH^hCYunVp3{(d{---&%-GZ=rK#V5Jo zJvP8b!2AA5?9)G8gwzB6ze3TU<5*Pqms^Q-?C9-CN~4hb-`U0D@kAkTWn23``cao^ z8IWAp8h7`%ZA+eI?w$sJktq5m>e&0@mQn>2BdpKAxbj1$m$8Z;`!iFvl9($Lb9Ff? zT^6cTZ~HgIeR6R*;G(rzpgsJP41Fx9Df;G6{;k6T(i}&8hX(jHSC@~#X@70h#)g(( z*9vUC+a*b%oAdf1$}Z3NR;|c5nY4^Z51pfqk(tmJbB;Q#ka#tf5eae;-kq$I{xO3<(TI$0lSe-JQzJ*es;il=Kn_?&?E zfLbs{qErPqm)-*ZfwbA*D-shgb|1;X;cH*yA|q8gS=HiosF=-kbdk6--SR+`F^H_` z0*i`J==@XSe=HT;_``G}ulE=H@*3GU*?gVd@h*`eT^GKjI;C@8+h~;(u3bA#b&bN{ zYw>dJ$(;RfHDLlndS`CWOE=g0jOocCc&;w(dOzrLf4-DK*MD@P_;u&CbfMw=#Q-B` zDq8hGwKN-O7(hQA_bP3f5XrZH+@*FGw~ppmDgNWcf|Lf*Pc%e5dw1DcJ1BWm!z7z3 zr^toEU*P(>G#;_1X}Rz(5lbDtCui%hY^d3lm)kw0vyk zX~K4$AG#7cG`6s2%9g9zsaQ9o?;3yzW4Pt!;NlS zzI#G7tiq&@eV&}qDtY(e$1JwscAfle%Al{3>Nr%``n?`Jac^CdOXUbFgI3;m{RkA~ zokl+lxuw9=%W&MmzA+G%ZdFMMP&N2^6BWjG2Lt|xKx)lMCR@b0n+xgw<)&Dwi?}>- z+$_e|@M;uW@3z6)q&L7bYitZ%huzGqH_qHOr&G5o!?(8TJv_MN1ka|&c6_!Q>#PgHSFoPWiLg|k_{ zQd#Zy&BPkU(0OE5S35!B5qb6%T3Wd#J(zBl8dw6I#xIDDF-LBPi-jXv1E?!gE|1OIdTejK)+U3ooC^otSIRsWZf-`&K}6}s!407Y58zH zK(oYx*7sN1O|Z_1YIJS_H$E@DH(hB4QKNCGQT3PTvwYoe2&8WKi5`5tU-r4!>_V3XUT}N)>8V;+z-!@-IGCKiD>E9RC(K`NMx=;Qp zf$2g^t?)zpU0L!BZi(oE#)^Z_biT*Svh>r#%1=O+Wo37G`Q)4@k#Pe?^mgBIugC)8 zyEICH=`{A~^x#X&%tr-$j|(nXrIrGQYNY+C3M+LO;yUU4-|v>a5#P)XYp>_|C0f0n{_p0mvwWmghfd%!Cm}$qBDxOqA3htLs~ghSA1>6^dVgd~ zVHHBBy6;Pp=El;dkTE=ttp~BoOJ$L@EB3Z37T1kTNG3tm4PY5O-7hP5DA$-k=vV&6 z?RiAm;W~*o)R7!x9>u$&@|&D4xMmJ*y+^-6t!F0u8G~78t&Bs#W>w_NbW>W9M3tXWXRf zI86FWVx%iXXh6MJ>dg#?lNu{K@S#nzMIG4PXQd%!Bvc*H0c7F_Y=adptJr*cHevMQ z%?Xu~q8CFw>^L*S_83kVhq=)hf0%_Lq}SE*g(Da_A{kXVZfAd*YCwp~bG32wi&SNM z#QZ7}Ug5-=+s^uqAh_|}gzya<(&E?XAZ%0ybd9nraj?|z1YfPr*{N?Q{ji}YG`T#| z=uwJZHIMlsmevnenT#-)t$L*=2wh|1EYXW?_36TR?L!sUItJVxaC0$Gb|gq4{|4gA z(v0ODFj!T)jc5>65ys)* z7$aBHfbKdz@QJq1b`NT`344*g()$>5*Ey`TPB7WI;|_8o8t9-_4ikFub|I{66>ge> zHA+6onzFKY*eaiA!77SD*^&LyumAR6gSvxY6Q?;!AvI{rZ##!G$%ZfIgce4F`aF;e z?jVh%+B-vj69ei~bh_zA9w}S4B4rzRKQ1~u$gwVu_x5PlRKDXX2(_2Mm7fs%6{SS7Qh1gWT8xaxc=f8`mW38ukIZxwU;lmHABwFSg50*o zrj%f%j~IKR?N5Dxwrq|sTa?!pd{b3sFM&~{4~_^YH4$bI^Fq2W4-y`))^|7fS?i0) zJ&Z9wY!8%l7@gAr`2{fqA;L;ptQR*X2|xUtrT47KK%XN+dydN$*M?65LuXTRabgERR{n>;E;(&vS0_@COY!p<%5LsRqGpER%~YjkSK zwBo9-2|-ZFiU3TT&S+@}3gDT35t0IXTzX@yHA(v>Y8;-mZNySQ&fE7RJ1^tzJfvdApX& z*!+tE)Y{oR%jk8A)3EiI3i*(TOwP!;B3hAOj?KQ6^h-q~1V^166uYS~mH*2Hh*0}r z`R3u1#^LG9IW|^QT^|61H(T1Jz?n;(Z>52lU0BO>Q6*zgpP*gTFk2Uw)!3zt>3F~_ ztil4!R*-j}wjh%&(kSB%}X=u4RbFRp@^l+$SmM@nW9B;yGbf@nasjFMEE{m9Oe

}qal5$moSACwfNXLXG5|3R0AtBcN` z?%yS)&>O>sqxU64U~C3&Q^>z-Zt}WuX4Wh3dKj9EO zfSbV!c3e;EOeKHQmWEw#NM4;*tw-2o@x&kKT?rsmy-F|$jw-F>WgA7?C@{O1qPg*J zf92|RTBMh&ptHADFc{T+cB?+mOj>h2HKgwkxq6w&XBxPc?>=JKvU2K9aU93@vp-R% z{5T=P$9U}AYZ5QU{3%7}YZ+ACWXw#-U zWyxU(OP#Q9-2AeGmCwcp`zWghf2hvsOjWjDQbU?U`v0&a--f1`v0Bd8HLiLmo)PKz5!A1|XVO+89 zm3h2~6yI~cpWor!_yt-?Lt>z`c0a7cJAW)#d8N8nNIf0H<+v;s4{0guDD(?T7Z<~$ zd`$vpZ_QQgFaMT0_d5&+(jwGU?M1FqUu6wjA-9z?mRM}(CmSdK;2e$Na}F-8jbhgN z9)@AIQeghf{xCC^{9P%VdYW1PP#}2BJwWt z0Hd8%st1NK5%h+)UB^mVwh{e#8TIm$xxgGo6I5;e{~VUeeMGRpM_Z%=eH5$X1}?Z5 z`|*_Vp~K&ziz45-Ih9y>EOr(Buy0&n$dbQ4$5eSr=Ti z#~7^n8dmem;$0D4+6eV7&G2D~d@ z+R#u8+nw_N%7_U_1e53P?~&10^m|ZUXrZhVp04lQLsGos%0fRDhS=@>8TOAAxK;Cy z9GZw_1pfSxD5~xoR!INI?tU0wrKDd6^Tv{jL>`Xb49kBaNPlhMaIfh_nq_)zB7NcX z05XeQKz`@BDUx7*i!V~%dc8XQ#ngBw0A2tSr(npSCrNy5Z7>48v&Zz?0{%FRElh_h zN2|?#EhJL5HQMIu6m1=ypTR?tVymHK)xQvS9ir7FzMp?CjlND39PK`od#GytVhZWp zQ1@>MTE1*Ip>hnXSWa?XbMH#708@j12yPbm`JfcqIgmJepn$5YgkJn_%5I)mr`Q(k z-a0yFR3A`houhvf&|wNpIsV{2p%MqhR@`@R(l6`}iufEgI*UxWq~26?WTpZCV{JtG zYL?&#I98fyf_;2S0?_V{=Aa4t^x%vy$pF$_Lh7W2f*~5uPvGYh;vZhMv|u+Z?2t0~ zcYPXdxbg6OS*LUjR_=jLDt)ab6;?g1IuySLG@UE;jLpt-wjLX&RlY>fnd@f&?0NyT zht5vhP^};k6`U76$%&I)iWPNxG6KPjdh`S6>g9GN@;KObQsLG zKyjfrPR0PU1B0a0=)3@9eCDl?mB9rFdlTMtTAeZv2}F*|@JWleq2+H1bt>>x!^wTk z+I)cgsZwzCMwoRpW_*!3IySTQu!`HWugAXe(Ai(a9Rsu;*0#o6torxwNMxPzEAjt` z>70Vw;HCQ?AnP`RKQ;2R8h%;LI#tx^(MO*lMWJe4_?)Q571P`kTmN#(ez21V!<6+S z@Uap+y%#8&cGgdf+E@y$dUx3g#)=#5k31Vqv0p!%L`*=-PiQAiSg-d9lKRZQDuJ-| zA96zwwomG+4}X$vR*IU=NC!vL<`rUTbf_uRJC4FS;k&HtV<=<)p(qymH)=MDV^aqK z#%sid7K|~!H`J!7hRr~Z!emxgWq6#GpQs%c#BM+scvNGz|Gi4G`;8Z~dP8)+51iB8 zw)0fazNz5(iK$LJeC_4e^8&@wT(DZ~~>SStz3P(>V8CLNlZqgv=2K-|Lu~si@XFwMN>QE^k zVS2U_A?Q$?M`NkU}^!M8m%O&T=kW>dG}1s2I~hxp9Y=a=1XX-(fB5) zej3`e5Et~R^r%?CZK0)UZsF_+tSOGIBMdrtMf#oJjGF9U`*P8t>i*TWed$Z2WNUZ* z_1Qw4Yr+Q0@bD?hD0P-^v}?FpPBg~zz5~g@J#J76C695|P>1l;OS8%~hZh5&-9Ji# z50%&56ZK4FC9}{jHL0!=qo9Yd(GGHCEX2|-F(f}q6@NMT4P3rQd{Q!=bz-8N(Z^!N;;ZzAWRf@C?X>mG=_NgyQX_?Jv$m(9$W>P;+e}O|&w&DjbsJPdWp0A2$yLr*!BY73Z z5d*BCaTI)w=sTlofc>n}@v_tSXIK?8(g`G_06u>SD*fOZJ~visq3lBVS2+cf-r$UQ zZ(8A0g&5M$IV7w5nqL(m$VS0X?=yy-e6>S>Ca3wZNT)b{GF39_gJdONflqc-j$b~o z2l@@h{$KVfC)V?#We*)@xYC;L^<@cHo>8axRMbSzw|eYTl|8pkabsQJ(3`z{>5H}c z`psz_Y6t)hvzL^=}P#++XUl6v`-j)SuXd6BynjNZ!&c2hnyE&4*K$nXn31Zk)cm+lx;> zya{T?{MRtSu?^3Y9bS&O$*mW^vRUpv!J3Tz12?3&Y62b_oiZ$24O(75Z)JWb+Rj)ACbK`f<&tSwtT$|Sy z$41kRPiM-jnPY9PKrLyI`pHm6LusMsrO*HpmE){Kp1^u2t%6nW^;GB|!4k!Ik8oav zjM?DBKh9G@W0gEwiU-M}0B)}olvoM71RccgiZBCs)L?q_GX&JDhegx4k2&cNatr5w zU)1#2USb8&`etO5Vk z?0}K+*2*@a5yt*X{qg0@8jEz~jcylVj>-042p1PBnabI#xUiCRD!ouw3?u-wwsqwF z8(@m8-Lk7q@v154g6yvx_tRDa>}oqpVda)wfI9(;ZVGt1v^{<|X?vC_(i@IJC+2I_lusrT=$h zF1lPc*Neb`;Xgrdf`p$w)~MzQW0M3_FYRKu{2$VU82J^B=X1#^<&P$_`=S$Ey04WU zTxG;hrFNLhWC*p+sH3x=JVcBJ9*7>eO20)n671SxQhZQlHMRP8FyO}yai~OTsbms0 zQ3b$C1Cn!>jMHDq{VX1ab^~_Q!z+f75+_AuwiN0*wA_#M#0|rU{+NlB%>Y+TNT0Gj z`3^LKMSJjz2(?lwg~ixDl_5%rzzZ}o_6Fj9e)T7gpH4=BgT1zmwJpC@g(f%&0`}8B z%7Y&qlP3aFmI#nmT`|R3+Lwzp+PLXt|5g%vlY_$fvse7zjus0D0fA##r+i4G4K-2Y zC#H95NGoYfWP#ZF_v$^Li{PZpm}fc&)aL?5doPcb835Cr6`T+EzzcEvLtmXcbAb<^ zw!_Zgk6Az7YA@*vb)(G{_W-B|zrf76z^`X%jOgqIIaqi~5nUup3vugzzg&rA^w(zR z+qCzvIV~nGR=47pDOcNTzuBw#5a=<=DMvGa)g zPw$^pmq9Fg&b#BZrPSoml(149rZS!fioV*Dy$z440U3MXDJmI?RZqLy0}IKSxN)o( z8+8wIZs#q(|KTg6y;Z(=96>xfpUsr@SP}I^v zN^R;ZVrDaWmNrM5-<X@k6JyjvA3;jHhma|Y|7!Vk& zgf(UK_6~cC;!|b!YTjke=nBiUqQdb#I9TY}!s5P)H+^c;9cW(QO8O%n5J^8Xfktd*qrn)+?-gP`m%B&q zi^}7jKm`yMW8ITFOMN#!QIB6$SWx*75tnCMaNg*_J*WuwBh~AT>0($nS8%&zmFQDp z$dL65niDtTV%!Kg1`6epWoQGNG`$`doy;Zjaa`keyL0F6iJMae6FIgnhAfzU%m@V+ zm5rQihLwS~b6{-bVR1ZSzBI7(Yj+V6T-8V*7I`ptWArGdy~8pnV>fALpi~NQLZ7;^ zpaj35=md<~-(tNmF69UX3?ua}A7UIn)q5i1iPYEGlhYSbkfeX`5epkxtzk3Qbu| zlgA`7ts%IvF4HJ}-98akyRnjCo{u-`A4&b+r?s|o`4wdYAHs-yh91p$7C_|+EdYH5 z10`!*=n+W9g>V&dfU1H!J}ASZi&-?`2IlDOAHnu306rD`y>jT)4^@S(X4XhN2{g9i zj-ym98+RT|d0ejIFJCM5>S{mT-8uGmRRqkJ3sMO_AQDrv77Q zv$t>zaVpVF6eBguE%9M2u?E-Oleft8z5+~W`G}KXD(Yc;7m4{Op>Le(k`g1UK7(1# zt6g}$n=Tdn{T4pu>v!c;xRCd_WI$Ali13x=U_0T!Ga-U~9W88q-lU+RLn2`N8Ouho z^0@SvC>$DguHWx)?^*ms-{PVq%dn(U3vrLj9zITDqQZ`H>Wsp@Gf%}SG=m)Vh}F$ztQAbwVGdDgd!28j&yX9wLW&s! zNR~6`nYg;ULAq8zi<;gUchAV5ib67Y##l2 zy+%gaD(|~G4@||{A;TYDSoS>q2o{t23t-^!NDSDEm8j3ao7Ei>KYLEpb$jz}7ciAM zD}trDN+AVVT_lXW<++~>8>Cj8fzJo@R;>%nGq)6+w?(#mNc#1J4W+!hA}?g$0Xqo? zn67qJmss)e%k(xO*&K@z6+}nHA(lCkb6n-|{pSztys$8HiOWTVR)tCO*Q9~if%3n7`uxGzE+OCu zwcVV|tgQdq60952$>85-GHk$lwM(uI+CU1?i{sVnKd0+UNq#eSSKjUKfDDgLnBG1y z^v?f#MRFkph~TgkoKBvM`L_~we8__xpLcjh`GwV|87q`vazJq?SX=mXhdvK>VqUf~ z4sYoTIpt5S)KrE-?>&=cRoBumD7;b5pq!Y07)#I$`)<@U+mo*dE*P~773p*u^6waO z2#thJahX_ySlYMpjx%h<)i43ao~Is`^Ya zMNZkuChEA7+ZJe6$>-C*dzTYf3#1SY82yFG?S&Q)5rTbKS-XLjckTLEc7>^sFcntQ zBeNXCSg&q1N3Bi^4zlQ%mcEBQ%2ab$?(;t-$HYd2%cnX$uuwU#I_6D3($m zR(>gHzM9ODf;r8b0l5LuEIQVZiQ0-|3Y_xzJkZc*CD=bPJ+&J+>>se%D4uTq?Ny{l z0Z5~og*Wa1O&anlcRWu_%o)(x?IZ0CfUNk_R-ik>GyvdFmpu1wHZaKTDGhL zqxsji)n<+)VKbV0_BRq9E;Kb`f=&vn(BK0Ba-gL?ZN;^^b3YFg6R=!q#zM;tcX0dM zdy5PPx@6pJPXHzH7$dGjM|6@6777nXPWV;CIQdNf(*Znv)sMy&Xcq> zhCq+6h6&v8<0}vd2(sKqU3j>fr7&#Xy%qZHcMU3m{wld^Nstkz8GagB?Y=SI&H z&{&BSA-|(i35$9(l6LpFyLm$0M0fK`Dz!~ezL?yEInsXAFR!bHe;ZL>Gd(#Hv?<$%`^b)oi?x%(jkylCPb=juPlF znMo&o961=NZ_$gd{xp1ZY2dNDOS!=XVj!M^A z+$z`EK4v=m{Bs{&I4W)({`&<5*^BV#z{IBAI_d+9Qx;~ zby?2zEjzUUeZWBDo5cz>%;z||z)<+6UtC)y60yD5J5`oo_zSM;l21@CY<0_|)NME5 zs)kHCMBa5YzB#N=W2aR?y9((~WuYwwf+HAc2mvU>NYlxOTvGf^Ye3za?*f-qUs^`a zT3>RPh9*Jf%3*bf|kqtnD_Buxv!<9N>BbuD#uYv-q^ z%RDnd7a3O4M9Y~TNISS@9K}JDkdg@>x8E6@n8jF=6qiDV+}{!V)(o?ykcr0sxBGEx zo!X;pc=r{H^vw6ztV5VZXBa4~(ujB$rZQ|AaGN@J7#q%2nU9gJ)g6dcj}zYB1& z@iFE0vMQVxa|v7tDHS$gwX$Ihc#M^DXRC>J@Zk?dC(3uB_s~*W&m-01DFMQGWjj5x z5po1@1gPl!v1Yra@qPG{D;$bYLM3qOwpl~7f~l)#n< zP+6`!NYe3EE~4RFR#_e=7YctPRBt6$He@`%e5m}f$M%yzC2S0<1}hRPjO>HJY~ z*dx(nbMbjv*;o&k{qzBdF|lS;UNVKziV=gbLq}UOCwr8GT5E9oRYQ}+>DhbQ1R=lj zgcNJN8|D)$Mx3#c+t@lhqcDUnHGVt0&EyQ{b5)=52B(VTzw=pQ^ba3`JB@BU^lS`_ zJEiLzgU#Acd_!}FMxCWC**FP^i#P}bYzNs78)#uSejEtYLbG>JJ7Igtho2oKQ;XW~ z4eMGO+t!_;G^V6c&R`5Tg+Pz2ToN(aybq4Q0ssie_{`t*DO%V7FaZ`{MBobFc9|pV z70o5ayHGJo9$$&Pgbs)pWNzduAcbh?~U?_P)(ve0S*3H%eNF&a5XR=!J#4c z;t992n7ZJr{*%`^dU1d-ALE8!3i#v;3r4r%j+JFCe=%3Vj=8{aXe zs)jrcUBZ=;LudcTUXj2ub>K5!{HHFHJ}Trx(PYugbQ8yK7&sqX;(;|UWjk3tGs3zuceeX)i4i_jA8Qz2Bc%DxN8 zXw!$+9jBtEHd1y90bYG4f8DcJM)Ab!M39tH5zz94*MAvnhA377@buNupSOUU3j8~> zd6&hk^ENRCp9T?_QUHk<=(&9Q^MJ^pi;nKOYNR@?L=RCSmKMJ5UQJQ`X!i~(gD*P! zs`RobzJG3Ra_Pg+WZUXUmMU$ilpwfcEti6)mw(~MZ0q!^sza>#jv!-+7B6F3QuMWg zVO!rXwD+lF1BBTito?ml-CV3vxuek~TKuOX^N6sol$v*{_%nAuD7i81eXm^Lz(Z~I z2Xj_Dts#G0&C;PV_Wkq*1QvB7+Post4={v;gk7b9u%#DC_bh(iJm$rqog^{JEx6NE zrs5^2SEL$|98#2WV#iG@L6cq|)SuTMSfGocPl65wUd^|5Lbpnb(;t>-Qu2jvANLgv zdte0vED-3C@^BdyHWLL(7{G$WA02z@JG!T-U^Q7HZ(7Bs&vchkh(p&}KvnS{MG^i6 z4r){gJp9p7WyWOEiKA2Cm6EXIn&&gk|Fc6^78OpPrX4ExCFE=SD$xcH;C2eB^{XTI zaxz_Cef*Yj==w_i_BTGXP;8C&f? z*QEM>={jFM8)lWAR870pG4XEWsl%%K|82S5b=9hVz7p_6i-d(Iyvq76&a#PV zR;VbQV|n?mg}&(ehClg%tK%IjgtnTR-u)lxH06XxXqH0soAZbB_Rm)XX=6Nge1uoG7 z9vQM_S~2h53n|W`y{{R9+=08rv~MohI_v4-BU^7fZ0-A}#b5{AOSTJm+(J;9yw%pD zX6u62GJ&@HKX5zQwq~j8T!Hrv-Mk^QSB5cu09L03{ToDO7jikM0WAcsjW>D}^jqCF zT0DEZ@K^KO_MD*%M!+V)lGVU6?LpX)eQVXEmq}R`NIJv;kBitJ!nW?0OxTVlu2ADf zE{A!*0g3%nwVcBD+AgT5bGx@WOnQk{zRpiZ4HhP`3BF%N|HdqPbbiV5)7x)kzC3ID zZ;27>0^mrMgWc7evsbQY`l`l})wr+e;=8U_!2&B77;1qL!N8y)eTJ2lf#CvhR~!Qa mc;sM|90DP5A*JW%f2r=u1xt!e4gwD_V(@hJb6Mw<&;$SznOm^{ literal 0 HcmV?d00001 diff --git a/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..cd1360e9f5f --- /dev/null +++ b/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json @@ -0,0 +1,283 @@ +{ + "attributes": { + "description": "Azure Frontdoor Integration Dashboard", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": [ + "azure_frontdoor.access", + "azure_frontdoor.waf" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "data_stream.dataset": "azure_frontdoor.access" + } + }, + { + "match_phrase": { + "data_stream.dataset": "azure_frontdoor.waf" + } + } + ] + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 13, + "i": "f8012579-e741-44fc-9470-5348fa7a6821", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "f8012579-e741-44fc-9470-5348fa7a6821", + "panelRefName": "panel_f8012579-e741-44fc-9470-5348fa7a6821", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 13, + "i": "a318c8ca-32a6-4115-81c2-7448d02f30c1", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "a318c8ca-32a6-4115-81c2-7448d02f30c1", + "panelRefName": "panel_a318c8ca-32a6-4115-81c2-7448d02f30c1", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "75629f82-636f-47f7-8080-b18e3e32fecf", + "w": 9, + "x": 0, + "y": 13 + }, + "panelIndex": "75629f82-636f-47f7-8080-b18e3e32fecf", + "panelRefName": "panel_75629f82-636f-47f7-8080-b18e3e32fecf", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "9d7f41e2-4835-49cd-97a8-3996b3803587", + "w": 17, + "x": 9, + "y": 13 + }, + "panelIndex": "9d7f41e2-4835-49cd-97a8-3996b3803587", + "panelRefName": "panel_9d7f41e2-4835-49cd-97a8-3996b3803587", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 17, + "i": "a66e658f-88dd-4098-bc14-52775b5b32b5", + "w": 22, + "x": 26, + "y": 13 + }, + "panelIndex": "a66e658f-88dd-4098-bc14-52775b5b32b5", + "panelRefName": "panel_a66e658f-88dd-4098-bc14-52775b5b32b5", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "408c25ae-832a-498f-88b1-c677a516195c", + "w": 17, + "x": 0, + "y": 30 + }, + "panelIndex": "408c25ae-832a-498f-88b1-c677a516195c", + "panelRefName": "panel_408c25ae-832a-498f-88b1-c677a516195c", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "95cf95ae-16c3-4787-a9ea-a401f6a0246f", + "w": 18, + "x": 17, + "y": 30 + }, + "panelIndex": "95cf95ae-16c3-4787-a9ea-a401f6a0246f", + "panelRefName": "panel_95cf95ae-16c3-4787-a9ea-a401f6a0246f", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "0c6e0763-18cd-4360-aede-b92d09e7a2c6", + "w": 13, + "x": 35, + "y": 30 + }, + "panelIndex": "0c6e0763-18cd-4360-aede-b92d09e7a2c6", + "panelRefName": "panel_0c6e0763-18cd-4360-aede-b92d09e7a2c6", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "a7777948-86d7-42e0-9463-032b402385f9", + "w": 24, + "x": 0, + "y": 42 + }, + "panelIndex": "a7777948-86d7-42e0-9463-032b402385f9", + "panelRefName": "panel_a7777948-86d7-42e0-9463-032b402385f9", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", + "w": 24, + "x": 24, + "y": 42 + }, + "panelIndex": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", + "panelRefName": "panel_aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + } + ], + "timeRestore": false, + "title": "[Azure Frontdoor] Overview", + "version": 1 + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f", + "migrationVersion": { + "dashboard": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f", + "name": "f8012579-e741-44fc-9470-5348fa7a6821:panel_f8012579-e741-44fc-9470-5348fa7a6821", + "type": "lens" + }, + { + "id": "azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f", + "name": "a318c8ca-32a6-4115-81c2-7448d02f30c1:panel_a318c8ca-32a6-4115-81c2-7448d02f30c1", + "type": "lens" + }, + { + "id": "azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f", + "name": "75629f82-636f-47f7-8080-b18e3e32fecf:panel_75629f82-636f-47f7-8080-b18e3e32fecf", + "type": "lens" + }, + { + "id": "azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f", + "name": "9d7f41e2-4835-49cd-97a8-3996b3803587:panel_9d7f41e2-4835-49cd-97a8-3996b3803587", + "type": "lens" + }, + { + "id": "azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f", + "name": "a66e658f-88dd-4098-bc14-52775b5b32b5:panel_a66e658f-88dd-4098-bc14-52775b5b32b5", + "type": "lens" + }, + { + "id": "azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f", + "name": "408c25ae-832a-498f-88b1-c677a516195c:panel_408c25ae-832a-498f-88b1-c677a516195c", + "type": "lens" + }, + { + "id": "azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f", + "name": "95cf95ae-16c3-4787-a9ea-a401f6a0246f:panel_95cf95ae-16c3-4787-a9ea-a401f6a0246f", + "type": "lens" + }, + { + "id": "azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f", + "name": "0c6e0763-18cd-4360-aede-b92d09e7a2c6:panel_0c6e0763-18cd-4360-aede-b92d09e7a2c6", + "type": "lens" + }, + { + "id": "azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f", + "name": "a7777948-86d7-42e0-9463-032b402385f9:panel_a7777948-86d7-42e0-9463-032b402385f9", + "type": "lens" + }, + { + "id": "azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f", + "name": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f:panel_aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", + "type": "lens" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..350ef054fa5 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "63bfc868-ae64-40f3-b7e1-62e2150f7704": { + "columnOrder": [ + "f629af01-d102-4903-9bbb-c7e80e525905", + "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631", + "23695d1c-b544-4e27-9205-100f67392609" + ], + "columns": { + "23695d1c-b544-4e27-9205-100f67392609": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of user_agent.os.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "23695d1c-b544-4e27-9205-100f67392609", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user_agent.os.name" + }, + "f629af01-d102-4903-9bbb-c7e80e525905": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of user_agent.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "23695d1c-b544-4e27-9205-100f67392609", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user_agent.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "f629af01-d102-4903-9bbb-c7e80e525905", + "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631" + ], + "layerId": "63bfc868-ae64-40f3-b7e1-62e2150f7704", + "layerType": "data", + "legendDisplay": "default", + "metric": "23695d1c-b544-4e27-9205-100f67392609", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "palette": { + "name": "status", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "User Agents Names and OS Names [Azure Frontdoor]", + "visualizationType": "lnsPie" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-63bfc868-ae64-40f3-b7e1-62e2150f7704", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..b5d94293eff --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b107299d-3122-4b2f-88c9-85b3e414217d": { + "columnOrder": [ + "f751542b-d8b3-486a-931c-545670d98874", + "a392968c-6481-4eba-8752-46420557d21f" + ], + "columns": { + "a392968c-6481-4eba-8752-46420557d21f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "f751542b-d8b3-486a-931c-545670d98874": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of source.geo.country_name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a392968c-6481-4eba-8752-46420557d21f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "f751542b-d8b3-486a-931c-545670d98874" + ], + "layerId": "b107299d-3122-4b2f-88c9-85b3e414217d", + "layerType": "data", + "legendDisplay": "default", + "metric": "a392968c-6481-4eba-8752-46420557d21f", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Top Country Names [Azure Frontdoor]", + "visualizationType": "lnsPie" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b107299d-3122-4b2f-88c9-85b3e414217d", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..67d2e9b4d74 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "d889492f-07a3-4ec6-9334-7299e029d385": { + "columnOrder": [ + "08f47d60-115d-40f0-b9fd-9bf1385c766b", + "77477f59-4dba-4ec0-ada1-093ffc78374d" + ], + "columns": { + "08f47d60-115d-40f0-b9fd-9bf1385c766b": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of url.original", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "77477f59-4dba-4ec0-ada1-093ffc78374d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "url.original" + }, + "77477f59-4dba-4ec0-ada1-093ffc78374d": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "08f47d60-115d-40f0-b9fd-9bf1385c766b" + }, + { + "columnId": "77477f59-4dba-4ec0-ada1-093ffc78374d" + } + ], + "layerId": "d889492f-07a3-4ec6-9334-7299e029d385", + "layerType": "data" + } + }, + "title": "Top URLs [Azure Frontdoor]", + "visualizationType": "lnsDatatable" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d889492f-07a3-4ec6-9334-7299e029d385", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..0024a6326f3 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "bcd2b4e0-0ffe-4901-9588-9687fc86a3f9": { + "columnOrder": [ + "423ae552-3c4e-49db-87b6-eb5802c317c3", + "97038146-0485-4c93-ad56-e815957ef6a0" + ], + "columns": { + "423ae552-3c4e-49db-87b6-eb5802c317c3": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of rule.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "97038146-0485-4c93-ad56-e815957ef6a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "rule.name" + }, + "97038146-0485-4c93-ad56-e815957ef6a0": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "423ae552-3c4e-49db-87b6-eb5802c317c3" + }, + { + "columnId": "97038146-0485-4c93-ad56-e815957ef6a0" + } + ], + "layerId": "bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", + "layerType": "data" + } + }, + "title": "Top WAF Rule Names [Azure Frontdoor]", + "visualizationType": "lnsDatatable" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..aaa706d8a81 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json @@ -0,0 +1,134 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "266caf24-daea-453b-a081-b81a3a1a5d34": { + "columnOrder": [ + "db61d40a-769c-47ad-b7ae-6384624df2ea", + "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b", + "ee54a93c-ed19-4e1b-84ff-52144faec318" + ], + "columns": { + "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "db61d40a-769c-47ad-b7ae-6384624df2ea": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of data_stream.dataset", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "ee54a93c-ed19-4e1b-84ff-52144faec318", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "data_stream.dataset" + }, + "ee54a93c-ed19-4e1b-84ff-52144faec318": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ee54a93c-ed19-4e1b-84ff-52144faec318" + ], + "layerId": "266caf24-daea-453b-a081-b81a3a1a5d34", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "db61d40a-769c-47ad-b7ae-6384624df2ea", + "xAccessor": "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "Logs Over Time [Azure Frontdoor]", + "visualizationType": "lnsXY" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-266caf24-daea-453b-a081-b81a3a1a5d34", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..f7eb3a171ad --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b136b727-78fc-4467-ae19-7284f19d1e8e": { + "columnOrder": [ + "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac", + "9de17676-7ef0-4ff8-a6a1-52df55f74b6f" + ], + "columns": { + "9de17676-7ef0-4ff8-a6a1-52df55f74b6f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of azure.frontdoor.waf.details.msg", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "9de17676-7ef0-4ff8-a6a1-52df55f74b6f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.frontdoor.waf.details.msg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac" + }, + { + "columnId": "9de17676-7ef0-4ff8-a6a1-52df55f74b6f" + } + ], + "layerId": "b136b727-78fc-4467-ae19-7284f19d1e8e", + "layerType": "data" + } + }, + "title": "Top WAF Detail Msg [Azure Frontdoor]", + "visualizationType": "lnsDatatable" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b136b727-78fc-4467-ae19-7284f19d1e8e", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..42a5abb723f --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json @@ -0,0 +1,134 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "0ee62278-341b-4d9d-8f65-44eef424786b": { + "columnOrder": [ + "823d0215-ee4e-4572-8a2a-e39893ece10d", + "74ecbafb-fb61-4678-820e-e0cd221307f4", + "f14be824-7dc6-4399-8491-5777389b1f1c" + ], + "columns": { + "74ecbafb-fb61-4678-820e-e0cd221307f4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "823d0215-ee4e-4572-8a2a-e39893ece10d": { + "dataType": "ip", + "isBucketed": true, + "label": "Top values of client.ip", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f14be824-7dc6-4399-8491-5777389b1f1c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "f14be824-7dc6-4399-8491-5777389b1f1c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f14be824-7dc6-4399-8491-5777389b1f1c" + ], + "layerId": "0ee62278-341b-4d9d-8f65-44eef424786b", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "823d0215-ee4e-4572-8a2a-e39893ece10d", + "xAccessor": "74ecbafb-fb61-4678-820e-e0cd221307f4" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "Top Client IP Trending Graph [Azure Frontdoor]", + "visualizationType": "lnsXY" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0ee62278-341b-4d9d-8f65-44eef424786b", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..d6c46ff71c4 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "dbf953f9-caf7-4403-aef3-0f888754526d": { + "columnOrder": [ + "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9", + "79b721f5-7a2e-4c74-9c8b-062b9b4d98db" + ], + "columns": { + "79b721f5-7a2e-4c74-9c8b-062b9b4d98db": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9": { + "dataType": "ip", + "isBucketed": true, + "label": "Top values of client.ip", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "79b721f5-7a2e-4c74-9c8b-062b9b4d98db", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9" + }, + { + "columnId": "79b721f5-7a2e-4c74-9c8b-062b9b4d98db" + } + ], + "layerId": "dbf953f9-caf7-4403-aef3-0f888754526d", + "layerType": "data" + } + }, + "title": "Top Client IPs [Azure Frontdoor]", + "visualizationType": "lnsDatatable" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dbf953f9-caf7-4403-aef3-0f888754526d", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..a9fd37be868 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "15580362-caea-4ea9-85ba-7583ab86c799": { + "columnOrder": [ + "d6ceac1c-38fa-4025-a94a-f6f2001ff848", + "61b5338d-8241-4b3b-8e82-193b301068ca" + ], + "columns": { + "61b5338d-8241-4b3b-8e82-193b301068ca": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "d6ceac1c-38fa-4025-a94a-f6f2001ff848": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of event.action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "61b5338d-8241-4b3b-8e82-193b301068ca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "d6ceac1c-38fa-4025-a94a-f6f2001ff848" + ], + "layerId": "15580362-caea-4ea9-85ba-7583ab86c799", + "layerType": "data", + "legendDisplay": "default", + "metric": "61b5338d-8241-4b3b-8e82-193b301068ca", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "palette": { + "name": "status", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "WAF Event Actions [Azure Frontdoor]", + "visualizationType": "lnsPie" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-15580362-caea-4ea9-85ba-7583ab86c799", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json new file mode 100644 index 00000000000..59ca4fa8aa7 --- /dev/null +++ b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "de5a74b1-0388-497f-b8ed-876c2c7c8e2e": { + "columnOrder": [ + "6b9235d9-4048-44b1-8285-d0867607799f", + "c006439b-bdfe-4054-972e-699fb00277d2" + ], + "columns": { + "6b9235d9-4048-44b1-8285-d0867607799f": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of url.domain", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c006439b-bdfe-4054-972e-699fb00277d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "url.domain" + }, + "c006439b-bdfe-4054-972e-699fb00277d2": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "6b9235d9-4048-44b1-8285-d0867607799f" + ], + "layerId": "de5a74b1-0388-497f-b8ed-876c2c7c8e2e", + "layerType": "data", + "legendDisplay": "default", + "metric": "c006439b-bdfe-4054-972e-699fb00277d2", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "palette": { + "name": "temperature", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Top WAF URL Domains [Azure Frontdoor]", + "visualizationType": "lnsPie" + }, + "coreMigrationVersion": "7.16.0", + "id": "azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f", + "migrationVersion": { + "lens": "7.16.0" + }, + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-de5a74b1-0388-497f-b8ed-876c2c7c8e2e", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml new file mode 100644 index 00000000000..02214eee542 --- /dev/null +++ b/packages/azure_frontdoor/manifest.yml @@ -0,0 +1,76 @@ +format_version: 1.0.0 +name: azure_frontdoor +title: "Azure Frontdoor" +version: 0.0.1 +license: basic +description: "This Elastic integration collects logs from Azure Frontdoor." +type: integration +categories: + - azure + - network + - security + - web +release: experimental +conditions: + kibana.version: "^7.16.0" +screenshots: + - src: /img/azure-frontdoor-overview.png + title: Azure Frontdoor Overview + size: 600x600 + type: image/png +icons: + - src: /img/front-door.svg + title: Frontdoor logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: azure_frontdoor + title: Azure Frontdoor logs + description: Collect sample logs + inputs: + - type: logfile + title: Collect azure frontdoor logs from log file. + description: "Collecting azure frontdoor logs (input: logfile)." + - type: "azure-eventhub" + title: "Collect azure frontdoor events from Event Hub" + description: "Collecting azure frontdooor events from Azure eventhub inputs (input: azure-eventhub)." + vars: + - name: eventhub + type: text + title: Eventhub + multi: false + required: true + show_user: true + - name: consumer_group + type: text + title: Consumer Group + multi: false + required: true + show_user: true + default: $Default + - name: connection_string + type: text + title: Connection String + multi: false + required: true + show_user: true + - name: storage_account + type: text + title: Storage Account + multi: false + required: true + show_user: true + - name: storage_account_key + type: text + title: Storage Account Key + multi: false + required: true + show_user: true + - name: resource_manager_endpoint + type: text + title: Resource Manager Endpoint + multi: false + required: false + show_user: true +owner: + github: elastic/integrations From cab955b51d0b7e5453d8b4e4c6bd6e5ea4389b2c Mon Sep 17 00:00:00 2001 From: emnp Date: Tue, 11 Jan 2022 07:02:58 +0000 Subject: [PATCH 02/25] remove sample logo & screenshot --- packages/azure_frontdoor/img/sample-logo.svg | 1 - .../azure_frontdoor/img/sample-screenshot.png | Bin 18849 -> 0 bytes 2 files changed, 1 deletion(-) delete mode 100644 packages/azure_frontdoor/img/sample-logo.svg delete mode 100644 packages/azure_frontdoor/img/sample-screenshot.png diff --git a/packages/azure_frontdoor/img/sample-logo.svg b/packages/azure_frontdoor/img/sample-logo.svg deleted file mode 100644 index 6268dd88f3b..00000000000 --- a/packages/azure_frontdoor/img/sample-logo.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/packages/azure_frontdoor/img/sample-screenshot.png b/packages/azure_frontdoor/img/sample-screenshot.png deleted file mode 100644 index d7a56a3ecc078c38636698cefba33f86291dd178..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18849 zcmeEu^S~#!E#4Tq;}?6chqwB{?k=6jc5D4>l%v(rleJ2Y%tW zDj9g7px}|*e;{M?LDwiK3@FNS(lDRTd-MJYIyUJCN948~OJk1M(DrJyI#iV;P4k~& zFZo35IfQt0RwlUN`48^6(1dv_wm(y1xhEdMld=Y?!%u=fPT_*{3( zwBwz3#qR}_)t>C*jp5@U)Ti~B)Y;qq*TRxZJ7ZRN_^A3TDAEM*@7Ve%(Ro7=1%1B< zVj6GBUTxXev>_^SFA zgKZ=g4aTS}9>Ofj7cSB0WO?gQ)x=+!hs_)b$6#>ScFZ>XAoIX)%Bc|BDC~JFBk0f0 z0NY}6gb)&!qx^FWC(!ji+Kl$V$2|ocA=vN0TM0Y`U?tX+T)c*C zA!IL(T2Vm%MCLa85^if@J@Kkprx8QN5!6eCR@4Oa5S?4-4|ou?90mFCM8D!;n(5xz zO}-*t!TntN>|a$s(kGQg1P-U?hqvGF2_fGvd&~yZ_l3Qf&j~XWa=;>N3#-~#zjzcc z*m18L`A-K2o!d@J>a8SRbm4P&-q1(H>|JgIymDbnJF&@008`=X!P?4DGgZb>voUl^ zNJKgPR4S={)3vuk_{n@=M8q;;aJL>q+VLdTnO=}`&x;1DKjJA3*f*idS{jP5?+;!W zn-^7021Z4zv`Aq`hmX1aid997RNh3fa-@PG(W7TzKa1W&5^y3|lPeETP7j9qXpo4)7%(W0_2 z^Nmq;t@rb1eP3?%kOkH`P%!zTC7ZHjSfNN3*Sb#=3#jB*KpNGNfnRZ{N(6DrW(;B2Bwom<%m?VQP%K+ zsFeF1-(DY}oP@)w^Kw~gPg03q?N;)Ec6^|nikA34T~RynX*z}H>R~qgT$`Zbhn8wzZs$j2fsGN&rOK-mIBBvzD@a8FgbLpL!h5N^u&0wG} zq!#md3MHITv?3@$37J?lc_5*LWJTTjel;IiU-Yq;(g9I^D&KN_NKVS0O~GvB~FzPM6}=4d%fG4Nw4pZshcyLqK@`b8?RhD38haIyr@+8+0r5TC1*C7^WleJ zZN3_ngTD#RQvNL*;qD2H@cBWJbCC#d!}=oKfod5SE9a?!?j%DVt1z@inN}Iy$r+96 zM@P?AC+(`cM;z6J94BYGJ;+P-N#yj$?`G26ydS&OVH?~JY(N4l()Fh+x+DoJ@r<+i zhm^ck@QP`=fLApr62@KyOef~}zuG;(VbDQmw|Wb+oSHSw=%w9R)=et0cY*~ytX)#M zEXlK^p;zM@vTnXn+C1vwP)~TJv|TvDE2($;;EzC5_5IL#H;u z)#CO8)TSzbt8)wHB8$I8KcIojx&GoE)3QNu{CQ+_xBmQ&`mL5-u=BX(hs^hMY^ zae!!*Q;Tr$@(0~GoBJAohGw*d{l8~!aXop87aaSUb2jm)Tk>#$1*cdo5Sl+?oD!l4Og~yX+soottl4 zp4OartUuAN(dD~yLJ}`A1*!D4-|L^hM;`_DM^1KYs-VF(}h(BjRO``b+xV~%O=-)?p z7ciJH7Fnl?V&=ay_AB{oQoa2iR;6$^tiE|-eRCFy|3F@%j#6gUxkZX@?K`F$u#;T< z4IZORpUthmB?U`;zrOkp?P(Rvd5TFRWrBJmVg;KEZvJ+;Q}FRY%QZ?c^&$oPXW+C5 zdN#c>v%U?QuE+hMQdzxS1Q(BT90;29qu#^A?a^)Ui;{TJ;%`nLgm2ew$J4NvREjCJ z$`C7&?tH$CrVG@M3J1-KJw_*9BKeL*JX{ zN+Vg_TXb9^jJO$ZGkXO6BBFDjt~w5`w2TB*z$&1W5Il3IiDs=ZMDt|9iRtKET*wF6 z0Z+|N87p-5Fh)^(*l>OVr5^aY5LW(@PuM>Qo@&)yj6XRkPm1>eTF#Y_c*aRF^ZY5A z9FAU7lKEHG@i{wJMPg;n6z2|69d-)q9@<7t()d-zPy&X zdXG7{Uw{k23)CzzQAXw#iqj<1u~W@K_Ljc#?ukh;fRKHeJ2l~Z+52b2n^bGiDF2oX zm25FLx|4AP8>rAi@koY03lrtS#X?zK591c?2iZ_jjc>0y>q9>fU<08o6zG%z9WK+S zDwZMW4~28wu#ye#V*@#5t^S@NiAA`3{SF$xINmc_WW^u-C9M=H>RQ1>WM=|R!660{ z6E6%DwX`eu<3pkmz7Z=FCRd$(vhDkc3yMnSr)5C*aho)DZ<12$`$TXj<8Z70)|rK7 zXFD8QzksfWZU`qL2K8X{C~TcF{KVW`3Y{IMb&)T9%1V`tv(HY1 z+LXkLyM|3mtLD{x-#hOw-U?sr-iLeHFA|=-sGZ4#hX)atL!a91(tWJc+og&5W}VfZ zpgE7`{5D`~?yGR++y7~xA&eU0N*ZezDjF$> zUeK&1aTFQRg*?v^Z2e7u<`lk$czR6}b6Cl-qA9%A`#A6q0*zyTu)X`3rhjR86NK3= zLdw{+-F}+b2gxd-qF7>Rla}dFkj|L#c|pg5Ni+MRA|BZH(@ME*o<1ijKcoXb%PVfJ ztp_uf=G%kvU((pHcw90Xut=}atA!giM-5By)f40nKp zv7Wdb{;^<}VRvruH~rYr~wEuYY2ov-5Q|p@u3Da9+z7PeIpBAwi?RxnxN3Kt+N9L(LUS%wxY` z>e&1VV;{CYw8DNRlvBH)>!I49SU4R!t3I4=y;mCevPZh!-}~G+F>6hcL_Rli4r zC4(WN)`j$>^S=~GMGR=^)A6wrqi(-x{xK37&Vx!OS6t=KQ2JVZo#GrSODtTe=TVh%*qfF%91nqsMNLNL^Gp|_ zz%I*HUkMQGqb!1eh{{bp|0GSCDbkG_D_d)8<(0r<6-%Qi7qDa7xZjcdZ$?Rth9L!f z$erCcs3<~mtupywbaT8NWZF#v?iZkvqSz3@p`RiXs7P!GUa~-U9hEG(NgI#3BzO-# z!9JWf(;r!*A=@g$f}>wi|6Q@9z8AmYf~x8G%sp>C5cfuJY;hs1o3Ozu^{pH0AFbs%yU)Xy5>Cf?qXiHn*-PAfKDRiy`U0sFSKFsgEZ6_ z9#ma!<#Izr^}_z*>PRSt564u6We*XmZUx^jv*dK; z4zyFZ*ZFSE!00<6!|+#33&R)@RA8V9YRjp$HS9?CGq*xDSDRbX#i;}mateEF{fqTI zt?X}Efkq_Ap*_ETgaikOBbQ|;47}hwX44K`(DUI@C)QiG&6UJ1UmRn*Q@6%e`+x(gpQp74O{;yli8YLCV}qD z4gIyZd_(8ED~WWaeXOb0^r=9=AiDT}by~+$KVF~M{ywbQl zng-h?a_E;yX?DCr4|_h7JMc7>xgWf7Ek-VmH^hCYunVp3{(d{---&%-GZ=rK#V5Jo zJvP8b!2AA5?9)G8gwzB6ze3TU<5*Pqms^Q-?C9-CN~4hb-`U0D@kAkTWn23``cao^ z8IWAp8h7`%ZA+eI?w$sJktq5m>e&0@mQn>2BdpKAxbj1$m$8Z;`!iFvl9($Lb9Ff? zT^6cTZ~HgIeR6R*;G(rzpgsJP41Fx9Df;G6{;k6T(i}&8hX(jHSC@~#X@70h#)g(( z*9vUC+a*b%oAdf1$}Z3NR;|c5nY4^Z51pfqk(tmJbB;Q#ka#tf5eae;-kq$I{xO3<(TI$0lSe-JQzJ*es;il=Kn_?&?E zfLbs{qErPqm)-*ZfwbA*D-shgb|1;X;cH*yA|q8gS=HiosF=-kbdk6--SR+`F^H_` z0*i`J==@XSe=HT;_``G}ulE=H@*3GU*?gVd@h*`eT^GKjI;C@8+h~;(u3bA#b&bN{ zYw>dJ$(;RfHDLlndS`CWOE=g0jOocCc&;w(dOzrLf4-DK*MD@P_;u&CbfMw=#Q-B` zDq8hGwKN-O7(hQA_bP3f5XrZH+@*FGw~ppmDgNWcf|Lf*Pc%e5dw1DcJ1BWm!z7z3 zr^toEU*P(>G#;_1X}Rz(5lbDtCui%hY^d3lm)kw0vyk zX~K4$AG#7cG`6s2%9g9zsaQ9o?;3yzW4Pt!;NlS zzI#G7tiq&@eV&}qDtY(e$1JwscAfle%Al{3>Nr%``n?`Jac^CdOXUbFgI3;m{RkA~ zokl+lxuw9=%W&MmzA+G%ZdFMMP&N2^6BWjG2Lt|xKx)lMCR@b0n+xgw<)&Dwi?}>- z+$_e|@M;uW@3z6)q&L7bYitZ%huzGqH_qHOr&G5o!?(8TJv_MN1ka|&c6_!Q>#PgHSFoPWiLg|k_{ zQd#Zy&BPkU(0OE5S35!B5qb6%T3Wd#J(zBl8dw6I#xIDDF-LBPi-jXv1E?!gE|1OIdTejK)+U3ooC^otSIRsWZf-`&K}6}s!407Y58zH zK(oYx*7sN1O|Z_1YIJS_H$E@DH(hB4QKNCGQT3PTvwYoe2&8WKi5`5tU-r4!>_V3XUT}N)>8V;+z-!@-IGCKiD>E9RC(K`NMx=;Qp zf$2g^t?)zpU0L!BZi(oE#)^Z_biT*Svh>r#%1=O+Wo37G`Q)4@k#Pe?^mgBIugC)8 zyEICH=`{A~^x#X&%tr-$j|(nXrIrGQYNY+C3M+LO;yUU4-|v>a5#P)XYp>_|C0f0n{_p0mvwWmghfd%!Cm}$qBDxOqA3htLs~ghSA1>6^dVgd~ zVHHBBy6;Pp=El;dkTE=ttp~BoOJ$L@EB3Z37T1kTNG3tm4PY5O-7hP5DA$-k=vV&6 z?RiAm;W~*o)R7!x9>u$&@|&D4xMmJ*y+^-6t!F0u8G~78t&Bs#W>w_NbW>W9M3tXWXRf zI86FWVx%iXXh6MJ>dg#?lNu{K@S#nzMIG4PXQd%!Bvc*H0c7F_Y=adptJr*cHevMQ z%?Xu~q8CFw>^L*S_83kVhq=)hf0%_Lq}SE*g(Da_A{kXVZfAd*YCwp~bG32wi&SNM z#QZ7}Ug5-=+s^uqAh_|}gzya<(&E?XAZ%0ybd9nraj?|z1YfPr*{N?Q{ji}YG`T#| z=uwJZHIMlsmevnenT#-)t$L*=2wh|1EYXW?_36TR?L!sUItJVxaC0$Gb|gq4{|4gA z(v0ODFj!T)jc5>65ys)* z7$aBHfbKdz@QJq1b`NT`344*g()$>5*Ey`TPB7WI;|_8o8t9-_4ikFub|I{66>ge> zHA+6onzFKY*eaiA!77SD*^&LyumAR6gSvxY6Q?;!AvI{rZ##!G$%ZfIgce4F`aF;e z?jVh%+B-vj69ei~bh_zA9w}S4B4rzRKQ1~u$gwVu_x5PlRKDXX2(_2Mm7fs%6{SS7Qh1gWT8xaxc=f8`mW38ukIZxwU;lmHABwFSg50*o zrj%f%j~IKR?N5Dxwrq|sTa?!pd{b3sFM&~{4~_^YH4$bI^Fq2W4-y`))^|7fS?i0) zJ&Z9wY!8%l7@gAr`2{fqA;L;ptQR*X2|xUtrT47KK%XN+dydN$*M?65LuXTRabgERR{n>;E;(&vS0_@COY!p<%5LsRqGpER%~YjkSK zwBo9-2|-ZFiU3TT&S+@}3gDT35t0IXTzX@yHA(v>Y8;-mZNySQ&fE7RJ1^tzJfvdApX& z*!+tE)Y{oR%jk8A)3EiI3i*(TOwP!;B3hAOj?KQ6^h-q~1V^166uYS~mH*2Hh*0}r z`R3u1#^LG9IW|^QT^|61H(T1Jz?n;(Z>52lU0BO>Q6*zgpP*gTFk2Uw)!3zt>3F~_ ztil4!R*-j}wjh%&(kSB%}X=u4RbFRp@^l+$SmM@nW9B;yGbf@nasjFMEE{m9Oe

}qal5$moSACwfNXLXG5|3R0AtBcN` z?%yS)&>O>sqxU64U~C3&Q^>z-Zt}WuX4Wh3dKj9EO zfSbV!c3e;EOeKHQmWEw#NM4;*tw-2o@x&kKT?rsmy-F|$jw-F>WgA7?C@{O1qPg*J zf92|RTBMh&ptHADFc{T+cB?+mOj>h2HKgwkxq6w&XBxPc?>=JKvU2K9aU93@vp-R% z{5T=P$9U}AYZ5QU{3%7}YZ+ACWXw#-U zWyxU(OP#Q9-2AeGmCwcp`zWghf2hvsOjWjDQbU?U`v0&a--f1`v0Bd8HLiLmo)PKz5!A1|XVO+89 zm3h2~6yI~cpWor!_yt-?Lt>z`c0a7cJAW)#d8N8nNIf0H<+v;s4{0guDD(?T7Z<~$ zd`$vpZ_QQgFaMT0_d5&+(jwGU?M1FqUu6wjA-9z?mRM}(CmSdK;2e$Na}F-8jbhgN z9)@AIQeghf{xCC^{9P%VdYW1PP#}2BJwWt z0Hd8%st1NK5%h+)UB^mVwh{e#8TIm$xxgGo6I5;e{~VUeeMGRpM_Z%=eH5$X1}?Z5 z`|*_Vp~K&ziz45-Ih9y>EOr(Buy0&n$dbQ4$5eSr=Ti z#~7^n8dmem;$0D4+6eV7&G2D~d@ z+R#u8+nw_N%7_U_1e53P?~&10^m|ZUXrZhVp04lQLsGos%0fRDhS=@>8TOAAxK;Cy z9GZw_1pfSxD5~xoR!INI?tU0wrKDd6^Tv{jL>`Xb49kBaNPlhMaIfh_nq_)zB7NcX z05XeQKz`@BDUx7*i!V~%dc8XQ#ngBw0A2tSr(npSCrNy5Z7>48v&Zz?0{%FRElh_h zN2|?#EhJL5HQMIu6m1=ypTR?tVymHK)xQvS9ir7FzMp?CjlND39PK`od#GytVhZWp zQ1@>MTE1*Ip>hnXSWa?XbMH#708@j12yPbm`JfcqIgmJepn$5YgkJn_%5I)mr`Q(k z-a0yFR3A`houhvf&|wNpIsV{2p%MqhR@`@R(l6`}iufEgI*UxWq~26?WTpZCV{JtG zYL?&#I98fyf_;2S0?_V{=Aa4t^x%vy$pF$_Lh7W2f*~5uPvGYh;vZhMv|u+Z?2t0~ zcYPXdxbg6OS*LUjR_=jLDt)ab6;?g1IuySLG@UE;jLpt-wjLX&RlY>fnd@f&?0NyT zht5vhP^};k6`U76$%&I)iWPNxG6KPjdh`S6>g9GN@;KObQsLG zKyjfrPR0PU1B0a0=)3@9eCDl?mB9rFdlTMtTAeZv2}F*|@JWleq2+H1bt>>x!^wTk z+I)cgsZwzCMwoRpW_*!3IySTQu!`HWugAXe(Ai(a9Rsu;*0#o6torxwNMxPzEAjt` z>70Vw;HCQ?AnP`RKQ;2R8h%;LI#tx^(MO*lMWJe4_?)Q571P`kTmN#(ez21V!<6+S z@Uap+y%#8&cGgdf+E@y$dUx3g#)=#5k31Vqv0p!%L`*=-PiQAiSg-d9lKRZQDuJ-| zA96zwwomG+4}X$vR*IU=NC!vL<`rUTbf_uRJC4FS;k&HtV<=<)p(qymH)=MDV^aqK z#%sid7K|~!H`J!7hRr~Z!emxgWq6#GpQs%c#BM+scvNGz|Gi4G`;8Z~dP8)+51iB8 zw)0fazNz5(iK$LJeC_4e^8&@wT(DZ~~>SStz3P(>V8CLNlZqgv=2K-|Lu~si@XFwMN>QE^k zVS2U_A?Q$?M`NkU}^!M8m%O&T=kW>dG}1s2I~hxp9Y=a=1XX-(fB5) zej3`e5Et~R^r%?CZK0)UZsF_+tSOGIBMdrtMf#oJjGF9U`*P8t>i*TWed$Z2WNUZ* z_1Qw4Yr+Q0@bD?hD0P-^v}?FpPBg~zz5~g@J#J76C695|P>1l;OS8%~hZh5&-9Ji# z50%&56ZK4FC9}{jHL0!=qo9Yd(GGHCEX2|-F(f}q6@NMT4P3rQd{Q!=bz-8N(Z^!N;;ZzAWRf@C?X>mG=_NgyQX_?Jv$m(9$W>P;+e}O|&w&DjbsJPdWp0A2$yLr*!BY73Z z5d*BCaTI)w=sTlofc>n}@v_tSXIK?8(g`G_06u>SD*fOZJ~visq3lBVS2+cf-r$UQ zZ(8A0g&5M$IV7w5nqL(m$VS0X?=yy-e6>S>Ca3wZNT)b{GF39_gJdONflqc-j$b~o z2l@@h{$KVfC)V?#We*)@xYC;L^<@cHo>8axRMbSzw|eYTl|8pkabsQJ(3`z{>5H}c z`psz_Y6t)hvzL^=}P#++XUl6v`-j)SuXd6BynjNZ!&c2hnyE&4*K$nXn31Zk)cm+lx;> zya{T?{MRtSu?^3Y9bS&O$*mW^vRUpv!J3Tz12?3&Y62b_oiZ$24O(75Z)JWb+Rj)ACbK`f<&tSwtT$|Sy z$41kRPiM-jnPY9PKrLyI`pHm6LusMsrO*HpmE){Kp1^u2t%6nW^;GB|!4k!Ik8oav zjM?DBKh9G@W0gEwiU-M}0B)}olvoM71RccgiZBCs)L?q_GX&JDhegx4k2&cNatr5w zU)1#2USb8&`etO5Vk z?0}K+*2*@a5yt*X{qg0@8jEz~jcylVj>-042p1PBnabI#xUiCRD!ouw3?u-wwsqwF z8(@m8-Lk7q@v154g6yvx_tRDa>}oqpVda)wfI9(;ZVGt1v^{<|X?vC_(i@IJC+2I_lusrT=$h zF1lPc*Neb`;Xgrdf`p$w)~MzQW0M3_FYRKu{2$VU82J^B=X1#^<&P$_`=S$Ey04WU zTxG;hrFNLhWC*p+sH3x=JVcBJ9*7>eO20)n671SxQhZQlHMRP8FyO}yai~OTsbms0 zQ3b$C1Cn!>jMHDq{VX1ab^~_Q!z+f75+_AuwiN0*wA_#M#0|rU{+NlB%>Y+TNT0Gj z`3^LKMSJjz2(?lwg~ixDl_5%rzzZ}o_6Fj9e)T7gpH4=BgT1zmwJpC@g(f%&0`}8B z%7Y&qlP3aFmI#nmT`|R3+Lwzp+PLXt|5g%vlY_$fvse7zjus0D0fA##r+i4G4K-2Y zC#H95NGoYfWP#ZF_v$^Li{PZpm}fc&)aL?5doPcb835Cr6`T+EzzcEvLtmXcbAb<^ zw!_Zgk6Az7YA@*vb)(G{_W-B|zrf76z^`X%jOgqIIaqi~5nUup3vugzzg&rA^w(zR z+qCzvIV~nGR=47pDOcNTzuBw#5a=<=DMvGa)g zPw$^pmq9Fg&b#BZrPSoml(149rZS!fioV*Dy$z440U3MXDJmI?RZqLy0}IKSxN)o( z8+8wIZs#q(|KTg6y;Z(=96>xfpUsr@SP}I^v zN^R;ZVrDaWmNrM5-<X@k6JyjvA3;jHhma|Y|7!Vk& zgf(UK_6~cC;!|b!YTjke=nBiUqQdb#I9TY}!s5P)H+^c;9cW(QO8O%n5J^8Xfktd*qrn)+?-gP`m%B&q zi^}7jKm`yMW8ITFOMN#!QIB6$SWx*75tnCMaNg*_J*WuwBh~AT>0($nS8%&zmFQDp z$dL65niDtTV%!Kg1`6epWoQGNG`$`doy;Zjaa`keyL0F6iJMae6FIgnhAfzU%m@V+ zm5rQihLwS~b6{-bVR1ZSzBI7(Yj+V6T-8V*7I`ptWArGdy~8pnV>fALpi~NQLZ7;^ zpaj35=md<~-(tNmF69UX3?ua}A7UIn)q5i1iPYEGlhYSbkfeX`5epkxtzk3Qbu| zlgA`7ts%IvF4HJ}-98akyRnjCo{u-`A4&b+r?s|o`4wdYAHs-yh91p$7C_|+EdYH5 z10`!*=n+W9g>V&dfU1H!J}ASZi&-?`2IlDOAHnu306rD`y>jT)4^@S(X4XhN2{g9i zj-ym98+RT|d0ejIFJCM5>S{mT-8uGmRRqkJ3sMO_AQDrv77Q zv$t>zaVpVF6eBguE%9M2u?E-Oleft8z5+~W`G}KXD(Yc;7m4{Op>Le(k`g1UK7(1# zt6g}$n=Tdn{T4pu>v!c;xRCd_WI$Ali13x=U_0T!Ga-U~9W88q-lU+RLn2`N8Ouho z^0@SvC>$DguHWx)?^*ms-{PVq%dn(U3vrLj9zITDqQZ`H>Wsp@Gf%}SG=m)Vh}F$ztQAbwVGdDgd!28j&yX9wLW&s! zNR~6`nYg;ULAq8zi<;gUchAV5ib67Y##l2 zy+%gaD(|~G4@||{A;TYDSoS>q2o{t23t-^!NDSDEm8j3ao7Ei>KYLEpb$jz}7ciAM zD}trDN+AVVT_lXW<++~>8>Cj8fzJo@R;>%nGq)6+w?(#mNc#1J4W+!hA}?g$0Xqo? zn67qJmss)e%k(xO*&K@z6+}nHA(lCkb6n-|{pSztys$8HiOWTVR)tCO*Q9~if%3n7`uxGzE+OCu zwcVV|tgQdq60952$>85-GHk$lwM(uI+CU1?i{sVnKd0+UNq#eSSKjUKfDDgLnBG1y z^v?f#MRFkph~TgkoKBvM`L_~we8__xpLcjh`GwV|87q`vazJq?SX=mXhdvK>VqUf~ z4sYoTIpt5S)KrE-?>&=cRoBumD7;b5pq!Y07)#I$`)<@U+mo*dE*P~773p*u^6waO z2#thJahX_ySlYMpjx%h<)i43ao~Is`^Ya zMNZkuChEA7+ZJe6$>-C*dzTYf3#1SY82yFG?S&Q)5rTbKS-XLjckTLEc7>^sFcntQ zBeNXCSg&q1N3Bi^4zlQ%mcEBQ%2ab$?(;t-$HYd2%cnX$uuwU#I_6D3($m zR(>gHzM9ODf;r8b0l5LuEIQVZiQ0-|3Y_xzJkZc*CD=bPJ+&J+>>se%D4uTq?Ny{l z0Z5~og*Wa1O&anlcRWu_%o)(x?IZ0CfUNk_R-ik>GyvdFmpu1wHZaKTDGhL zqxsji)n<+)VKbV0_BRq9E;Kb`f=&vn(BK0Ba-gL?ZN;^^b3YFg6R=!q#zM;tcX0dM zdy5PPx@6pJPXHzH7$dGjM|6@6777nXPWV;CIQdNf(*Znv)sMy&Xcq> zhCq+6h6&v8<0}vd2(sKqU3j>fr7&#Xy%qZHcMU3m{wld^Nstkz8GagB?Y=SI&H z&{&BSA-|(i35$9(l6LpFyLm$0M0fK`Dz!~ezL?yEInsXAFR!bHe;ZL>Gd(#Hv?<$%`^b)oi?x%(jkylCPb=juPlF znMo&o961=NZ_$gd{xp1ZY2dNDOS!=XVj!M^A z+$z`EK4v=m{Bs{&I4W)({`&<5*^BV#z{IBAI_d+9Qx;~ zby?2zEjzUUeZWBDo5cz>%;z||z)<+6UtC)y60yD5J5`oo_zSM;l21@CY<0_|)NME5 zs)kHCMBa5YzB#N=W2aR?y9((~WuYwwf+HAc2mvU>NYlxOTvGf^Ye3za?*f-qUs^`a zT3>RPh9*Jf%3*bf|kqtnD_Buxv!<9N>BbuD#uYv-q^ z%RDnd7a3O4M9Y~TNISS@9K}JDkdg@>x8E6@n8jF=6qiDV+}{!V)(o?ykcr0sxBGEx zo!X;pc=r{H^vw6ztV5VZXBa4~(ujB$rZQ|AaGN@J7#q%2nU9gJ)g6dcj}zYB1& z@iFE0vMQVxa|v7tDHS$gwX$Ihc#M^DXRC>J@Zk?dC(3uB_s~*W&m-01DFMQGWjj5x z5po1@1gPl!v1Yra@qPG{D;$bYLM3qOwpl~7f~l)#n< zP+6`!NYe3EE~4RFR#_e=7YctPRBt6$He@`%e5m}f$M%yzC2S0<1}hRPjO>HJY~ z*dx(nbMbjv*;o&k{qzBdF|lS;UNVKziV=gbLq}UOCwr8GT5E9oRYQ}+>DhbQ1R=lj zgcNJN8|D)$Mx3#c+t@lhqcDUnHGVt0&EyQ{b5)=52B(VTzw=pQ^ba3`JB@BU^lS`_ zJEiLzgU#Acd_!}FMxCWC**FP^i#P}bYzNs78)#uSejEtYLbG>JJ7Igtho2oKQ;XW~ z4eMGO+t!_;G^V6c&R`5Tg+Pz2ToN(aybq4Q0ssie_{`t*DO%V7FaZ`{MBobFc9|pV z70o5ayHGJo9$$&Pgbs)pWNzduAcbh?~U?_P)(ve0S*3H%eNF&a5XR=!J#4c z;t992n7ZJr{*%`^dU1d-ALE8!3i#v;3r4r%j+JFCe=%3Vj=8{aXe zs)jrcUBZ=;LudcTUXj2ub>K5!{HHFHJ}Trx(PYugbQ8yK7&sqX;(;|UWjk3tGs3zuceeX)i4i_jA8Qz2Bc%DxN8 zXw!$+9jBtEHd1y90bYG4f8DcJM)Ab!M39tH5zz94*MAvnhA377@buNupSOUU3j8~> zd6&hk^ENRCp9T?_QUHk<=(&9Q^MJ^pi;nKOYNR@?L=RCSmKMJ5UQJQ`X!i~(gD*P! zs`RobzJG3Ra_Pg+WZUXUmMU$ilpwfcEti6)mw(~MZ0q!^sza>#jv!-+7B6F3QuMWg zVO!rXwD+lF1BBTito?ml-CV3vxuek~TKuOX^N6sol$v*{_%nAuD7i81eXm^Lz(Z~I z2Xj_Dts#G0&C;PV_Wkq*1QvB7+Post4={v;gk7b9u%#DC_bh(iJm$rqog^{JEx6NE zrs5^2SEL$|98#2WV#iG@L6cq|)SuTMSfGocPl65wUd^|5Lbpnb(;t>-Qu2jvANLgv zdte0vED-3C@^BdyHWLL(7{G$WA02z@JG!T-U^Q7HZ(7Bs&vchkh(p&}KvnS{MG^i6 z4r){gJp9p7WyWOEiKA2Cm6EXIn&&gk|Fc6^78OpPrX4ExCFE=SD$xcH;C2eB^{XTI zaxz_Cef*Yj==w_i_BTGXP;8C&f? z*QEM>={jFM8)lWAR870pG4XEWsl%%K|82S5b=9hVz7p_6i-d(Iyvq76&a#PV zR;VbQV|n?mg}&(ehClg%tK%IjgtnTR-u)lxH06XxXqH0soAZbB_Rm)XX=6Nge1uoG7 z9vQM_S~2h53n|W`y{{R9+=08rv~MohI_v4-BU^7fZ0-A}#b5{AOSTJm+(J;9yw%pD zX6u62GJ&@HKX5zQwq~j8T!Hrv-Mk^QSB5cu09L03{ToDO7jikM0WAcsjW>D}^jqCF zT0DEZ@K^KO_MD*%M!+V)lGVU6?LpX)eQVXEmq}R`NIJv;kBitJ!nW?0OxTVlu2ADf zE{A!*0g3%nwVcBD+AgT5bGx@WOnQk{zRpiZ4HhP`3BF%N|HdqPbbiV5)7x)kzC3ID zZ;27>0^mrMgWc7evsbQY`l`l})wr+e;=8U_!2&B77;1qL!N8y)eTJ2lf#CvhR~!Qa mc;sM|90DP5A*JW%f2r=u1xt!e4gwD_V(@hJb6Mw<&;$SznOm^{ From 390c55dffaa02f91d769ce8908333411938701ad Mon Sep 17 00:00:00 2001 From: emnp Date: Tue, 11 Jan 2022 07:31:41 +0000 Subject: [PATCH 03/25] add pr link --- packages/azure_frontdoor/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/changelog.yml b/packages/azure_frontdoor/changelog.yml index 7b5f7fd8f9a..1dd4bbcbdcc 100644 --- a/packages/azure_frontdoor/changelog.yml +++ b/packages/azure_frontdoor/changelog.yml @@ -3,4 +3,4 @@ changes: - description: Initial draft of the package type: enhancement - link: https://github.com/elastic/integrations/pull/0 # FIXME Replace with the real PR link + link: https://github.com/elastic/integrations/pull/2497 From 892bf6727ac6f5ff18c67a1e378c63bd6d8bc59f Mon Sep 17 00:00:00 2001 From: emnp Date: Mon, 28 Nov 2022 16:51:03 +0630 Subject: [PATCH 04/25] updated file --- .../azure_frontdoor/_dev/build/docs/README.md | 10 +- .../_dev/test/pipeline/test-fdaccess.log | 6 +- .../pipeline/test-fdaccess.log-expected.json | 324 +++++++++--------- .../data_stream/access/sample_event.json | 67 +--- .../waf/_dev/test/pipeline/test-fdwaf.log | 4 +- .../pipeline/test-fdwaf.log-expected.json | 167 +++++---- .../data_stream/waf/sample_event.json | 69 +--- packages/azure_frontdoor/docs/README.md | 24 +- packages/azure_frontdoor/manifest.yml | 2 +- 9 files changed, 307 insertions(+), 366 deletions(-) diff --git a/packages/azure_frontdoor/_dev/build/docs/README.md b/packages/azure_frontdoor/_dev/build/docs/README.md index 69502f8c504..784eb26ac85 100644 --- a/packages/azure_frontdoor/_dev/build/docs/README.md +++ b/packages/azure_frontdoor/_dev/build/docs/README.md @@ -1,4 +1,4 @@ -# Azure Logs Integration +# Azure Frontdoor Logs Integration The azure frontdoor logs integration retrieves different types of log data from AFD. Azure Front Door provides different logging to help you track, monitor, and debug your Front Door. @@ -8,11 +8,15 @@ Azure Front Door provides different logging to help you track, monitor, and debu - Health Probe logs provides the logs for every failed probe to your origin. - Web Application Firewall (WAF) logs provide detailed information of requests that gets logged through either detection or prevention mode of an Azure Front Door endpoint. A custom domain that gets configured with WAF can also be viewed through these logs. -The package contains the following data streams: +## Data streams + +This integration collects two types of data streams: - access log - waf logs +## Requirements + ### Credentials `eventhub` : @@ -54,4 +58,4 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th ## WAF Logs -{{fields "waf"}} \ No newline at end of file +{{fields "waf"}} diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log index 9a40350e25f..742f7aefabd 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log @@ -1,3 +1,3 @@ -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"103.25.241.29","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"103.25.241.29","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:10:11.6479719Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"103.217.158.198","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"103.217.158.198","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:49.9266300Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"103.217.158.198","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"103.217.158.198","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:50.0584922Z"} \ No newline at end of file +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"89.160.20.128","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"89.160.20.128","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:10:11.6479719Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:49.9266300Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:50.0584922Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json index d4104890e24..651190931f3 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -1,276 +1,270 @@ { "expected": [ { - "source": { - "geo": { - "continent_name": "Asia", - "country_name": "Myanmar", - "location": { - "lon": 98.0, - "lat": 22.0 + "@timestamp": "2021-12-15T03:10:11.647Z", + "azure": { + "frontdoor": { + "access": { + "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "cache_status": "CONFIG_NOCACHE", + "error_info": "NoError", + "is_received_from_client": true, + "pop": "SIN", + "routing_rule_name": "erp", + "rules_engine_match_names": [], + "time_taken": "0.384", + "time_to_first_byte": "0.384" }, - "country_iso_code": "MM" - }, - "as": { - "number": 133384, - "organization": { - "name": "5BB Broadband" - } + "category": "FrontdoorAccessLog", + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" } }, - "url": { - "original": "https://erp.mitcloud.com:443/StockSetup/GetStockListByCir" - }, - "tags": [ - "preserve_original_event" - ], - "network": { - "protocol": "HTTPS" + "client": { + "address": "89.160.20.128", + "ip": "89.160.20.128", + "port": 50382 }, "cloud": { "provider": "azure" }, - "@timestamp": "2021-12-15T03:10:11.647Z", "ecs": { "version": "1.12.0" }, - "client": { - "port": 50382, - "address": "103.25.241.29", - "ip": "103.25.241.29" + "event": { + "ingested": "2022-11-28T09:41:38.876708697Z" }, "http": { "request": { - "method": "POST", - "bytes": 2545 + "bytes": 2545, + "method": "POST" }, - "version": "2.0.0.0", "response": { "bytes": 1205, "status_code": 200 + }, + "version": "2.0.0.0" + }, + "network": { + "protocol": "HTTPS" + }, + "source": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" } }, + "tags": [ + "preserve_original_event" + ], "tls": { "version": "1.2", "version_protocol": "TLS" }, - "event": { - "ingested": "2021-12-29T11:50:11.818647743Z", - "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"103.25.241.29\",\"clientPort\":\"50382\",\"httpMethod\":\"POST\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SIN\",\"requestBytes\":\"2545\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/StockSetup/GetStockListByCir\",\"responseBytes\":\"1205\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"103.25.241.29\",\"timeTaken\":\"0.384\",\"timeToFirstByte\":\"0.384\",\"trackingReference\":\"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\",\"userAgent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:10:11.6479719Z\"}" + "url": { + "original": "https://erp.mitcloud.com:443/StockSetup/GetStockListByCir" }, "user_agent": { + "device": { + "name": "Other" + }, "name": "Chrome", "original": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", "os": { + "full": "Windows 7", "name": "Windows", - "version": "7", - "full": "Windows 7" - }, - "device": { - "name": "Other" + "version": "7" }, "version": "96.0.4664.93" - }, + } + }, + { + "@timestamp": "2021-12-15T03:35:49.926Z", "azure": { "frontdoor": { - "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "access": { - "pop": "SIN", - "error_info": "NoError", - "rules_engine_match_names": [], "backend_hostname": "vantagev6erp.azurewebsites.net:443", - "routing_rule_name": "erp", - "is_received_from_client": true, "cache_status": "CONFIG_NOCACHE", - "time_to_first_byte": "0.384", - "time_taken": "0.384" + "error_info": "NoError", + "is_received_from_client": true, + "pop": "SIN", + "routing_rule_name": "erp", + "rules_engine_match_names": [], + "time_taken": "0.122", + "time_to_first_byte": "0.122" }, "category": "FrontdoorAccessLog", - "tracking_reference": "0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" - } - } - }, - { - "source": { - "geo": { - "continent_name": "Asia", - "country_name": "Myanmar", - "location": { - "lon": 98.0, - "lat": 22.0 - }, - "country_iso_code": "MM" - }, - "as": { - "number": 135405, - "organization": { - "name": "WELINK" - } + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" } }, - "url": { - "original": "https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392" - }, - "tags": [ - "preserve_original_event" - ], - "network": { - "protocol": "HTTPS" + "client": { + "address": "175.16.199.0", + "ip": "175.16.199.0", + "port": 6610 }, "cloud": { "provider": "azure" }, - "@timestamp": "2021-12-15T03:35:49.926Z", "ecs": { "version": "1.12.0" }, - "client": { - "port": 6610, - "address": "103.217.158.198", - "ip": "103.217.158.198" + "event": { + "ingested": "2022-11-28T09:41:38.876730897Z" }, "http": { "request": { - "method": "GET", - "bytes": 1984 + "bytes": 1984, + "method": "GET" }, - "version": "2.0.0.0", "response": { "bytes": 2308, "status_code": 200 + }, + "version": "2.0.0.0" + }, + "network": { + "protocol": "HTTPS" + }, + "source": { + "geo": { + "city_name": "Changchun", + "continent_name": "Asia", + "country_iso_code": "CN", + "country_name": "China", + "location": { + "lat": 43.88, + "lon": 125.3228 + }, + "region_iso_code": "CN-22", + "region_name": "Jilin Sheng" } }, + "tags": [ + "preserve_original_event" + ], "tls": { "version": "1.2", "version_protocol": "TLS" }, - "event": { - "ingested": "2021-12-29T11:50:11.818677727Z", - "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"103.217.158.198\",\"clientPort\":\"6610\",\"httpMethod\":\"GET\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SIN\",\"requestBytes\":\"1984\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392\",\"responseBytes\":\"2308\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"103.217.158.198\",\"timeTaken\":\"0.122\",\"timeToFirstByte\":\"0.122\",\"trackingReference\":\"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\",\"userAgent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:35:49.9266300Z\"}" + "url": { + "original": "https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392" }, "user_agent": { + "device": { + "name": "Other" + }, "name": "Chrome", "original": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", "os": { + "full": "Windows 7", "name": "Windows", - "version": "7", - "full": "Windows 7" - }, - "device": { - "name": "Other" + "version": "7" }, "version": "96.0.4664.93" - }, + } + }, + { + "@timestamp": "2021-12-15T03:35:50.058Z", "azure": { "frontdoor": { - "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "access": { - "pop": "SIN", - "error_info": "NoError", - "rules_engine_match_names": [], "backend_hostname": "vantagev6erp.azurewebsites.net:443", - "routing_rule_name": "erp", - "is_received_from_client": true, "cache_status": "CONFIG_NOCACHE", - "time_to_first_byte": "0.122", - "time_taken": "0.122" + "error_info": "NoError", + "is_received_from_client": true, + "pop": "SIN", + "routing_rule_name": "erp", + "rules_engine_match_names": [], + "time_taken": "0.064", + "time_to_first_byte": "0.064" }, "category": "FrontdoorAccessLog", - "tracking_reference": "0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" - } - } - }, - { - "source": { - "geo": { - "continent_name": "Asia", - "country_name": "Myanmar", - "location": { - "lon": 98.0, - "lat": 22.0 - }, - "country_iso_code": "MM" - }, - "as": { - "number": 135405, - "organization": { - "name": "WELINK" - } + "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" } }, - "url": { - "original": "https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892" - }, - "tags": [ - "preserve_original_event" - ], - "network": { - "protocol": "HTTPS" + "client": { + "address": "175.16.199.0", + "ip": "175.16.199.0", + "port": 6610 }, "cloud": { "provider": "azure" }, - "@timestamp": "2021-12-15T03:35:50.058Z", "ecs": { "version": "1.12.0" }, - "client": { - "port": 6610, - "address": "103.217.158.198", - "ip": "103.217.158.198" + "event": { + "ingested": "2022-11-28T09:41:38.876734697Z" }, "http": { "request": { - "method": "GET", - "bytes": 1971 + "bytes": 1971, + "method": "GET" }, - "version": "2.0.0.0", "response": { "bytes": 637, "status_code": 200 + }, + "version": "2.0.0.0" + }, + "network": { + "protocol": "HTTPS" + }, + "source": { + "geo": { + "city_name": "Changchun", + "continent_name": "Asia", + "country_iso_code": "CN", + "country_name": "China", + "location": { + "lat": 43.88, + "lon": 125.3228 + }, + "region_iso_code": "CN-22", + "region_name": "Jilin Sheng" } }, + "tags": [ + "preserve_original_event" + ], "tls": { "version": "1.2", "version_protocol": "TLS" }, - "event": { - "ingested": "2021-12-29T11:50:11.818685158Z", - "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"103.217.158.198\",\"clientPort\":\"6610\",\"httpMethod\":\"GET\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SIN\",\"requestBytes\":\"1971\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892\",\"responseBytes\":\"637\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"103.217.158.198\",\"timeTaken\":\"0.064\",\"timeToFirstByte\":\"0.064\",\"trackingReference\":\"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\",\"userAgent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:35:50.0584922Z\"}" + "url": { + "original": "https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892" }, "user_agent": { + "device": { + "name": "Other" + }, "name": "Chrome", "original": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36", "os": { + "full": "Windows 7", "name": "Windows", - "version": "7", - "full": "Windows 7" - }, - "device": { - "name": "Other" + "version": "7" }, "version": "96.0.4664.93" - }, - "azure": { - "frontdoor": { - "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", - "access": { - "pop": "SIN", - "error_info": "NoError", - "rules_engine_match_names": [], - "backend_hostname": "vantagev6erp.azurewebsites.net:443", - "routing_rule_name": "erp", - "is_received_from_client": true, - "cache_status": "CONFIG_NOCACHE", - "time_to_first_byte": "0.064", - "time_taken": "0.064" - }, - "category": "FrontdoorAccessLog", - "tracking_reference": "0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" - } } } ] diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json index 6e0eec6f986..75b3ef7efc8 100644 --- a/packages/azure_frontdoor/data_stream/access/sample_event.json +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -1,12 +1,11 @@ { "@timestamp": "2021-12-15T03:36:54.005Z", "agent": { - "ephemeral_id": "a0b1e4bf-8bc8-44a8-904f-ff7b55f6039b", - "hostname": "docker-fleet-agent", - "id": "1be0b35e-6d0c-4359-8f1e-3d43aade3bea", + "ephemeral_id": "6cf5c6dc-b2bf-4846-ae52-2990ca02d7c4", + "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.16.0" + "version": "8.4.0" }, "azure": { "frontdoor": { @@ -33,24 +32,7 @@ "port": 65238 }, "cloud": { - "account": { - "id": "k-researach-lab" - }, - "availability_zone": "asia-southeast1-b", - "instance": { - "id": "7627326072194210872", - "name": "elmuu" - }, - "machine": { - "type": "e2-standard-2" - }, - "project": { - "id": "k-researach-lab" - }, - "provider": "azure", - "service": { - "name": "GCE" - } + "provider": "azure" }, "data_stream": { "dataset": "azure_frontdoor.access", @@ -61,37 +43,36 @@ "version": "1.12.0" }, "elastic_agent": { - "id": "1be0b35e-6d0c-4359-8f1e-3d43aade3bea", + "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", "snapshot": true, - "version": "7.16.0" + "version": "8.4.0" }, "event": { "agent_id_status": "verified", "dataset": "azure_frontdoor.access", - "ingested": "2021-12-30T05:03:08Z", - "original": "{\"category\":\"FrontdoorAccessLog\",\"operationName\":\"Microsoft.Network/FrontDoor/AccessLog/Write\",\"properties\":{\"ErrorInfo\":\"NoError\",\"backendHostname\":\"vantagev6erp.azurewebsites.net:443\",\"cacheStatus\":\"CONFIG_NOCACHE\",\"clientIp\":\"2400:ac40:60b:7aeb:418d:7c32:ac90:e100\",\"clientPort\":\"65238\",\"httpMethod\":\"POST\",\"httpStatusCode\":\"200\",\"httpStatusDetails\":\"200\",\"httpVersion\":\"2.0.0.0\",\"isReceivedFromClient\":true,\"pop\":\"SGE\",\"requestBytes\":\"3081\",\"requestProtocol\":\"HTTPS\",\"requestUri\":\"https://erp.mitcloud.com:443/Dashboard/getTopStockList\",\"responseBytes\":\"3191\",\"routingRuleName\":\"erp\",\"rulesEngineMatchNames\":[],\"securityProtocol\":\"TLS 1.2\",\"socketIp\":\"2400:ac40:60b:7aeb:418d:7c32:ac90:e100\",\"timeTaken\":\"3.603\",\"timeToFirstByte\":\"3.603\",\"trackingReference\":\"00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-15T03:36:54.0059097Z\"}", + "ingested": "2022-11-28T09:53:49Z", "timezone": "+00:00" }, "host": { "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "1fe40eba24f3f02b88864749eb7679a3", + "id": "3493985e8aa84ed5927322c499789a5f", "ip": [ - "192.168.112.7" + "172.19.0.7" ], "mac": [ - "02:42:c0:a8:70:07" + "02:42:ac:13:00:07" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-1022-gcp", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.15.74.2-microsoft-standard-WSL2", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.4 LTS (Focal Fossa)" } }, "http": { @@ -119,22 +100,10 @@ }, "source": { "as": { - "number": 136255, + "number": 237, "organization": { - "name": "Telecom International Myanmar Co., Ltd" + "name": "Merit Network Inc." } - }, - "geo": { - "city_name": "Yangon", - "continent_name": "Asia", - "country_iso_code": "MM", - "country_name": "Myanmar", - "location": { - "lat": 16.7827, - "lon": 96.1771 - }, - "region_iso_code": "MM-06", - "region_name": "Rangoon" } }, "tls": { diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log index 9c876863421..a8fca891980 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log @@ -1,3 +1,3 @@ -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"8.38.147.74","clientPort":"56094","details":{"matches":[]},"host":"connect.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"8.38.147.74","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T15:00:06.6330668Z"} -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"122.248.108.128","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.mitcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"122.248.108.128","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T16:03:09.8128356Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"216.160.83.56","clientPort":"56094","details":{"matches":[]},"host":"connect.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"216.160.83.56","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T15:00:06.6330668Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"81.2.69.142","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.mitcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"81.2.69.142","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T16:03:09.8128356Z"} {"records": [{ "time": "2021-12-27T16:00:28.7593936Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942200","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects MySQL comment-/space-obfuscated injections and backtick termination","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7601443Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942260","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_expenses_with_cc_gofresh","matchVariableValue":"{\"lvl1ExpensesWithCC\":\"Food Stuff\"}"},{"matchVariableName":"CookieValue:w_cogs_gofresh","matchVariableValue":"{\"lvl1cogs\":\"Cost of Sales\",\"lvl2cogs\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_expenses_without_cogs_gofresh","matchVariableValue":"{\"lvl1ExpensesWithoutcogs\":\"Selling & Distribution Expenses\",\"lvl2ExpensesWithoutcogs\":\"Selling & Di"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_top_gofresh","matchVariableValue":"{\"dataSelect\":30,\"cusSku\":1}"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},],"msg":"Detects basic SQL authentication bypass attempts 2/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7601736Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942200","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects MySQL comment-/space-obfuscated injections and backtick termination","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7608904Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942260","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_expenses_with_cc_gofresh","matchVariableValue":"{\"lvl1ExpensesWithCC\":\"Food Stuff\"}"},{"matchVariableName":"CookieValue:w_cogs_gofresh","matchVariableValue":"{\"lvl1cogs\":\"Cost of Sales\",\"lvl2cogs\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_expenses_without_cogs_gofresh","matchVariableValue":"{\"lvl1ExpensesWithoutcogs\":\"Selling & Distribution Expenses\",\"lvl2ExpensesWithoutcogs\":\"Selling & Di"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_top_gofresh","matchVariableValue":"{\"dataSelect\":30,\"cusSku\":1}"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},],"msg":"Detects basic SQL authentication bypass attempts 2/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7611593Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942330","policy":"waf2","action":"Block","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects classic SQL injection probings 1/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7618185Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942330","policy":"waf2","action":"Block","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects classic SQL injection probings 1/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}}]} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json index d64f1afe6c2..18b72e8a8c9 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -1,128 +1,119 @@ { "expected": [ { - "rule": { - "name": "AllowMyanmar" - }, - "source": { - "geo": { - "continent_name": "Asia", - "country_name": "Singapore", - "city_name": "Singapore", - "location": { - "lon": 103.8547, - "lat": 1.2929 - }, - "country_iso_code": "SG" - }, - "as": { - "number": 13335, - "organization": { - "name": "Cloudflare, Inc." + "@timestamp": "2021-12-27T15:00:06.633Z", + "azure": { + "frontdoor": { + "category": "FrontdoorWebApplicationFirewallLog", + "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=", + "waf": { + "details": {}, + "policy": "waf2", + "policy_mode": "detection" } } }, - "url": { - "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1", - "domain": "connect.mitcloud.com" + "client": { + "address": "216.160.83.56", + "ip": "216.160.83.56", + "port": 56094 }, - "tags": [ - "preserve_original_event" - ], "cloud": { "provider": "azure" }, - "@timestamp": "2021-12-27T15:00:06.633Z", "ecs": { "version": "1.12.0" }, - "client": { - "port": 56094, - "address": "8.38.147.74", - "ip": "8.38.147.74" - }, "event": { "action": "Log", - "ingested": "2021-12-29T11:50:39.365361636Z", - "original": "{\"category\":\"FrontdoorWebApplicationFirewallLog\",\"operationName\":\"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write\",\"properties\":{\"action\":\"Log\",\"clientIP\":\"8.38.147.74\",\"clientPort\":\"56094\",\"details\":{\"matches\":[]},\"host\":\"connect.mitcloud.com\",\"policy\":\"waf2\",\"policyMode\":\"detection\",\"requestUri\":\"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1\",\"ruleName\":\"AllowMyanmar\",\"socketIP\":\"8.38.147.74\",\"trackingReference\":\"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-27T15:00:06.6330668Z\"}" + "ingested": "2022-11-28T09:41:39.416111358Z" }, - "azure": { - "frontdoor": { - "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", - "category": "FrontdoorWebApplicationFirewallLog", - "waf": { - "policy_mode": "detection", - "details": {}, - "policy": "waf2" - }, - "tracking_reference": "09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" - } - } - }, - { "rule": { - "name": "DefaultRuleSet-1.0-SQLI-942330" + "name": "AllowMyanmar" }, "source": { + "as": { + "number": 209 + }, "geo": { - "continent_name": "Asia", - "region_iso_code": "MM-04", - "city_name": "Mandalay", - "country_iso_code": "MM", - "country_name": "Myanmar", - "region_name": "Mandalay Region", + "city_name": "Milton", + "continent_name": "North America", + "country_iso_code": "US", + "country_name": "United States", "location": { - "lon": 96.0833, - "lat": 22.0 - } - }, - "as": { - "number": 131322, - "organization": { - "name": "Yatanarpon Teleport Company Limited" - } + "lat": 47.2513, + "lon": -122.3149 + }, + "region_iso_code": "US-WA", + "region_name": "Washington" } }, - "url": { - "original": "https://erp.mitcloud.com:443/accountcategory/getAccountCategory", - "domain": "erp.mitcloud.com" - }, "tags": [ "preserve_original_event" ], + "url": { + "domain": "connect.mitcloud.com", + "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" + } + }, + { + "@timestamp": "2021-12-27T16:03:09.812Z", + "azure": { + "frontdoor": { + "category": "FrontdoorWebApplicationFirewallLog", + "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "tracking_reference": "0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=", + "waf": { + "details": { + "data": "Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"", + "msg": "Detects classic SQL injection probings 1/3" + }, + "policy": "waf2", + "policy_mode": "detection" + } + } + }, + "client": { + "address": "81.2.69.142", + "ip": "81.2.69.142", + "port": 59781 + }, "cloud": { "provider": "azure" }, - "@timestamp": "2021-12-27T16:03:09.812Z", "ecs": { "version": "1.12.0" }, - "client": { - "port": 59781, - "address": "122.248.108.128", - "ip": "122.248.108.128" - }, "event": { "action": "Block", - "ingested": "2021-12-29T11:50:39.365385870Z", - "original": "{\"category\":\"FrontdoorWebApplicationFirewallLog\",\"operationName\":\"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write\",\"properties\":{\"action\":\"Block\",\"clientIP\":\"122.248.108.128\",\"clientPort\":\"59781\",\"details\":{\"data\":\"Matched Data: {\\\"selectPeriod\\\":\\\"0000\\\",\\\"fromDate\\\":\\\"20210701\\\",\\\"toDate\\\":\\\"20211231\\\",\\\"checkDate\\\":\\\"20211226\\\",\\\"ccSyskey\\\":\\\" found within CookieValue:w_db_ibp: {\\\"selectPeriod\\\":\\\"0000\\\",\\\"fromDate\\\":\\\"20210701\\\",\\\"toDate\\\":\\\"20211231\\\",\\\"checkDate\\\":\\\"20211226\\\",\\\"ccSyskey\\\":\\\"\",\"matches\":[{\"matchVariableName\":\"CookieValue:w_db_ibp\",\"matchVariableValue\":\"{\\\"selectPeriod\\\":\\\"0000\\\",\\\"fromDate\\\":\\\"20210701\\\",\\\"toDate\\\":\\\"20211231\\\",\\\"checkDate\\\":\\\"20211226\\\",\\\"ccSyskey\\\":\\\"\"},{\"matchVariableName\":\"CookieValue:w_solist_ibp\",\"matchVariableValue\":\"{\\\"refNo\\\":\\\"\\\",\\\"secRefNo\\\":\\\"\\\",\\\"crossRefNo\\\":\\\"\\\",\\\"custCodeOpt\\\":\\\"c\\\",\\\"custCode\\\":\\\"\\\",\\\"custNameOpt\\\":\\\"c\\\",\\\"custNam\"},{\"matchVariableName\":\"CookieValue:w_pilist_ibp\",\"matchVariableValue\":\"{\\\"refNo\\\":\\\"\\\",\\\"secRefNo\\\":\\\"\\\",\\\"crossRef\\\":\\\"\\\",\\\"status\\\":\\\"0\\\",\\\"venCodeOpt\\\":\\\"c\\\",\\\"venCode\\\":\\\"\\\",\\\"venNameOpt\\\":\\\"c\\\",\"},{\"matchVariableName\":\"CookieValue:w_ah_ibp\",\"matchVariableValue\":\"{\\\"selectedAccCat\\\":0,\\\"showTrial\\\":false,\\\"showAmt\\\":false,\\\"isCc\\\":false,\\\"isDept\\\":false,\\\"ccSyskey\\\":\\\"-1\\\",\\\"d\"},{\"matchVariableName\":\"CookieValue:w_silist_ibp\",\"matchVariableValue\":\"{\\\"refNo\\\":\\\"\\\",\\\"secRefNo\\\":\\\"\\\",\\\"crossRefNo\\\":\\\"\\\",\\\"custCodeOpt\\\":\\\"c\\\",\\\"custCode\\\":\\\"\\\",\\\"custNameOpt\\\":\\\"c\\\",\\\"custNam\"}],\"msg\":\"Detects classic SQL injection probings 1/3\"},\"host\":\"erp.mitcloud.com\",\"policy\":\"waf2\",\"policyMode\":\"detection\",\"requestUri\":\"https://erp.mitcloud.com:443/accountcategory/getAccountCategory\",\"ruleName\":\"DefaultRuleSet-1.0-SQLI-942330\",\"socketIP\":\"122.248.108.128\",\"trackingReference\":\"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-27T16:03:09.8128356Z\"}" + "ingested": "2022-11-28T09:41:39.416144058Z" }, - "azure": { - "frontdoor": { - "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", - "category": "FrontdoorWebApplicationFirewallLog", - "waf": { - "policy_mode": "detection", - "details": { - "msg": "Detects classic SQL injection probings 1/3", - "data": "Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"" - }, - "policy": "waf2" + "rule": { + "name": "DefaultRuleSet-1.0-SQLI-942330" + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 }, - "tracking_reference": "0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" + "region_iso_code": "GB-ENG", + "region_name": "England" } + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "erp.mitcloud.com", + "original": "https://erp.mitcloud.com:443/accountcategory/getAccountCategory" } }, null diff --git a/packages/azure_frontdoor/data_stream/waf/sample_event.json b/packages/azure_frontdoor/data_stream/waf/sample_event.json index 5d7d94fafe6..9b6e2082e7b 100644 --- a/packages/azure_frontdoor/data_stream/waf/sample_event.json +++ b/packages/azure_frontdoor/data_stream/waf/sample_event.json @@ -1,12 +1,11 @@ { "@timestamp": "2021-12-27T15:00:06.633Z", "agent": { - "ephemeral_id": "4e3dcda0-ff10-4d61-b8d3-d8ad468c59ec", - "hostname": "docker-fleet-agent", - "id": "4da1e81c-6b6e-441c-b06e-8075f54ea45a", + "ephemeral_id": "378511a1-e299-4261-9ad1-ba37b63e4637", + "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.16.0" + "version": "8.4.0" }, "azure": { "frontdoor": { @@ -27,24 +26,7 @@ "port": 56094 }, "cloud": { - "account": { - "id": "k-researach-lab" - }, - "availability_zone": "asia-southeast1-b", - "instance": { - "id": "7627326072194210872", - "name": "elmuu" - }, - "machine": { - "type": "e2-standard-2" - }, - "project": { - "id": "k-researach-lab" - }, - "provider": "azure", - "service": { - "name": "GCE" - } + "provider": "azure" }, "data_stream": { "dataset": "azure_frontdoor.waf", @@ -55,38 +37,37 @@ "version": "1.12.0" }, "elastic_agent": { - "id": "4da1e81c-6b6e-441c-b06e-8075f54ea45a", + "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", "snapshot": true, - "version": "7.16.0" + "version": "8.4.0" }, "event": { "action": "Log", "agent_id_status": "verified", "dataset": "azure_frontdoor.waf", - "ingested": "2021-12-30T06:02:58Z", - "original": "{\"category\":\"FrontdoorWebApplicationFirewallLog\",\"operationName\":\"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write\",\"properties\":{\"action\":\"Log\",\"clientIP\":\"8.38.147.74\",\"clientPort\":\"56094\",\"details\":{\"matches\":[]},\"host\":\"connect.mitcloud.com\",\"policy\":\"waf2\",\"policyMode\":\"detection\",\"requestUri\":\"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1\",\"ruleName\":\"AllowMyanmar\",\"socketIP\":\"8.38.147.74\",\"trackingReference\":\"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=\"},\"resourceId\":\"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD\",\"time\":\"2021-12-27T15:00:06.6330668Z\"}", + "ingested": "2022-11-28T09:54:46Z", "timezone": "+00:00" }, "host": { "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "1fe40eba24f3f02b88864749eb7679a3", + "id": "3493985e8aa84ed5927322c499789a5f", "ip": [ - "192.168.208.5" + "172.19.0.7" ], "mac": [ - "02:42:c0:a8:d0:05" + "02:42:ac:13:00:07" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-1022-gcp", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.15.74.2-microsoft-standard-WSL2", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.4 LTS (Focal Fossa)" } }, "input": { @@ -101,24 +82,6 @@ "rule": { "name": "AllowMyanmar" }, - "source": { - "as": { - "number": 13335, - "organization": { - "name": "Cloudflare, Inc." - } - }, - "geo": { - "city_name": "Singapore", - "continent_name": "Asia", - "country_iso_code": "SG", - "country_name": "Singapore", - "location": { - "lat": 1.2929, - "lon": 103.8547 - } - } - }, "url": { "domain": "connect.mitcloud.com", "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" diff --git a/packages/azure_frontdoor/docs/README.md b/packages/azure_frontdoor/docs/README.md index 87556902c17..d7617d7d1a1 100644 --- a/packages/azure_frontdoor/docs/README.md +++ b/packages/azure_frontdoor/docs/README.md @@ -1,4 +1,4 @@ -# Azure Logs Integration +# Azure Frontdoor Logs Integration The azure frontdoor logs integration retrieves different types of log data from AFD. Azure Front Door provides different logging to help you track, monitor, and debug your Front Door. @@ -8,11 +8,15 @@ Azure Front Door provides different logging to help you track, monitor, and debu - Health Probe logs provides the logs for every failed probe to your origin. - Web Application Firewall (WAF) logs provide detailed information of requests that gets logged through either detection or prevention mode of an Azure Front Door endpoint. A custom domain that gets configured with WAF can also be viewed through these logs. -The package contains the following data streams: +## Data streams + +This integration collects two types of data streams: - access log - waf logs +## Requirements + ### Credentials `eventhub` : @@ -91,6 +95,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | | destination.geo.city_name | City name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | | destination.geo.country_iso_code | Country ISO code. | keyword | @@ -129,6 +134,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | @@ -149,6 +155,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | | source.geo.city_name | City name. | keyword | | source.geo.continent_name | Name of the continent. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | @@ -163,15 +170,21 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | tls.version | Numeric part of the version parsed from the original string. | keyword | | tls.version_protocol | Normalized lowercase protocol name parsed from original string. | keyword | | url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | | user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | | user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | | user.id | Unique identifier of the user. | keyword | | user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | | user_agent.device.name | Name of the device. | keyword | | user_agent.name | Name of the user agent. | keyword | | user_agent.original | Unparsed user_agent string. | keyword | +| user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | | user_agent.os.full | Operating system name, including the version or code name. | keyword | +| user_agent.os.full.text | Multi-field of `user_agent.os.full`. | match_only_text | | user_agent.os.name | Operating system name, without the version. | keyword | +| user_agent.os.name.text | Multi-field of `user_agent.os.name`. | match_only_text | | user_agent.os.version | Operating system version as a raw string. | keyword | | user_agent.version | Version of the user agent. | keyword | @@ -214,6 +227,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | | destination.geo.city_name | City name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | | destination.geo.country_iso_code | Country ISO code. | keyword | @@ -252,6 +266,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | @@ -268,6 +283,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | | source.geo.city_name | City name. | keyword | | source.geo.continent_name | Name of the continent. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | @@ -281,7 +297,11 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | tags | List of keywords used to tag each event. | keyword | | url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | | url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | | user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | | user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | | user.id | Unique identifier of the user. | keyword | | user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index 02214eee542..c9e68b673a8 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -12,7 +12,7 @@ categories: - web release: experimental conditions: - kibana.version: "^7.16.0" + kibana.version: "^7.16.0 || ^8.0.0" screenshots: - src: /img/azure-frontdoor-overview.png title: Azure Frontdoor Overview From ede1a368d94f1657a2d0c4a54651f57ad2c89908 Mon Sep 17 00:00:00 2001 From: emnp Date: Wed, 30 Nov 2022 15:17:32 +0630 Subject: [PATCH 05/25] updated file --- .../pipeline/test-fdaccess.log-expected.json | 6 +-- .../agent/stream/azure-eventhub.yml.hbs | 2 +- .../access/agent/stream/stream.yml.hbs | 2 +- .../elasticsearch/ingest_pipeline/default.yml | 44 +++++-------------- .../data_stream/access/sample_event.json | 12 ++--- .../pipeline/test-fdwaf.log-expected.json | 4 +- .../waf/agent/stream/azure-eventhub.yml.hbs | 2 +- .../waf/agent/stream/stream.yml.hbs | 2 +- .../elasticsearch/ingest_pipeline/default.yml | 42 ++++-------------- .../data_stream/waf/sample_event.json | 12 ++--- 10 files changed, 40 insertions(+), 88 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json index 651190931f3..d9665324756 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -33,7 +33,7 @@ "version": "1.12.0" }, "event": { - "ingested": "2022-11-28T09:41:38.876708697Z" + "ingested": "2022-11-30T08:39:10.169846321Z" }, "http": { "request": { @@ -126,7 +126,7 @@ "version": "1.12.0" }, "event": { - "ingested": "2022-11-28T09:41:38.876730897Z" + "ingested": "2022-11-30T08:39:10.169888722Z" }, "http": { "request": { @@ -213,7 +213,7 @@ "version": "1.12.0" }, "event": { - "ingested": "2022-11-28T09:41:38.876734697Z" + "ingested": "2022-11-30T08:39:10.169893522Z" }, "http": { "request": { diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs index b5354f4e5dc..18701a049f6 100644 --- a/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs +++ b/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs @@ -21,7 +21,7 @@ tags: {{#if preserve_original_event}} - preserve_original_event {{/if}} -{{#each tags as |tag i|}} +{{#each tags as |tag|}} - {{tag}} {{/each}} {{#contains "forwarded" tags}} diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs index 5845510de80..64d0aab8a99 100644 --- a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs +++ b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs @@ -1,5 +1,5 @@ paths: -{{#each paths as |path i|}} +{{#each paths as |path|}} - {{path}} {{/each}} exclude_files: [".gz$"] diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index d3e00782012..cf1bec426ae 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -3,10 +3,10 @@ description: Pipeline for processing azure frontdoor access logs processors: - set: field: event.ingested - value: '{{_ingest.timestamp}}' + value: "{{_ingest.timestamp}}" - set: field: ecs.version - value: '1.12.0' + value: "1.12.0" - rename: field: message target_field: event.original @@ -14,21 +14,9 @@ processors: - set: field: cloud.provider value: azure -# - grok: -# field: event.original -# patterns: -# - '{ body: %{GREEDYDATA:body}, properties: %{WORD:properties}, offset: %{NUMBER:offset}, sequence_number: %{NUMBER:sequence_number}, enqueued_time=%{GREEDYDATA:enqueued_time} }' -# ignore_failure: true -# - gsub: -# field: body -# pattern: \' -# replacement: "" -# - json: -# field: body -# target_field: azure.frontdoor_access - drop: description: Drop if inavlid json - if: "ctx?.event.original.contains('\"records\"')" + if: 'ctx?.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.access @@ -147,26 +135,14 @@ processors: - date: field: azure.frontdoor.access.time - target_field: '@timestamp' + target_field: "@timestamp" ignore_failure: true formats: - - ISO8601 - -# - grok: -# field: azure.resource_id -# patterns: -# - /SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace} -# - /subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/namespaces/%{NAMESPACE:azure.resource.namespace} -# pattern_definitions: -# SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} -# GROUPID: .+ -# PROVIDERNAME: .+ -# NAMESPACE: .+ -# ignore_failure: true + - ISO8601 - dissect: - field: azure.frontdoor.access.properties.securityProtocol - pattern: '%{tls.version_protocol} %{tls.version}' + field: azure.frontdoor.access.properties.securityProtocol + pattern: "%{tls.version_protocol} %{tls.version}" - remove: field: @@ -201,6 +177,6 @@ processors: ignore_missing: true on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + - set: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json index 75b3ef7efc8..dcd0b5427d0 100644 --- a/packages/azure_frontdoor/data_stream/access/sample_event.json +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -1,8 +1,8 @@ { "@timestamp": "2021-12-15T03:36:54.005Z", "agent": { - "ephemeral_id": "6cf5c6dc-b2bf-4846-ae52-2990ca02d7c4", - "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", + "ephemeral_id": "81ab6f88-5bba-45a6-8d61-787c2860de82", + "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.4.0" @@ -43,14 +43,14 @@ "version": "1.12.0" }, "elastic_agent": { - "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", + "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", "snapshot": true, "version": "8.4.0" }, "event": { "agent_id_status": "verified", "dataset": "azure_frontdoor.access", - "ingested": "2022-11-28T09:53:49Z", + "ingested": "2022-11-30T08:41:19Z", "timezone": "+00:00" }, "host": { @@ -59,10 +59,10 @@ "hostname": "docker-fleet-agent", "id": "3493985e8aa84ed5927322c499789a5f", "ip": [ - "172.19.0.7" + "172.19.0.4" ], "mac": [ - "02:42:ac:13:00:07" + "02:42:ac:13:00:04" ], "name": "docker-fleet-agent", "os": { diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json index 18b72e8a8c9..6fdefcb9713 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -28,7 +28,7 @@ }, "event": { "action": "Log", - "ingested": "2022-11-28T09:41:39.416111358Z" + "ingested": "2022-11-30T08:39:10.775214740Z" }, "rule": { "name": "AllowMyanmar" @@ -89,7 +89,7 @@ }, "event": { "action": "Block", - "ingested": "2022-11-28T09:41:39.416144058Z" + "ingested": "2022-11-30T08:39:10.775232440Z" }, "rule": { "name": "DefaultRuleSet-1.0-SQLI-942330" diff --git a/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs b/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs index b5354f4e5dc..18701a049f6 100644 --- a/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs +++ b/packages/azure_frontdoor/data_stream/waf/agent/stream/azure-eventhub.yml.hbs @@ -21,7 +21,7 @@ tags: {{#if preserve_original_event}} - preserve_original_event {{/if}} -{{#each tags as |tag i|}} +{{#each tags as |tag|}} - {{tag}} {{/each}} {{#contains "forwarded" tags}} diff --git a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs index 5845510de80..64d0aab8a99 100644 --- a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs +++ b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs @@ -1,5 +1,5 @@ paths: -{{#each paths as |path i|}} +{{#each paths as |path|}} - {{path}} {{/each}} exclude_files: [".gz$"] diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index d64e8c9d00c..3e8dc7a681a 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -3,10 +3,10 @@ description: Pipeline for processing azure frontdoor waf logs processors: - set: field: event.ingested - value: '{{_ingest.timestamp}}' + value: "{{_ingest.timestamp}}" - set: field: ecs.version - value: '1.12.0' + value: "1.12.0" - rename: field: message target_field: event.original @@ -14,21 +14,9 @@ processors: - set: field: cloud.provider value: azure -# - grok: -# field: event.original -# patterns: -# - '{ body: %{GREEDYDATA:body}, properties: %{WORD:properties}, offset: %{NUMBER:offset}, sequence_number: %{NUMBER:sequence_number}, enqueued_time=%{GREEDYDATA:enqueued_time} }' -# ignore_failure: true -# - gsub: -# field: body -# pattern: \' -# replacement: "" -# - json: -# field: body -# target_field: azure.frontdoor_waf - drop: description: Drop if inavlid json - if: "ctx?.event.original.contains('\"records\"')" + if: 'ctx?.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.waf @@ -81,7 +69,7 @@ processors: target_field: azure.frontdoor.waf.policy ignore_missing: true - rename: - field: azure.frontdoor.waf.properties.policyMode + field: azure.frontdoor.waf.properties.policyMode target_field: azure.frontdoor.waf.policy_mode ignore_missing: true - rename: @@ -95,22 +83,10 @@ processors: - date: field: azure.frontdoor.waf.time - target_field: '@timestamp' + target_field: "@timestamp" ignore_failure: true formats: - - ISO8601 - -# - grok: -# field: azure.resource_id -# patterns: -# - /SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace} -# - /subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/namespaces/%{NAMESPACE:azure.resource.namespace} -# pattern_definitions: -# SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} -# GROUPID: .+ -# PROVIDERNAME: .+ -# NAMESPACE: .+ -# ignore_failure: true + - ISO8601 - remove: field: @@ -141,6 +117,6 @@ processors: ignore_missing: true on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + - set: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/packages/azure_frontdoor/data_stream/waf/sample_event.json b/packages/azure_frontdoor/data_stream/waf/sample_event.json index 9b6e2082e7b..641b3f406ea 100644 --- a/packages/azure_frontdoor/data_stream/waf/sample_event.json +++ b/packages/azure_frontdoor/data_stream/waf/sample_event.json @@ -1,8 +1,8 @@ { "@timestamp": "2021-12-27T15:00:06.633Z", "agent": { - "ephemeral_id": "378511a1-e299-4261-9ad1-ba37b63e4637", - "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", + "ephemeral_id": "72175106-4ca2-4978-84d5-5e6737578462", + "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.4.0" @@ -37,7 +37,7 @@ "version": "1.12.0" }, "elastic_agent": { - "id": "1cb0009a-f093-4e2b-a396-3d7e3f8fd162", + "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", "snapshot": true, "version": "8.4.0" }, @@ -45,7 +45,7 @@ "action": "Log", "agent_id_status": "verified", "dataset": "azure_frontdoor.waf", - "ingested": "2022-11-28T09:54:46Z", + "ingested": "2022-11-30T08:41:57Z", "timezone": "+00:00" }, "host": { @@ -54,10 +54,10 @@ "hostname": "docker-fleet-agent", "id": "3493985e8aa84ed5927322c499789a5f", "ip": [ - "172.19.0.7" + "172.19.0.4" ], "mac": [ - "02:42:ac:13:00:07" + "02:42:ac:13:00:04" ], "name": "docker-fleet-agent", "os": { From 1663751d55fc499a7ebc836ced08df362e7ef0e7 Mon Sep 17 00:00:00 2001 From: emnp Date: Wed, 7 Dec 2022 10:33:00 +0630 Subject: [PATCH 06/25] updated file --- packages/azure_frontdoor/_dev/build/build.yml | 2 +- packages/azure_frontdoor/changelog.yml | 2 +- .../deploy/docker/sample_logs/fdaccess.log | 4 +- .../_dev/test/pipeline/test-fdaccess.log | 6 +-- .../pipeline/test-fdaccess.log-expected.json | 45 ++++++++++------ .../agent/stream/azure-eventhub.yml.hbs | 10 +++- .../access/agent/stream/stream.yml.hbs | 14 ++++- .../elasticsearch/ingest_pipeline/default.yml | 12 +++-- .../data_stream/access/manifest.yml | 2 + .../data_stream/access/sample_event.json | 53 +++++++------------ .../_dev/deploy/docker/sample_logs/fdwaf.log | 4 +- .../waf/_dev/test/pipeline/test-fdwaf.log | 5 +- .../pipeline/test-fdwaf.log-expected.json | 33 +++++++----- .../waf/agent/stream/stream.yml.hbs | 4 ++ .../elasticsearch/ingest_pipeline/default.yml | 12 +++-- .../data_stream/waf/manifest.yml | 3 ++ .../data_stream/waf/sample_event.json | 53 ++++++++----------- packages/azure_frontdoor/docs/README.md | 6 +-- packages/azure_frontdoor/manifest.yml | 2 +- 19 files changed, 152 insertions(+), 120 deletions(-) diff --git a/packages/azure_frontdoor/_dev/build/build.yml b/packages/azure_frontdoor/_dev/build/build.yml index 08d85edcf9a..8d9e4bf7ac8 100644 --- a/packages/azure_frontdoor/_dev/build/build.yml +++ b/packages/azure_frontdoor/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@1.12 + reference: git@v8.4.0 diff --git a/packages/azure_frontdoor/changelog.yml b/packages/azure_frontdoor/changelog.yml index 1dd4bbcbdcc..a5fffb80249 100644 --- a/packages/azure_frontdoor/changelog.yml +++ b/packages/azure_frontdoor/changelog.yml @@ -1,5 +1,5 @@ # newer versions go on top -- version: "0.0.1" +- version: "0.1.0" changes: - description: Initial draft of the package type: enhancement diff --git a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log index 7a6bf75fa83..43f4d180d3b 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log +++ b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log @@ -1,2 +1,2 @@ -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.603","timeToFirstByte":"3.603","trackingReference":"00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:36:54.0059097Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.542","timeToFirstByte":"3.542","trackingReference":"00mK5YQAAAABiYkksxXO5SqADULPyu7WxU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:36:54.0036459Z"} \ No newline at end of file +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.603","timeToFirstByte":"3.603","trackingReference":"00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:36:54.0059097Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.542","timeToFirstByte":"3.542","trackingReference":"00mK5YQAAAABiYkksxXO5SqADULPyu7WxU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:36:54.0036459Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log index 742f7aefabd..f27f2413e9d 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log @@ -1,3 +1,3 @@ -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"89.160.20.128","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"89.160.20.128","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:10:11.6479719Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:49.9266300Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"vantagev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-15T03:35:50.0584922Z"} \ No newline at end of file +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"89.160.20.128","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"89.160.20.128","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:10:11.6479719Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:49.9266300Z"} +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:50.0584922Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json index d9665324756..9f778c57737 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -5,7 +5,7 @@ "azure": { "frontdoor": { "access": { - "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "backend_hostname": "samplev6erp.azurewebsites.net:443", "cache_status": "CONFIG_NOCACHE", "error_info": "NoError", "is_received_from_client": true, @@ -17,7 +17,7 @@ }, "category": "FrontdoorAccessLog", "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" } }, @@ -30,10 +30,15 @@ "provider": "azure" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "event": { - "ingested": "2022-11-30T08:39:10.169846321Z" + "category": [ + "network" + ], + "type": [ + "connection" + ] }, "http": { "request": { @@ -77,7 +82,7 @@ "version_protocol": "TLS" }, "url": { - "original": "https://erp.mitcloud.com:443/StockSetup/GetStockListByCir" + "original": "https://erp.testcloud.com:443/StockSetup/GetStockListByCir" }, "user_agent": { "device": { @@ -98,7 +103,7 @@ "azure": { "frontdoor": { "access": { - "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "backend_hostname": "samplev6erp.azurewebsites.net:443", "cache_status": "CONFIG_NOCACHE", "error_info": "NoError", "is_received_from_client": true, @@ -110,7 +115,7 @@ }, "category": "FrontdoorAccessLog", "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" } }, @@ -123,10 +128,15 @@ "provider": "azure" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "event": { - "ingested": "2022-11-30T08:39:10.169888722Z" + "category": [ + "network" + ], + "type": [ + "connection" + ] }, "http": { "request": { @@ -164,7 +174,7 @@ "version_protocol": "TLS" }, "url": { - "original": "https://erp.mitcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392" + "original": "https://erp.testcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392" }, "user_agent": { "device": { @@ -185,7 +195,7 @@ "azure": { "frontdoor": { "access": { - "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "backend_hostname": "samplev6erp.azurewebsites.net:443", "cache_status": "CONFIG_NOCACHE", "error_info": "NoError", "is_received_from_client": true, @@ -197,7 +207,7 @@ }, "category": "FrontdoorAccessLog", "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=" } }, @@ -210,10 +220,15 @@ "provider": "azure" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "event": { - "ingested": "2022-11-30T08:39:10.169893522Z" + "category": [ + "network" + ], + "type": [ + "connection" + ] }, "http": { "request": { @@ -251,7 +266,7 @@ "version_protocol": "TLS" }, "url": { - "original": "https://erp.mitcloud.com:443/Customer/searchContactList/2107050813256062892" + "original": "https://erp.testcloud.com:443/Customer/searchContactList/2107050813256062892" }, "user_agent": { "device": { diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs index 18701a049f6..daf9c0503b0 100644 --- a/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs +++ b/packages/azure_frontdoor/data_stream/access/agent/stream/azure-eventhub.yml.hbs @@ -1,9 +1,15 @@ {{#if connection_string}} connection_string: {{connection_string}} {{/if}} +{{#if storage_account_container }} +storage_account_container: {{storage_account_container}} +{{else}} +{{#if eventhub}} +storage_account_container: filebeat-firewalllogs-{{eventhub}} +{{/if}} +{{/if}} {{#if eventhub}} eventhub: {{eventhub}} -storage_account_container: filebeat-activitylogs-{{eventhub}} {{/if}} {{#if consumer_group}} consumer_group: {{consumer_group}} @@ -30,4 +36,4 @@ publisher_pipeline.disable_host: true {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs index 64d0aab8a99..d0bec8af049 100644 --- a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs +++ b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs @@ -3,5 +3,17 @@ paths: - {{path}} {{/each}} exclude_files: [".gz$"] +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} processors: - - add_locale: ~ +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index cf1bec426ae..019696c70c7 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -1,12 +1,15 @@ --- description: Pipeline for processing azure frontdoor access logs processors: - - set: - field: event.ingested - value: "{{_ingest.timestamp}}" - set: field: ecs.version - value: "1.12.0" + value: "8.5.0" + - set: + field: event.category + value: [network] + - set: + field: event.type + value: [connection] - rename: field: message target_field: event.original @@ -136,7 +139,6 @@ processors: - date: field: azure.frontdoor.access.time target_field: "@timestamp" - ignore_failure: true formats: - ISO8601 diff --git a/packages/azure_frontdoor/data_stream/access/manifest.yml b/packages/azure_frontdoor/data_stream/access/manifest.yml index 69961a248f7..56cca05c5d9 100644 --- a/packages/azure_frontdoor/data_stream/access/manifest.yml +++ b/packages/azure_frontdoor/data_stream/access/manifest.yml @@ -19,6 +19,7 @@ streams: show_user: false default: - azure-frontdoor-access + - forwarded - name: preserve_original_event required: true show_user: true @@ -48,6 +49,7 @@ streams: show_user: false default: - azure-frontdoor-access + - forwarded - name: preserve_original_event required: true show_user: true diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json index dcd0b5427d0..d2914982171 100644 --- a/packages/azure_frontdoor/data_stream/access/sample_event.json +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -1,16 +1,16 @@ { "@timestamp": "2021-12-15T03:36:54.005Z", "agent": { - "ephemeral_id": "81ab6f88-5bba-45a6-8d61-787c2860de82", - "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", + "ephemeral_id": "0d8103f6-3567-4591-9d9e-027a17ad7d11", + "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.5.0" }, "azure": { "frontdoor": { "access": { - "backend_hostname": "vantagev6erp.azurewebsites.net:443", + "backend_hostname": "samplev6erp.azurewebsites.net:443", "cache_status": "CONFIG_NOCACHE", "error_info": "NoError", "is_received_from_client": true, @@ -22,7 +22,7 @@ }, "category": "FrontdoorAccessLog", "operation_name": "Microsoft.Network/FrontDoor/AccessLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3" } }, @@ -40,40 +40,23 @@ "type": "logs" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "elastic_agent": { - "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", + "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", "snapshot": true, - "version": "8.4.0" + "version": "8.5.0" }, "event": { "agent_id_status": "verified", - "dataset": "azure_frontdoor.access", - "ingested": "2022-11-30T08:41:19Z", - "timezone": "+00:00" - }, - "host": { - "architecture": "x86_64", - "containerized": true, - "hostname": "docker-fleet-agent", - "id": "3493985e8aa84ed5927322c499789a5f", - "ip": [ - "172.19.0.4" + "category": [ + "network" ], - "mac": [ - "02:42:ac:13:00:04" - ], - "name": "docker-fleet-agent", - "os": { - "codename": "focal", - "family": "debian", - "kernel": "5.15.74.2-microsoft-standard-WSL2", - "name": "Ubuntu", - "platform": "ubuntu", - "type": "linux", - "version": "20.04.4 LTS (Focal Fossa)" - } + "dataset": "azure_frontdoor.access", + "ingested": "2022-12-07T03:57:27Z", + "type": [ + "connection" + ] }, "http": { "request": { @@ -106,12 +89,16 @@ } } }, + "tags": [ + "azure-frontdoor-access", + "forwarded" + ], "tls": { "version": "1.2", "version_protocol": "TLS" }, "url": { - "original": "https://erp.mitcloud.com:443/Dashboard/getTopStockList" + "original": "https://erp.testcloud.com:443/Dashboard/getTopStockList" }, "user_agent": { "device": { diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log index 64de7f9c0c6..3f37a613033 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log +++ b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log @@ -1,2 +1,2 @@ -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"8.38.147.74","clientPort":"56094","details":{"matches":[]},"host":"connect.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"8.38.147.74","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T15:00:06.6330668Z"} -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"122.248.108.128","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.mitcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"122.248.108.128","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T16:03:09.8128356Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"8.38.147.74","clientPort":"56094","details":{"matches":[]},"host":"connect.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"8.38.147.74","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T15:00:06.6330668Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"122.248.108.128","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.testcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"122.248.108.128","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T16:03:09.8128356Z"} diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log index a8fca891980..b62e6173f3a 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log @@ -1,3 +1,2 @@ -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"216.160.83.56","clientPort":"56094","details":{"matches":[]},"host":"connect.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"216.160.83.56","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T15:00:06.6330668Z"} -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"81.2.69.142","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.mitcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.mitcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"81.2.69.142","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD","time":"2021-12-27T16:03:09.8128356Z"} -{"records": [{ "time": "2021-12-27T16:00:28.7593936Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942200","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects MySQL comment-/space-obfuscated injections and backtick termination","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7601443Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942260","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_expenses_with_cc_gofresh","matchVariableValue":"{\"lvl1ExpensesWithCC\":\"Food Stuff\"}"},{"matchVariableName":"CookieValue:w_cogs_gofresh","matchVariableValue":"{\"lvl1cogs\":\"Cost of Sales\",\"lvl2cogs\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_expenses_without_cogs_gofresh","matchVariableValue":"{\"lvl1ExpensesWithoutcogs\":\"Selling & Distribution Expenses\",\"lvl2ExpensesWithoutcogs\":\"Selling & Di"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_top_gofresh","matchVariableValue":"{\"dataSelect\":30,\"cusSku\":1}"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},],"msg":"Detects basic SQL authentication bypass attempts 2/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7601736Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942200","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects MySQL comment-/space-obfuscated injections and backtick termination","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7608904Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942260","policy":"waf2","action":"Log","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_sale_gofresh","matchVariableValue":"{\"lvl1sale\":\"Revenues\",\"lvl2sale\":\"Revenues\"}"},{"matchVariableName":"CookieValue:w_expenses_with_cc_gofresh","matchVariableValue":"{\"lvl1ExpensesWithCC\":\"Food Stuff\"}"},{"matchVariableName":"CookieValue:w_cogs_gofresh","matchVariableValue":"{\"lvl1cogs\":\"Cost of Sales\",\"lvl2cogs\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_exp_gofresh","matchVariableValue":"{\"expensesName\":\"Cost of Sales\",\"expensesHeaderName\":\"Cost of Sales\"}"},{"matchVariableName":"CookieValue:w_expenses_without_cogs_gofresh","matchVariableValue":"{\"lvl1ExpensesWithoutcogs\":\"Selling & Distribution Expenses\",\"lvl2ExpensesWithoutcogs\":\"Selling & Di"},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_top_gofresh","matchVariableValue":"{\"dataSelect\":30,\"cusSku\":1}"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},],"msg":"Detects basic SQL authentication bypass attempts 2/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7611593Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Vendor/searchMailingAddress/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942330","policy":"waf2","action":"Block","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAADoQV5y6gOWSpYCFpB/13cLU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects classic SQL injection probings 1/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}},{ "time": "2021-12-27T16:00:28.7618185Z", "resourceId": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", "category": "FrontdoorWebApplicationFirewallLog", "operationName": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", "properties": {"clientIP":"103.89.178.29","clientPort":"2125","socketIP":"103.89.178.29","requestUri":"https://erp.mitcloud.com:443/Customer/searchContactList/2011100717109617987","ruleName":"DefaultRuleSet-1.0-SQLI-942330","policy":"waf2","action":"Block","host":"erp.mitcloud.com","trackingReference":"0HOPJYQAAAABLGZ2WjuhQRpWwcGA31DFxU0lOMzBFREdFMDIwNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","policyMode":"detection","details":{"matches":[{"matchVariableName":"CookieValue:w_pilist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_gofresh","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_cbrlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"custNameOpt"},{"matchVariableName":"CookieValue:w_grnlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"vendorCodeOpt\":\"c\",\"vendorCode\":\"\",\"vendorNameOpt\":\"c\",\"v"},{"matchVariableName":"CookieValue:w_cbplist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"DR140106\",\"status\":\"0\",\"cashbooks\":\"0\",\"chequeNoOpt\":\"eq\",\"chequeNo\":\"\",\"cus"},{"matchVariableName":"CookieValue:w_prlist_gofresh","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c"},{"matchVariableName":"CookieValue:w_db_gofresh","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20200721\",\"toDate\":\"20210118\",\"checkDate\":\"20211227\",\"ccSyskey\":\""}],"msg":"Detects classic SQL injection probings 1/3","data":"Matched Data: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\", found within CookieValue:w_pilist_gofresh: {\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","}}}]} \ No newline at end of file +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"216.160.83.56","clientPort":"56094","details":{"matches":[]},"host":"connect.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"216.160.83.56","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T15:00:06.6330668Z"} +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"81.2.69.142","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.testcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"81.2.69.142","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T16:03:09.8128356Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json index 6fdefcb9713..40fcbf820b5 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -6,7 +6,7 @@ "frontdoor": { "category": "FrontdoorWebApplicationFirewallLog", "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=", "waf": { "details": {}, @@ -24,11 +24,16 @@ "provider": "azure" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "event": { "action": "Log", - "ingested": "2022-11-30T08:39:10.775214740Z" + "category": [ + "network" + ], + "type": [ + "connection" + ] }, "rule": { "name": "AllowMyanmar" @@ -54,8 +59,8 @@ "preserve_original_event" ], "url": { - "domain": "connect.mitcloud.com", - "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" + "domain": "connect.testcloud.com", + "original": "https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" } }, { @@ -64,7 +69,7 @@ "frontdoor": { "category": "FrontdoorWebApplicationFirewallLog", "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=", "waf": { "details": { @@ -85,11 +90,16 @@ "provider": "azure" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "event": { "action": "Block", - "ingested": "2022-11-30T08:39:10.775232440Z" + "category": [ + "network" + ], + "type": [ + "connection" + ] }, "rule": { "name": "DefaultRuleSet-1.0-SQLI-942330" @@ -112,10 +122,9 @@ "preserve_original_event" ], "url": { - "domain": "erp.mitcloud.com", - "original": "https://erp.mitcloud.com:443/accountcategory/getAccountCategory" + "domain": "erp.testcloud.com", + "original": "https://erp.testcloud.com:443/accountcategory/getAccountCategory" } - }, - null + } ] } \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs index 64d0aab8a99..0afb0da83e7 100644 --- a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs +++ b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs @@ -3,5 +3,9 @@ paths: - {{path}} {{/each}} exclude_files: [".gz$"] +tags: +{{#each tags as |tag|}} +- {{tag}} +{{/each}} processors: - add_locale: ~ diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index 3e8dc7a681a..fae2161ac3b 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -1,12 +1,15 @@ --- description: Pipeline for processing azure frontdoor waf logs processors: - - set: - field: event.ingested - value: "{{_ingest.timestamp}}" - set: field: ecs.version - value: "1.12.0" + value: "8.5.0" + - set: + field: event.category + value: [network] + - set: + field: event.type + value: [connection] - rename: field: message target_field: event.original @@ -84,7 +87,6 @@ processors: - date: field: azure.frontdoor.waf.time target_field: "@timestamp" - ignore_failure: true formats: - ISO8601 diff --git a/packages/azure_frontdoor/data_stream/waf/manifest.yml b/packages/azure_frontdoor/data_stream/waf/manifest.yml index 479a6309d8e..b0a9c0c2c87 100644 --- a/packages/azure_frontdoor/data_stream/waf/manifest.yml +++ b/packages/azure_frontdoor/data_stream/waf/manifest.yml @@ -2,6 +2,7 @@ title: "FrontDoor WAF" type: logs streams: - input: logfile + template_path: stream.yml.hbs title: Azure Frontdoor WAF logs description: Collect frontdoor waf logs vars: @@ -19,6 +20,7 @@ streams: show_user: false default: - azure-frontdoor-waf + - forwarded - name: preserve_original_event required: true show_user: true @@ -48,6 +50,7 @@ streams: show_user: false default: - azure-frontdoor-waf + - forwarded - name: preserve_original_event required: true show_user: true diff --git a/packages/azure_frontdoor/data_stream/waf/sample_event.json b/packages/azure_frontdoor/data_stream/waf/sample_event.json index 641b3f406ea..7ae94c5b224 100644 --- a/packages/azure_frontdoor/data_stream/waf/sample_event.json +++ b/packages/azure_frontdoor/data_stream/waf/sample_event.json @@ -1,17 +1,17 @@ { "@timestamp": "2021-12-27T15:00:06.633Z", "agent": { - "ephemeral_id": "72175106-4ca2-4978-84d5-5e6737578462", - "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", + "ephemeral_id": "0d8103f6-3567-4591-9d9e-027a17ad7d11", + "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.5.0" }, "azure": { "frontdoor": { "category": "FrontdoorWebApplicationFirewallLog", "operation_name": "Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write", - "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/MITCLOUD", + "resource_id": "/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD", "tracking_reference": "09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=", "waf": { "details": {}, @@ -34,41 +34,28 @@ "type": "logs" }, "ecs": { - "version": "1.12.0" + "version": "8.5.0" }, "elastic_agent": { - "id": "a51d5b58-91cb-476d-8a64-31f5dda8de0f", + "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", "snapshot": true, - "version": "8.4.0" + "version": "8.5.0" }, "event": { "action": "Log", "agent_id_status": "verified", + "category": [ + "network" + ], "dataset": "azure_frontdoor.waf", - "ingested": "2022-11-30T08:41:57Z", - "timezone": "+00:00" + "ingested": "2022-12-07T03:58:03Z", + "timezone": "+00:00", + "type": [ + "connection" + ] }, "host": { - "architecture": "x86_64", - "containerized": true, - "hostname": "docker-fleet-agent", - "id": "3493985e8aa84ed5927322c499789a5f", - "ip": [ - "172.19.0.4" - ], - "mac": [ - "02:42:ac:13:00:04" - ], - "name": "docker-fleet-agent", - "os": { - "codename": "focal", - "family": "debian", - "kernel": "5.15.74.2-microsoft-standard-WSL2", - "name": "Ubuntu", - "platform": "ubuntu", - "type": "linux", - "version": "20.04.4 LTS (Focal Fossa)" - } + "name": "docker-fleet-agent" }, "input": { "type": "log" @@ -82,8 +69,12 @@ "rule": { "name": "AllowMyanmar" }, + "tags": [ + "azure-frontdoor-waf", + "forwarded" + ], "url": { - "domain": "connect.mitcloud.com", - "original": "https://connect.mitcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" + "domain": "connect.testcloud.com", + "original": "https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1" } } \ No newline at end of file diff --git a/packages/azure_frontdoor/docs/README.md b/packages/azure_frontdoor/docs/README.md index d7617d7d1a1..90bf7f711b8 100644 --- a/packages/azure_frontdoor/docs/README.md +++ b/packages/azure_frontdoor/docs/README.md @@ -139,7 +139,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | http.request.bytes | Total size in bytes of the request (body and headers). | long | -| http.request.method | HTTP request method. Prior to ECS 1.6.0 the following guidance was provided: "The field value must be normalized to lowercase for querying." As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection. Original case will be mandated in ECS 2.0.0 | keyword | +| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | | http.response.bytes | Total size in bytes of the response (body and headers). | long | | http.response.status_code | HTTP response status code. | long | | http.version | HTTP version. | keyword | @@ -149,7 +149,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | log.offset | Log offset. | long | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.protocol | L7 Network protocol name. ex. http, lumberjack, transport protocol. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". | keyword | +| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | | source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | @@ -276,7 +276,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | log.offset | Log offset. | long | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | -| network.protocol | L7 Network protocol name. ex. http, lumberjack, transport protocol. The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS". | keyword | +| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | | rule.name | The name of the rule or signature generating the event. | keyword | diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index c9e68b673a8..ce3c7312f1c 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: azure_frontdoor title: "Azure Frontdoor" -version: 0.0.1 +version: 0.1.0 license: basic description: "This Elastic integration collects logs from Azure Frontdoor." type: integration From 85e03913a456119fe39ebe8d5c0156e7ba3cc6b4 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:44:49 +0530 Subject: [PATCH 07/25] add package to codeowners --- .github/CODEOWNERS | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 1a27e7782d6..1e55a7b73e5 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -24,6 +24,7 @@ /packages/azure_application_insights @elastic/obs-cloud-monitoring /packages/azure_billing @elastic/obs-cloud-monitoring /packages/azure @elastic/obs-cloud-monitoring +/packages/azure_frontdoor @elastic/security-external-integrations /packages/azure_metrics @elastic/obs-cloud-monitoring /packages/barracuda @elastic/security-external-integrations /packages/barracuda_cloudgen_firewall @elastic/security-external-integrations From 7108233f04951520675d8009dc08cce161d37379 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:44:58 +0530 Subject: [PATCH 08/25] update ECS version --- packages/azure_frontdoor/_dev/build/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/_dev/build/build.yml b/packages/azure_frontdoor/_dev/build/build.yml index 8d9e4bf7ac8..ca551c032a8 100644 --- a/packages/azure_frontdoor/_dev/build/build.yml +++ b/packages/azure_frontdoor/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.4.0 + reference: git@8.6 From 3a3af7660c53c7e7cd0fdbe285ae98196f8cdfdf Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:45:10 +0530 Subject: [PATCH 09/25] add package tags to pipeline config --- .../data_stream/access/_dev/test/pipeline/test-common-config.yml | 1 + .../data_stream/waf/_dev/test/pipeline/test-common-config.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml index 5622947e4b8..e11f3ae9932 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-common-config.yml @@ -3,3 +3,4 @@ dynamic_fields: fields: tags: - preserve_original_event + - azure-frontdoor-access diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml index 5622947e4b8..e11f3ae9932 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-common-config.yml @@ -3,3 +3,4 @@ dynamic_fields: fields: tags: - preserve_original_event + - azure-frontdoor-access From 5ae287d78ae7b60893222ee87a3299990e67d6fb Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:48:18 +0530 Subject: [PATCH 10/25] remove -logfile ref --- .../data_stream/access/_dev/deploy/docker/docker-compose.yml | 2 +- .../data_stream/access/_dev/test/system/test-default-config.yml | 2 +- .../data_stream/waf/_dev/deploy/docker/docker-compose.yml | 2 +- .../data_stream/waf/_dev/test/system/test-default-config.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml index dab43b824ac..83a67af3043 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml +++ b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml @@ -1,6 +1,6 @@ version: "2.3" services: - fdaccess-log-logfile: + fdaccess-log: image: alpine volumes: - ./sample_logs:/sample_logs:ro diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml index bf558a5272d..dd9d8098632 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml @@ -1,4 +1,4 @@ -service: fdaccess-log-logfile +service: fdaccess-log vars: ~ input: logfile data_stream: diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml index 151c4d107bb..47d8f89392c 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml +++ b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml @@ -1,6 +1,6 @@ version: "2.3" services: - fdwaf-log-logfile: + fdwaf-log: image: alpine volumes: - ./sample_logs:/sample_logs:ro diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml index 2e77b442a0f..8834f40a764 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml @@ -1,4 +1,4 @@ -service: fdwaf-log-logfile +service: fdwaf-log vars: ~ input: logfile data_stream: From 30063767ee65398191178036f0f355c9582c8a87 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:48:27 +0530 Subject: [PATCH 11/25] ctx is never null --- .../access/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/waf/elasticsearch/ingest_pipeline/default.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 019696c70c7..02f194d46c2 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx?.event.original.contains(''"records"'')' + if: 'ctx.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.access diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index fae2161ac3b..e9f847f00c6 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx?.event.original.contains(''"records"'')' + if: 'ctx.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.waf From 1c51b270d5b51f00affca0427786f844e92451fb Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:48:58 +0530 Subject: [PATCH 12/25] add ignore_missing --- .../data_stream/access/elasticsearch/ingest_pipeline/default.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 02f194d46c2..d4b56072baf 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -145,6 +145,7 @@ processors: - dissect: field: azure.frontdoor.access.properties.securityProtocol pattern: "%{tls.version_protocol} %{tls.version}" + ignore_missing: true - remove: field: From fbb00cffd2d0b7922f027e7225b9d6bbd8afac5a Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:49:34 +0530 Subject: [PATCH 13/25] add ignore_missing on remove --- .../data_stream/access/elasticsearch/ingest_pipeline/default.yml | 1 + .../data_stream/waf/elasticsearch/ingest_pipeline/default.yml | 1 + 2 files changed, 2 insertions(+) diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index d4b56072baf..e2226d1c651 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -154,6 +154,7 @@ processors: - azure.frontdoor.access.time - azure.frontdoor.access.properties - event.original + ignore_missing: true - geoip: field: client.ip diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index e9f847f00c6..bee2381ff0f 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -96,6 +96,7 @@ processors: - azure.frontdoor.waf.properties - azure.frontdoor.waf.details.matches - event.original + ignore_missing: true - geoip: field: client.ip From ad45e4b53f4b393b9e707a492424eed776a10065 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:53:45 +0530 Subject: [PATCH 14/25] check for non-null --- .../access/elasticsearch/ingest_pipeline/default.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index e2226d1c651..7ce34c67e5d 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx.event.original.contains(''"records"'')' + if: 'ctx.event?.original != null && ctx.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.access From 7c14eb008d656c375bbf89157fc464e842a62f86 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 14:54:24 +0530 Subject: [PATCH 15/25] check for non-null waf --- .../data_stream/waf/elasticsearch/ingest_pipeline/default.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index bee2381ff0f..634f394d89a 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx.event.original.contains(''"records"'')' + if: 'ctx.event?.original != null && ctx.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.waf From 39ed6fad3b3d556e23a7f1d82a3e43feb1a2fdff Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:08:26 +0530 Subject: [PATCH 16/25] add filestream --- packages/azure_frontdoor/data_stream/access/manifest.yml | 2 +- packages/azure_frontdoor/data_stream/waf/manifest.yml | 2 +- packages/azure_frontdoor/manifest.yml | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/manifest.yml b/packages/azure_frontdoor/data_stream/access/manifest.yml index 56cca05c5d9..d5859332540 100644 --- a/packages/azure_frontdoor/data_stream/access/manifest.yml +++ b/packages/azure_frontdoor/data_stream/access/manifest.yml @@ -1,7 +1,7 @@ title: "FrontDoor Access" type: logs streams: - - input: logfile + - input: filestream title: Azure Frontdoor Access logs description: Collect frontdoor access logs vars: diff --git a/packages/azure_frontdoor/data_stream/waf/manifest.yml b/packages/azure_frontdoor/data_stream/waf/manifest.yml index b0a9c0c2c87..f5ff930e9c8 100644 --- a/packages/azure_frontdoor/data_stream/waf/manifest.yml +++ b/packages/azure_frontdoor/data_stream/waf/manifest.yml @@ -1,7 +1,7 @@ title: "FrontDoor WAF" type: logs streams: - - input: logfile + - input: filestream template_path: stream.yml.hbs title: Azure Frontdoor WAF logs description: Collect frontdoor waf logs diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index ce3c7312f1c..8b6da19ae70 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -28,9 +28,9 @@ policy_templates: title: Azure Frontdoor logs description: Collect sample logs inputs: - - type: logfile + - type: filestream title: Collect azure frontdoor logs from log file. - description: "Collecting azure frontdoor logs (input: logfile)." + description: "Collecting azure frontdoor logs (input: filestream)." - type: "azure-eventhub" title: "Collect azure frontdoor events from Event Hub" description: "Collecting azure frontdooor events from Azure eventhub inputs (input: azure-eventhub)." From 3111f65290330fad1228e38b004113b19d391167 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:18:20 +0530 Subject: [PATCH 17/25] make release beta --- packages/azure_frontdoor/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index 8b6da19ae70..4e9966c1245 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -10,7 +10,7 @@ categories: - network - security - web -release: experimental +release: beta conditions: kibana.version: "^7.16.0 || ^8.0.0" screenshots: From efe6af4dc95731a947f8e6fb642246bb710c3828 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:19:31 +0530 Subject: [PATCH 18/25] test for invalid json --- .../access/_dev/test/pipeline/test-fdaccess.log | 3 ++- .../test/pipeline/test-fdaccess.log-expected.json | 12 ++++++++---- .../access/elasticsearch/ingest_pipeline/default.yml | 2 +- .../waf/_dev/test/pipeline/test-fdwaf.log | 3 ++- .../_dev/test/pipeline/test-fdwaf.log-expected.json | 9 ++++++--- .../waf/elasticsearch/ingest_pipeline/default.yml | 2 +- 6 files changed, 20 insertions(+), 11 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log index f27f2413e9d..7caa4c7ea17 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log @@ -1,3 +1,4 @@ {"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"89.160.20.128","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"89.160.20.128","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:10:11.6479719Z"} {"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:49.9266300Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:50.0584922Z"} \ No newline at end of file +{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:50.0584922Z"} +{"records": [{"time":"2021-02-02T07:15:37.3640748Z","resourceId":"/SUBSCRIPTIONS/saDFEEQW-JESSIE","category":"FrontdoorAccessLog"}]} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json index 9f778c57737..df69cb55dbd 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -75,7 +75,8 @@ } }, "tags": [ - "preserve_original_event" + "preserve_original_event", + "azure-frontdoor-access" ], "tls": { "version": "1.2", @@ -167,7 +168,8 @@ } }, "tags": [ - "preserve_original_event" + "preserve_original_event", + "azure-frontdoor-access" ], "tls": { "version": "1.2", @@ -259,7 +261,8 @@ } }, "tags": [ - "preserve_original_event" + "preserve_original_event", + "azure-frontdoor-access" ], "tls": { "version": "1.2", @@ -281,6 +284,7 @@ }, "version": "96.0.4664.93" } - } + }, + null ] } \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 7ce34c67e5d..e54ce08bf45 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx.event?.original != null && ctx.event.original.contains(''"records"'')' + if: 'ctx.event?.original != null && ctx.event.original.contains("records")' - json: field: event.original target_field: azure.frontdoor.access diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log index b62e6173f3a..229c5588ffd 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log @@ -1,2 +1,3 @@ {"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"216.160.83.56","clientPort":"56094","details":{"matches":[]},"host":"connect.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"216.160.83.56","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T15:00:06.6330668Z"} -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"81.2.69.142","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.testcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"81.2.69.142","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T16:03:09.8128356Z"} \ No newline at end of file +{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"81.2.69.142","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.testcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"81.2.69.142","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T16:03:09.8128356Z"} +{"records": [{"time":"2021-02-02T07:15:37.3640748Z","resourceId":"/SUBSCRIPTIONS/saDFEEQW-JESSIE","category":"FrontdoorAccessLog"}]} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json index 40fcbf820b5..e800c2f5c81 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -56,7 +56,8 @@ } }, "tags": [ - "preserve_original_event" + "preserve_original_event", + "azure-frontdoor-access" ], "url": { "domain": "connect.testcloud.com", @@ -119,12 +120,14 @@ } }, "tags": [ - "preserve_original_event" + "preserve_original_event", + "azure-frontdoor-access" ], "url": { "domain": "erp.testcloud.com", "original": "https://erp.testcloud.com:443/accountcategory/getAccountCategory" } - } + }, + null ] } \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index 634f394d89a..d84eb752a1a 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx.event?.original != null && ctx.event.original.contains(''"records"'')' + if: 'ctx.event?.original != null && ctx.event.original.contains("records")' - json: field: event.original target_field: azure.frontdoor.waf From 1a15e80ca3ae27d2bc928d240dac15e611c68c25 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:31:07 +0530 Subject: [PATCH 19/25] update test log --- .../data_stream/access/_dev/test/pipeline/test-fdaccess.log | 2 +- .../access/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/waf/_dev/test/pipeline/test-fdwaf.log | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log index 7caa4c7ea17..d2235f2240a 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log @@ -1,4 +1,4 @@ {"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"89.160.20.128","clientPort":"50382","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"2545","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/StockSetup/GetStockListByCir","responseBytes":"1205","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"89.160.20.128","timeTaken":"0.384","timeToFirstByte":"0.384","trackingReference":"0k1y5YQAAAAAWd0Uc6UcnR7WN8uo2prYZU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:10:11.6479719Z"} {"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1984","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/saleInvoice/readBySyskeySIByRoleAllowed/2112140619239361392","responseBytes":"2308","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.122","timeToFirstByte":"0.122","trackingReference":"0lWK5YQAAAAD89Q/jewlnT7dWvZNIh72LU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:49.9266300Z"} {"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"175.16.199.0","clientPort":"6610","httpMethod":"GET","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SIN","requestBytes":"1971","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Customer/searchContactList/2107050813256062892","responseBytes":"637","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"175.16.199.0","timeTaken":"0.064","timeToFirstByte":"0.064","trackingReference":"0lWK5YQAAAAAnKnstK4rwSovl+unjuKhoU0lOMzBFREdFMDIxNwBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc=","userAgent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:35:50.0584922Z"} -{"records": [{"time":"2021-02-02T07:15:37.3640748Z","resourceId":"/SUBSCRIPTIONS/saDFEEQW-JESSIE","category":"FrontdoorAccessLog"}]} \ No newline at end of file +{''"records"'': [{"time":"2021-02-02T07:15:37.3640748Z","resourceId":"/SUBSCRIPTIONS/saDFEEQW-JESSIE","category":"FrontdoorAccessLog"}]} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index e54ce08bf45..7ce34c67e5d 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -19,7 +19,7 @@ processors: value: azure - drop: description: Drop if inavlid json - if: 'ctx.event?.original != null && ctx.event.original.contains("records")' + if: 'ctx.event?.original != null && ctx.event.original.contains(''"records"'')' - json: field: event.original target_field: azure.frontdoor.access diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log index 229c5588ffd..2a8d72d97f6 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log @@ -1,3 +1,3 @@ {"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"216.160.83.56","clientPort":"56094","details":{"matches":[]},"host":"connect.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"216.160.83.56","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T15:00:06.6330668Z"} {"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"81.2.69.142","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.testcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"81.2.69.142","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T16:03:09.8128356Z"} -{"records": [{"time":"2021-02-02T07:15:37.3640748Z","resourceId":"/SUBSCRIPTIONS/saDFEEQW-JESSIE","category":"FrontdoorAccessLog"}]} \ No newline at end of file +{''"records"'': [{"time":"2021-02-02T07:15:37.3640748Z","resourceId":"/SUBSCRIPTIONS/saDFEEQW-JESSIE","category":"FrontdoorAccessLog"}]} \ No newline at end of file From 976a6d77a75b410b04856877305373a9d95eafc1 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:37:26 +0530 Subject: [PATCH 20/25] update system test --- .../_dev/test/system/test-default-config.yml | 2 +- .../data_stream/access/sample_event.json | 16 ++++++++-------- .../waf/_dev/test/system/test-default-config.yml | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml index dd9d8098632..6a05159694e 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml @@ -1,6 +1,6 @@ service: fdaccess-log vars: ~ -input: logfile +input: filestream data_stream: vars: paths: diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json index d2914982171..27b8b7e726b 100644 --- a/packages/azure_frontdoor/data_stream/access/sample_event.json +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-15T03:36:54.005Z", "agent": { - "ephemeral_id": "0d8103f6-3567-4591-9d9e-027a17ad7d11", - "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", + "ephemeral_id": "0514f21f-9d4b-4187-a1a2-b938a446dea9", + "id": "8613a3ea-29d9-44b8-84ec-c5b258194534", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.0" + "version": "8.6.0" }, "azure": { "frontdoor": { @@ -43,9 +43,9 @@ "version": "8.5.0" }, "elastic_agent": { - "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", - "snapshot": true, - "version": "8.5.0" + "id": "8613a3ea-29d9-44b8-84ec-c5b258194534", + "snapshot": false, + "version": "8.6.0" }, "event": { "agent_id_status": "verified", @@ -53,7 +53,7 @@ "network" ], "dataset": "azure_frontdoor.access", - "ingested": "2022-12-07T03:57:27Z", + "ingested": "2023-02-02T10:02:39Z", "type": [ "connection" ] @@ -70,7 +70,7 @@ "version": "2.0.0.0" }, "input": { - "type": "log" + "type": "filestream" }, "log": { "file": { diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml index 8834f40a764..1118b7c9a54 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml @@ -1,6 +1,6 @@ service: fdwaf-log vars: ~ -input: logfile +input: filestream data_stream: vars: paths: From 11c2f75634e586f057cb9a182c1390d6a781607e Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:43:44 +0530 Subject: [PATCH 21/25] dash by value --- .../data_stream/access/sample_event.json | 8 +- ...-d05e0860-6ea7-11ec-bf35-712f9048d91f.json | 1529 ++++++++++++++--- ...-03737aa0-6ead-11ec-bf35-712f9048d91f.json | 114 -- ...-1870ee80-6eab-11ec-bf35-712f9048d91f.json | 94 - ...-594f3970-6eab-11ec-bf35-712f9048d91f.json | 85 - ...-63822080-6eae-11ec-bf35-712f9048d91f.json | 85 - ...-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json | 134 -- ...-8139b390-6eae-11ec-bf35-712f9048d91f.json | 85 - ...-85519480-6ea8-11ec-bf35-712f9048d91f.json | 134 -- ...-c3757a60-6ea8-11ec-bf35-712f9048d91f.json | 85 - ...-dcef2360-6ead-11ec-bf35-712f9048d91f.json | 94 - ...-fdd991c0-6eab-11ec-bf35-712f9048d91f.json | 94 - 12 files changed, 1282 insertions(+), 1259 deletions(-) delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json delete mode 100644 packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json index 27b8b7e726b..ed4a330c384 100644 --- a/packages/azure_frontdoor/data_stream/access/sample_event.json +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -1,8 +1,8 @@ { "@timestamp": "2021-12-15T03:36:54.005Z", "agent": { - "ephemeral_id": "0514f21f-9d4b-4187-a1a2-b938a446dea9", - "id": "8613a3ea-29d9-44b8-84ec-c5b258194534", + "ephemeral_id": "4c506c0d-6542-4a1d-a552-405ffaf54291", + "id": "d7426e8a-1535-4d9a-8f1e-1d5eab23567b", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.6.0" @@ -43,7 +43,7 @@ "version": "8.5.0" }, "elastic_agent": { - "id": "8613a3ea-29d9-44b8-84ec-c5b258194534", + "id": "d7426e8a-1535-4d9a-8f1e-1d5eab23567b", "snapshot": false, "version": "8.6.0" }, @@ -53,7 +53,7 @@ "network" ], "dataset": "azure_frontdoor.access", - "ingested": "2023-02-02T10:02:39Z", + "ingested": "2023-02-02T10:12:54Z", "type": [ "connection" ] diff --git a/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json index cd1360e9f5f..364071c49c2 100644 --- a/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json +++ b/packages/azure_frontdoor/kibana/dashboard/azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f.json @@ -1,283 +1,1310 @@ { - "attributes": { - "description": "Azure Frontdoor Integration Dashboard", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": [ - "azure_frontdoor.access", - "azure_frontdoor.waf" - ], - "type": "phrases" + "id": "azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2023-02-02T10:06:59.720Z", + "created_at": "2023-02-02T10:06:59.720Z", + "version": "Wzg0MCwxXQ==", + "attributes": { + "description": "Azure Frontdoor Integration Dashboard", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": [ + "azure_frontdoor.access", + "azure_frontdoor.waf" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "data_stream.dataset": "azure_frontdoor.access" + } + }, + { + "match_phrase": { + "data_stream.dataset": "azure_frontdoor.waf" + } + } + ] + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 13, + "i": "f8012579-e741-44fc-9470-5348fa7a6821", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "f8012579-e741-44fc-9470-5348fa7a6821", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "266caf24-daea-453b-a081-b81a3a1a5d34": { + "columnOrder": [ + "db61d40a-769c-47ad-b7ae-6384624df2ea", + "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b", + "ee54a93c-ed19-4e1b-84ff-52144faec318" + ], + "columns": { + "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto", + "includeEmptyRows": true + }, + "scale": "interval", + "sourceField": "@timestamp" }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "data_stream.dataset": "azure_frontdoor.access" - } - }, - { - "match_phrase": { - "data_stream.dataset": "azure_frontdoor.waf" - } - } - ] + "db61d40a-769c-47ad-b7ae-6384624df2ea": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of data_stream.dataset", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "ee54a93c-ed19-4e1b-84ff-52144faec318", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5, + "parentFormat": { + "id": "terms" } + }, + "scale": "ordinal", + "sourceField": "data_stream.dataset" + }, + "ee54a93c-ed19-4e1b-84ff-52144faec318": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" } + }, + "incompleteColumns": {} } - ], - "query": { - "language": "kuery", - "query": "" + } } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {} + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "gridData": { - "h": 13, - "i": "f8012579-e741-44fc-9470-5348fa7a6821", - "w": 24, - "x": 0, - "y": 0 - }, - "panelIndex": "f8012579-e741-44fc-9470-5348fa7a6821", - "panelRefName": "panel_f8012579-e741-44fc-9470-5348fa7a6821", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "gridData": { - "h": 13, - "i": "a318c8ca-32a6-4115-81c2-7448d02f30c1", - "w": 24, - "x": 24, - "y": 0 + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 }, - "panelIndex": "a318c8ca-32a6-4115-81c2-7448d02f30c1", - "panelRefName": "panel_a318c8ca-32a6-4115-81c2-7448d02f30c1", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "layers": [ + { + "accessors": [ + "ee54a93c-ed19-4e1b-84ff-52144faec318" + ], + "layerId": "266caf24-daea-453b-a081-b81a3a1a5d34", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "db61d40a-769c-47ad-b7ae-6384624df2ea", + "xAccessor": "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "legendSize": "auto" }, - "gridData": { - "h": 17, - "i": "75629f82-636f-47f7-8080-b18e3e32fecf", - "w": 9, - "x": 0, - "y": 13 + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "panelIndex": "75629f82-636f-47f7-8080-b18e3e32fecf", - "panelRefName": "panel_75629f82-636f-47f7-8080-b18e3e32fecf", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" }, - "gridData": { - "h": 17, - "i": "9d7f41e2-4835-49cd-97a8-3996b3803587", - "w": 17, - "x": 9, - "y": 13 - }, - "panelIndex": "9d7f41e2-4835-49cd-97a8-3996b3803587", - "panelRefName": "panel_9d7f41e2-4835-49cd-97a8-3996b3803587", - "type": "lens", - "version": "7.16.0-SNAPSHOT" + "yRightExtent": { + "mode": "full" + } + } }, - { - "embeddableConfig": { - "enhancements": {} + "title": "Logs Over Time [Azure Frontdoor]", + "visualizationType": "lnsXY", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-266caf24-daea-453b-a081-b81a3a1a5d34", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 13, + "i": "a318c8ca-32a6-4115-81c2-7448d02f30c1", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "a318c8ca-32a6-4115-81c2-7448d02f30c1", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "0ee62278-341b-4d9d-8f65-44eef424786b": { + "columnOrder": [ + "823d0215-ee4e-4572-8a2a-e39893ece10d", + "74ecbafb-fb61-4678-820e-e0cd221307f4", + "f14be824-7dc6-4399-8491-5777389b1f1c" + ], + "columns": { + "74ecbafb-fb61-4678-820e-e0cd221307f4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto", + "includeEmptyRows": true + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "823d0215-ee4e-4572-8a2a-e39893ece10d": { + "dataType": "ip", + "isBucketed": true, + "label": "Top values of client.ip", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f14be824-7dc6-4399-8491-5777389b1f1c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "f14be824-7dc6-4399-8491-5777389b1f1c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "gridData": { - "h": 17, - "i": "a66e658f-88dd-4098-bc14-52775b5b32b5", - "w": 22, - "x": 26, - "y": 13 + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "panelIndex": "a66e658f-88dd-4098-bc14-52775b5b32b5", - "panelRefName": "panel_a66e658f-88dd-4098-bc14-52775b5b32b5", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 }, - "gridData": { - "h": 12, - "i": "408c25ae-832a-498f-88b1-c677a516195c", - "w": 17, - "x": 0, - "y": 30 + "layers": [ + { + "accessors": [ + "f14be824-7dc6-4399-8491-5777389b1f1c" + ], + "layerId": "0ee62278-341b-4d9d-8f65-44eef424786b", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "823d0215-ee4e-4572-8a2a-e39893ece10d", + "xAccessor": "74ecbafb-fb61-4678-820e-e0cd221307f4" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "legendSize": "auto" }, - "panelIndex": "408c25ae-832a-498f-88b1-c677a516195c", - "panelRefName": "panel_408c25ae-832a-498f-88b1-c677a516195c", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "gridData": { - "h": 12, - "i": "95cf95ae-16c3-4787-a9ea-a401f6a0246f", - "w": 18, - "x": 17, - "y": 30 + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" }, - "panelIndex": "95cf95ae-16c3-4787-a9ea-a401f6a0246f", - "panelRefName": "panel_95cf95ae-16c3-4787-a9ea-a401f6a0246f", - "type": "lens", - "version": "7.16.0-SNAPSHOT" + "yRightExtent": { + "mode": "full" + } + } }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 12, - "i": "0c6e0763-18cd-4360-aede-b92d09e7a2c6", - "w": 13, - "x": 35, - "y": 30 - }, - "panelIndex": "0c6e0763-18cd-4360-aede-b92d09e7a2c6", - "panelRefName": "panel_0c6e0763-18cd-4360-aede-b92d09e7a2c6", - "type": "lens", - "version": "7.16.0-SNAPSHOT" + "title": "Top Client IP Trending Graph [Azure Frontdoor]", + "visualizationType": "lnsXY", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0ee62278-341b-4d9d-8f65-44eef424786b", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 17, + "i": "75629f82-636f-47f7-8080-b18e3e32fecf", + "w": 9, + "x": 0, + "y": 13 + }, + "panelIndex": "75629f82-636f-47f7-8080-b18e3e32fecf", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "dbf953f9-caf7-4403-aef3-0f888754526d": { + "columnOrder": [ + "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9", + "79b721f5-7a2e-4c74-9c8b-062b9b4d98db" + ], + "columns": { + "79b721f5-7a2e-4c74-9c8b-062b9b4d98db": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9": { + "dataType": "ip", + "isBucketed": true, + "label": "Top values of client.ip", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "79b721f5-7a2e-4c74-9c8b-062b9b4d98db", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9" + }, + { + "columnId": "79b721f5-7a2e-4c74-9c8b-062b9b4d98db" + } + ], + "layerId": "dbf953f9-caf7-4403-aef3-0f888754526d", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "a7777948-86d7-42e0-9463-032b402385f9", - "w": 24, - "x": 0, - "y": 42 + "title": "Top Client IPs [Azure Frontdoor]", + "visualizationType": "lnsDatatable", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dbf953f9-caf7-4403-aef3-0f888754526d", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 17, + "i": "9d7f41e2-4835-49cd-97a8-3996b3803587", + "w": 17, + "x": 9, + "y": 13 + }, + "panelIndex": "9d7f41e2-4835-49cd-97a8-3996b3803587", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "b107299d-3122-4b2f-88c9-85b3e414217d": { + "columnOrder": [ + "f751542b-d8b3-486a-931c-545670d98874", + "a392968c-6481-4eba-8752-46420557d21f" + ], + "columns": { + "a392968c-6481-4eba-8752-46420557d21f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "f751542b-d8b3-486a-931c-545670d98874": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of source.geo.country_name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a392968c-6481-4eba-8752-46420557d21f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "source.geo.country_name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b107299d-3122-4b2f-88c9-85b3e414217d", + "layerType": "data", + "legendDisplay": "default", + "nestedLegend": false, + "numberDisplay": "percent", + "legendSize": "auto", + "primaryGroups": [ + "f751542b-d8b3-486a-931c-545670d98874" + ], + "metrics": [ + "a392968c-6481-4eba-8752-46420557d21f" + ] + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "panelIndex": "a7777948-86d7-42e0-9463-032b402385f9", - "panelRefName": "panel_a7777948-86d7-42e0-9463-032b402385f9", - "type": "lens", - "version": "7.16.0-SNAPSHOT" + "shape": "donut" + } }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", - "w": 24, - "x": 24, - "y": 42 - }, - "panelIndex": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", - "panelRefName": "panel_aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - } - ], - "timeRestore": false, - "title": "[Azure Frontdoor] Overview", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-d05e0860-6ea7-11ec-bf35-712f9048d91f", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f", - "name": "f8012579-e741-44fc-9470-5348fa7a6821:panel_f8012579-e741-44fc-9470-5348fa7a6821", - "type": "lens" - }, - { - "id": "azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f", - "name": "a318c8ca-32a6-4115-81c2-7448d02f30c1:panel_a318c8ca-32a6-4115-81c2-7448d02f30c1", - "type": "lens" - }, - { - "id": "azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f", - "name": "75629f82-636f-47f7-8080-b18e3e32fecf:panel_75629f82-636f-47f7-8080-b18e3e32fecf", - "type": "lens" - }, - { - "id": "azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f", - "name": "9d7f41e2-4835-49cd-97a8-3996b3803587:panel_9d7f41e2-4835-49cd-97a8-3996b3803587", - "type": "lens" + "title": "Top Country Names [Azure Frontdoor]", + "visualizationType": "lnsPie", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b107299d-3122-4b2f-88c9-85b3e414217d", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 17, + "i": "a66e658f-88dd-4098-bc14-52775b5b32b5", + "w": 22, + "x": 26, + "y": 13 }, - { - "id": "azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f", - "name": "a66e658f-88dd-4098-bc14-52775b5b32b5:panel_a66e658f-88dd-4098-bc14-52775b5b32b5", - "type": "lens" + "panelIndex": "a66e658f-88dd-4098-bc14-52775b5b32b5", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "d889492f-07a3-4ec6-9334-7299e029d385": { + "columnOrder": [ + "08f47d60-115d-40f0-b9fd-9bf1385c766b", + "77477f59-4dba-4ec0-ada1-093ffc78374d" + ], + "columns": { + "08f47d60-115d-40f0-b9fd-9bf1385c766b": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of url.original", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "77477f59-4dba-4ec0-ada1-093ffc78374d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 20, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "url.original" + }, + "77477f59-4dba-4ec0-ada1-093ffc78374d": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "08f47d60-115d-40f0-b9fd-9bf1385c766b" + }, + { + "columnId": "77477f59-4dba-4ec0-ada1-093ffc78374d" + } + ], + "layerId": "d889492f-07a3-4ec6-9334-7299e029d385", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "Top URLs [Azure Frontdoor]", + "visualizationType": "lnsDatatable", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d889492f-07a3-4ec6-9334-7299e029d385", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 12, + "i": "408c25ae-832a-498f-88b1-c677a516195c", + "w": 17, + "x": 0, + "y": 30 }, - { - "id": "azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f", - "name": "408c25ae-832a-498f-88b1-c677a516195c:panel_408c25ae-832a-498f-88b1-c677a516195c", - "type": "lens" + "panelIndex": "408c25ae-832a-498f-88b1-c677a516195c", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "63bfc868-ae64-40f3-b7e1-62e2150f7704": { + "columnOrder": [ + "f629af01-d102-4903-9bbb-c7e80e525905", + "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631", + "23695d1c-b544-4e27-9205-100f67392609" + ], + "columns": { + "23695d1c-b544-4e27-9205-100f67392609": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of user_agent.os.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "23695d1c-b544-4e27-9205-100f67392609", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "user_agent.os.name" + }, + "f629af01-d102-4903-9bbb-c7e80e525905": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of user_agent.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "23695d1c-b544-4e27-9205-100f67392609", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "user_agent.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "63bfc868-ae64-40f3-b7e1-62e2150f7704", + "layerType": "data", + "legendDisplay": "default", + "nestedLegend": false, + "numberDisplay": "percent", + "legendSize": "auto", + "primaryGroups": [ + "f629af01-d102-4903-9bbb-c7e80e525905", + "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631" + ], + "metrics": [ + "23695d1c-b544-4e27-9205-100f67392609" + ] + } + ], + "palette": { + "name": "status", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "User Agents Names and OS Names [Azure Frontdoor]", + "visualizationType": "lnsPie", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-63bfc868-ae64-40f3-b7e1-62e2150f7704", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 12, + "i": "95cf95ae-16c3-4787-a9ea-a401f6a0246f", + "w": 18, + "x": 17, + "y": 30 }, - { - "id": "azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f", - "name": "95cf95ae-16c3-4787-a9ea-a401f6a0246f:panel_95cf95ae-16c3-4787-a9ea-a401f6a0246f", - "type": "lens" + "panelIndex": "95cf95ae-16c3-4787-a9ea-a401f6a0246f", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "de5a74b1-0388-497f-b8ed-876c2c7c8e2e": { + "columnOrder": [ + "6b9235d9-4048-44b1-8285-d0867607799f", + "c006439b-bdfe-4054-972e-699fb00277d2" + ], + "columns": { + "6b9235d9-4048-44b1-8285-d0867607799f": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of url.domain", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c006439b-bdfe-4054-972e-699fb00277d2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "url.domain" + }, + "c006439b-bdfe-4054-972e-699fb00277d2": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "de5a74b1-0388-497f-b8ed-876c2c7c8e2e", + "layerType": "data", + "legendDisplay": "default", + "nestedLegend": false, + "numberDisplay": "percent", + "legendSize": "auto", + "primaryGroups": [ + "6b9235d9-4048-44b1-8285-d0867607799f" + ], + "metrics": [ + "c006439b-bdfe-4054-972e-699fb00277d2" + ] + } + ], + "palette": { + "name": "temperature", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Top WAF URL Domains [Azure Frontdoor]", + "visualizationType": "lnsPie", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-de5a74b1-0388-497f-b8ed-876c2c7c8e2e", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 12, + "i": "0c6e0763-18cd-4360-aede-b92d09e7a2c6", + "w": 13, + "x": 35, + "y": 30 }, - { - "id": "azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f", - "name": "0c6e0763-18cd-4360-aede-b92d09e7a2c6:panel_0c6e0763-18cd-4360-aede-b92d09e7a2c6", - "type": "lens" + "panelIndex": "0c6e0763-18cd-4360-aede-b92d09e7a2c6", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "15580362-caea-4ea9-85ba-7583ab86c799": { + "columnOrder": [ + "d6ceac1c-38fa-4025-a94a-f6f2001ff848", + "61b5338d-8241-4b3b-8e82-193b301068ca" + ], + "columns": { + "61b5338d-8241-4b3b-8e82-193b301068ca": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "d6ceac1c-38fa-4025-a94a-f6f2001ff848": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of event.action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "61b5338d-8241-4b3b-8e82-193b301068ca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "15580362-caea-4ea9-85ba-7583ab86c799", + "layerType": "data", + "legendDisplay": "default", + "nestedLegend": false, + "numberDisplay": "percent", + "legendSize": "auto", + "primaryGroups": [ + "d6ceac1c-38fa-4025-a94a-f6f2001ff848" + ], + "metrics": [ + "61b5338d-8241-4b3b-8e82-193b301068ca" + ] + } + ], + "palette": { + "name": "status", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "WAF Event Actions [Azure Frontdoor]", + "visualizationType": "lnsPie", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-15580362-caea-4ea9-85ba-7583ab86c799", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 15, + "i": "a7777948-86d7-42e0-9463-032b402385f9", + "w": 24, + "x": 0, + "y": 42 }, - { - "id": "azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f", - "name": "a7777948-86d7-42e0-9463-032b402385f9:panel_a7777948-86d7-42e0-9463-032b402385f9", - "type": "lens" + "panelIndex": "a7777948-86d7-42e0-9463-032b402385f9", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "bcd2b4e0-0ffe-4901-9588-9687fc86a3f9": { + "columnOrder": [ + "423ae552-3c4e-49db-87b6-eb5802c317c3", + "97038146-0485-4c93-ad56-e815957ef6a0" + ], + "columns": { + "423ae552-3c4e-49db-87b6-eb5802c317c3": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of rule.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "97038146-0485-4c93-ad56-e815957ef6a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "rule.name" + }, + "97038146-0485-4c93-ad56-e815957ef6a0": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "423ae552-3c4e-49db-87b6-eb5802c317c3" + }, + { + "columnId": "97038146-0485-4c93-ad56-e815957ef6a0" + } + ], + "layerId": "bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "Top WAF Rule Names [Azure Frontdoor]", + "visualizationType": "lnsDatatable", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", + "type": "index-pattern" + } + ] + } + } + }, + { + "version": "8.6.0", + "type": "lens", + "gridData": { + "h": 15, + "i": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", + "w": 24, + "x": 24, + "y": 42 }, - { - "id": "azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f", - "name": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f:panel_aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", - "type": "lens" + "panelIndex": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f", + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "b136b727-78fc-4467-ae19-7284f19d1e8e": { + "columnOrder": [ + "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac", + "9de17676-7ef0-4ff8-a6a1-52df55f74b6f" + ], + "columns": { + "9de17676-7ef0-4ff8-a6a1-52df55f74b6f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of azure.frontdoor.waf.details.msg", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "9de17676-7ef0-4ff8-a6a1-52df55f74b6f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10, + "parentFormat": { + "id": "terms" + } + }, + "scale": "ordinal", + "sourceField": "azure.frontdoor.waf.details.msg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac" + }, + { + "columnId": "9de17676-7ef0-4ff8-a6a1-52df55f74b6f" + } + ], + "layerId": "b136b727-78fc-4467-ae19-7284f19d1e8e", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "Top WAF Detail Msg [Azure Frontdoor]", + "visualizationType": "lnsDatatable", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b136b727-78fc-4467-ae19-7284f19d1e8e", + "type": "index-pattern" + } + ] + } } + } ], - "type": "dashboard" + "timeRestore": false, + "title": "[Azure Frontdoor] Overview", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "type": "index-pattern", + "name": "f8012579-e741-44fc-9470-5348fa7a6821:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "f8012579-e741-44fc-9470-5348fa7a6821:indexpattern-datasource-layer-266caf24-daea-453b-a081-b81a3a1a5d34", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "a318c8ca-32a6-4115-81c2-7448d02f30c1:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "a318c8ca-32a6-4115-81c2-7448d02f30c1:indexpattern-datasource-layer-0ee62278-341b-4d9d-8f65-44eef424786b", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "75629f82-636f-47f7-8080-b18e3e32fecf:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "75629f82-636f-47f7-8080-b18e3e32fecf:indexpattern-datasource-layer-dbf953f9-caf7-4403-aef3-0f888754526d", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "9d7f41e2-4835-49cd-97a8-3996b3803587:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "9d7f41e2-4835-49cd-97a8-3996b3803587:indexpattern-datasource-layer-b107299d-3122-4b2f-88c9-85b3e414217d", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "a66e658f-88dd-4098-bc14-52775b5b32b5:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "a66e658f-88dd-4098-bc14-52775b5b32b5:indexpattern-datasource-layer-d889492f-07a3-4ec6-9334-7299e029d385", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "408c25ae-832a-498f-88b1-c677a516195c:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "408c25ae-832a-498f-88b1-c677a516195c:indexpattern-datasource-layer-63bfc868-ae64-40f3-b7e1-62e2150f7704", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "95cf95ae-16c3-4787-a9ea-a401f6a0246f:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "95cf95ae-16c3-4787-a9ea-a401f6a0246f:indexpattern-datasource-layer-de5a74b1-0388-497f-b8ed-876c2c7c8e2e", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "0c6e0763-18cd-4360-aede-b92d09e7a2c6:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "0c6e0763-18cd-4360-aede-b92d09e7a2c6:indexpattern-datasource-layer-15580362-caea-4ea9-85ba-7583ab86c799", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "a7777948-86d7-42e0-9463-032b402385f9:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "a7777948-86d7-42e0-9463-032b402385f9:indexpattern-datasource-layer-bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "aa73e953-7e0a-4f4b-a069-fe1cedd2c53f:indexpattern-datasource-layer-b136b727-78fc-4467-ae19-7284f19d1e8e", + "id": "logs-*" + } + ], + "migrationVersion": { + "dashboard": "8.6.0" + }, + "coreMigrationVersion": "8.6.0" } \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json deleted file mode 100644 index 350ef054fa5..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "63bfc868-ae64-40f3-b7e1-62e2150f7704": { - "columnOrder": [ - "f629af01-d102-4903-9bbb-c7e80e525905", - "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631", - "23695d1c-b544-4e27-9205-100f67392609" - ], - "columns": { - "23695d1c-b544-4e27-9205-100f67392609": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of user_agent.os.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "23695d1c-b544-4e27-9205-100f67392609", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "user_agent.os.name" - }, - "f629af01-d102-4903-9bbb-c7e80e525905": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of user_agent.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "23695d1c-b544-4e27-9205-100f67392609", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "user_agent.name" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "f629af01-d102-4903-9bbb-c7e80e525905", - "e1217af1-5b7b-4a1e-8b23-c2cca6cf8631" - ], - "layerId": "63bfc868-ae64-40f3-b7e1-62e2150f7704", - "layerType": "data", - "legendDisplay": "default", - "metric": "23695d1c-b544-4e27-9205-100f67392609", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "palette": { - "name": "status", - "type": "palette" - }, - "shape": "donut" - } - }, - "title": "User Agents Names and OS Names [Azure Frontdoor]", - "visualizationType": "lnsPie" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-03737aa0-6ead-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-63bfc868-ae64-40f3-b7e1-62e2150f7704", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json deleted file mode 100644 index b5d94293eff..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,94 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "b107299d-3122-4b2f-88c9-85b3e414217d": { - "columnOrder": [ - "f751542b-d8b3-486a-931c-545670d98874", - "a392968c-6481-4eba-8752-46420557d21f" - ], - "columns": { - "a392968c-6481-4eba-8752-46420557d21f": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "f751542b-d8b3-486a-931c-545670d98874": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of source.geo.country_name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a392968c-6481-4eba-8752-46420557d21f", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.geo.country_name" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "f751542b-d8b3-486a-931c-545670d98874" - ], - "layerId": "b107299d-3122-4b2f-88c9-85b3e414217d", - "layerType": "data", - "legendDisplay": "default", - "metric": "a392968c-6481-4eba-8752-46420557d21f", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "shape": "donut" - } - }, - "title": "Top Country Names [Azure Frontdoor]", - "visualizationType": "lnsPie" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-1870ee80-6eab-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-b107299d-3122-4b2f-88c9-85b3e414217d", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json deleted file mode 100644 index 67d2e9b4d74..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "d889492f-07a3-4ec6-9334-7299e029d385": { - "columnOrder": [ - "08f47d60-115d-40f0-b9fd-9bf1385c766b", - "77477f59-4dba-4ec0-ada1-093ffc78374d" - ], - "columns": { - "08f47d60-115d-40f0-b9fd-9bf1385c766b": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of url.original", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "77477f59-4dba-4ec0-ada1-093ffc78374d", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 20 - }, - "scale": "ordinal", - "sourceField": "url.original" - }, - "77477f59-4dba-4ec0-ada1-093ffc78374d": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "08f47d60-115d-40f0-b9fd-9bf1385c766b" - }, - { - "columnId": "77477f59-4dba-4ec0-ada1-093ffc78374d" - } - ], - "layerId": "d889492f-07a3-4ec6-9334-7299e029d385", - "layerType": "data" - } - }, - "title": "Top URLs [Azure Frontdoor]", - "visualizationType": "lnsDatatable" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-594f3970-6eab-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-d889492f-07a3-4ec6-9334-7299e029d385", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json deleted file mode 100644 index 0024a6326f3..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "bcd2b4e0-0ffe-4901-9588-9687fc86a3f9": { - "columnOrder": [ - "423ae552-3c4e-49db-87b6-eb5802c317c3", - "97038146-0485-4c93-ad56-e815957ef6a0" - ], - "columns": { - "423ae552-3c4e-49db-87b6-eb5802c317c3": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of rule.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "97038146-0485-4c93-ad56-e815957ef6a0", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "rule.name" - }, - "97038146-0485-4c93-ad56-e815957ef6a0": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "423ae552-3c4e-49db-87b6-eb5802c317c3" - }, - { - "columnId": "97038146-0485-4c93-ad56-e815957ef6a0" - } - ], - "layerId": "bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", - "layerType": "data" - } - }, - "title": "Top WAF Rule Names [Azure Frontdoor]", - "visualizationType": "lnsDatatable" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-63822080-6eae-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-bcd2b4e0-0ffe-4901-9588-9687fc86a3f9", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json deleted file mode 100644 index aaa706d8a81..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,134 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "266caf24-daea-453b-a081-b81a3a1a5d34": { - "columnOrder": [ - "db61d40a-769c-47ad-b7ae-6384624df2ea", - "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b", - "ee54a93c-ed19-4e1b-84ff-52144faec318" - ], - "columns": { - "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "db61d40a-769c-47ad-b7ae-6384624df2ea": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of data_stream.dataset", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "ee54a93c-ed19-4e1b-84ff-52144faec318", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "data_stream.dataset" - }, - "ee54a93c-ed19-4e1b-84ff-52144faec318": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "ee54a93c-ed19-4e1b-84ff-52144faec318" - ], - "layerId": "266caf24-daea-453b-a081-b81a3a1a5d34", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "db61d40a-769c-47ad-b7ae-6384624df2ea", - "xAccessor": "a6dfa33a-652d-4d16-b4ea-709a9bf51a2b" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } - } - }, - "title": "Logs Over Time [Azure Frontdoor]", - "visualizationType": "lnsXY" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-76cd1bb0-6ea7-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-266caf24-daea-453b-a081-b81a3a1a5d34", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json deleted file mode 100644 index f7eb3a171ad..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "b136b727-78fc-4467-ae19-7284f19d1e8e": { - "columnOrder": [ - "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac", - "9de17676-7ef0-4ff8-a6a1-52df55f74b6f" - ], - "columns": { - "9de17676-7ef0-4ff8-a6a1-52df55f74b6f": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of azure.frontdoor.waf.details.msg", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "9de17676-7ef0-4ff8-a6a1-52df55f74b6f", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "azure.frontdoor.waf.details.msg" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "c0164b02-0ae2-4c90-b5b8-9b2da03aa6ac" - }, - { - "columnId": "9de17676-7ef0-4ff8-a6a1-52df55f74b6f" - } - ], - "layerId": "b136b727-78fc-4467-ae19-7284f19d1e8e", - "layerType": "data" - } - }, - "title": "Top WAF Detail Msg [Azure Frontdoor]", - "visualizationType": "lnsDatatable" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-8139b390-6eae-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-b136b727-78fc-4467-ae19-7284f19d1e8e", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json deleted file mode 100644 index 42a5abb723f..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,134 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "0ee62278-341b-4d9d-8f65-44eef424786b": { - "columnOrder": [ - "823d0215-ee4e-4572-8a2a-e39893ece10d", - "74ecbafb-fb61-4678-820e-e0cd221307f4", - "f14be824-7dc6-4399-8491-5777389b1f1c" - ], - "columns": { - "74ecbafb-fb61-4678-820e-e0cd221307f4": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "823d0215-ee4e-4572-8a2a-e39893ece10d": { - "dataType": "ip", - "isBucketed": true, - "label": "Top values of client.ip", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "f14be824-7dc6-4399-8491-5777389b1f1c", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "client.ip" - }, - "f14be824-7dc6-4399-8491-5777389b1f1c": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "f14be824-7dc6-4399-8491-5777389b1f1c" - ], - "layerId": "0ee62278-341b-4d9d-8f65-44eef424786b", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "823d0215-ee4e-4572-8a2a-e39893ece10d", - "xAccessor": "74ecbafb-fb61-4678-820e-e0cd221307f4" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } - } - }, - "title": "Top Client IP Trending Graph [Azure Frontdoor]", - "visualizationType": "lnsXY" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-85519480-6ea8-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-0ee62278-341b-4d9d-8f65-44eef424786b", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json deleted file mode 100644 index d6c46ff71c4..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "dbf953f9-caf7-4403-aef3-0f888754526d": { - "columnOrder": [ - "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9", - "79b721f5-7a2e-4c74-9c8b-062b9b4d98db" - ], - "columns": { - "79b721f5-7a2e-4c74-9c8b-062b9b4d98db": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9": { - "dataType": "ip", - "isBucketed": true, - "label": "Top values of client.ip", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "79b721f5-7a2e-4c74-9c8b-062b9b4d98db", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "client.ip" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "7e7bf19e-0b03-49aa-b194-3ea5dc67f4c9" - }, - { - "columnId": "79b721f5-7a2e-4c74-9c8b-062b9b4d98db" - } - ], - "layerId": "dbf953f9-caf7-4403-aef3-0f888754526d", - "layerType": "data" - } - }, - "title": "Top Client IPs [Azure Frontdoor]", - "visualizationType": "lnsDatatable" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-c3757a60-6ea8-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-dbf953f9-caf7-4403-aef3-0f888754526d", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json deleted file mode 100644 index a9fd37be868..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,94 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "15580362-caea-4ea9-85ba-7583ab86c799": { - "columnOrder": [ - "d6ceac1c-38fa-4025-a94a-f6f2001ff848", - "61b5338d-8241-4b3b-8e82-193b301068ca" - ], - "columns": { - "61b5338d-8241-4b3b-8e82-193b301068ca": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "d6ceac1c-38fa-4025-a94a-f6f2001ff848": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of event.action", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "61b5338d-8241-4b3b-8e82-193b301068ca", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.action" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "d6ceac1c-38fa-4025-a94a-f6f2001ff848" - ], - "layerId": "15580362-caea-4ea9-85ba-7583ab86c799", - "layerType": "data", - "legendDisplay": "default", - "metric": "61b5338d-8241-4b3b-8e82-193b301068ca", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "palette": { - "name": "status", - "type": "palette" - }, - "shape": "pie" - } - }, - "title": "WAF Event Actions [Azure Frontdoor]", - "visualizationType": "lnsPie" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-dcef2360-6ead-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-15580362-caea-4ea9-85ba-7583ab86c799", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file diff --git a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json b/packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json deleted file mode 100644 index 59ca4fa8aa7..00000000000 --- a/packages/azure_frontdoor/kibana/lens/azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f.json +++ /dev/null @@ -1,94 +0,0 @@ -{ - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "de5a74b1-0388-497f-b8ed-876c2c7c8e2e": { - "columnOrder": [ - "6b9235d9-4048-44b1-8285-d0867607799f", - "c006439b-bdfe-4054-972e-699fb00277d2" - ], - "columns": { - "6b9235d9-4048-44b1-8285-d0867607799f": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of url.domain", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "c006439b-bdfe-4054-972e-699fb00277d2", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "url.domain" - }, - "c006439b-bdfe-4054-972e-699fb00277d2": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "6b9235d9-4048-44b1-8285-d0867607799f" - ], - "layerId": "de5a74b1-0388-497f-b8ed-876c2c7c8e2e", - "layerType": "data", - "legendDisplay": "default", - "metric": "c006439b-bdfe-4054-972e-699fb00277d2", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "palette": { - "name": "temperature", - "type": "palette" - }, - "shape": "donut" - } - }, - "title": "Top WAF URL Domains [Azure Frontdoor]", - "visualizationType": "lnsPie" - }, - "coreMigrationVersion": "7.16.0", - "id": "azure_frontdoor-fdd991c0-6eab-11ec-bf35-712f9048d91f", - "migrationVersion": { - "lens": "7.16.0" - }, - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-de5a74b1-0388-497f-b8ed-876c2c7c8e2e", - "type": "index-pattern" - } - ], - "type": "lens" -} \ No newline at end of file From e17d9c8631cb715e3b1c633862119c4b6b5995ed Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 15:57:10 +0530 Subject: [PATCH 22/25] update owner in manifest --- packages/azure_frontdoor/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index 4e9966c1245..8bf15e79a84 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -73,4 +73,4 @@ policy_templates: required: false show_user: true owner: - github: elastic/integrations + github: elastic/security-external-integrations From 9ea2e5669c21b844b39bbc71e8bc2fcee544e0fe Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 16:23:06 +0530 Subject: [PATCH 23/25] update stack version --- packages/azure_frontdoor/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index 8bf15e79a84..2b6c1df43f3 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -12,7 +12,7 @@ categories: - web release: beta conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana.version: "^8.6.0" screenshots: - src: /img/azure-frontdoor-overview.png title: Azure Frontdoor Overview From cf3cd7d80610f31f914bd8c5a007b7294b427879 Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 17:18:38 +0530 Subject: [PATCH 24/25] update ecs version --- .../access/elasticsearch/ingest_pipeline/default.yml | 2 +- .../data_stream/waf/elasticsearch/ingest_pipeline/default.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 7ce34c67e5d..3b2a63bea27 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing azure frontdoor access logs processors: - set: field: ecs.version - value: "8.5.0" + value: "8.6.0" - set: field: event.category value: [network] diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index d84eb752a1a..827f908bfd8 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing azure frontdoor waf logs processors: - set: field: ecs.version - value: "8.5.0" + value: "8.6.0" - set: field: event.category value: [network] From ae0c72ab662bf85f64d98e5c4c59d1103caea66e Mon Sep 17 00:00:00 2001 From: kcreddy Date: Thu, 2 Feb 2023 17:25:22 +0530 Subject: [PATCH 25/25] remove filestream input,remove syst tests,mark exp --- packages/azure_frontdoor/changelog.yml | 2 +- .../_dev/deploy/docker/docker-compose.yml | 8 ----- .../deploy/docker/sample_logs/fdaccess.log | 2 -- .../pipeline/test-fdaccess.log-expected.json | 6 ++-- .../_dev/test/system/test-default-config.yml | 7 ---- .../access/agent/stream/stream.yml.hbs | 19 ---------- .../data_stream/access/fields/fields.yml | 2 +- .../data_stream/access/manifest.yml | 35 ------------------ .../waf/_dev/deploy/docker/docker-compose.yml | 8 ----- .../_dev/deploy/docker/sample_logs/fdwaf.log | 2 -- .../pipeline/test-fdwaf.log-expected.json | 4 +-- .../_dev/test/system/test-default-config.yml | 7 ---- .../waf/agent/stream/stream.yml.hbs | 11 ------ .../data_stream/waf/fields/fields.yml | 2 +- .../data_stream/waf/manifest.yml | 36 ------------------- packages/azure_frontdoor/docs/README.md | 4 +-- packages/azure_frontdoor/manifest.yml | 7 ++-- 17 files changed, 12 insertions(+), 150 deletions(-) delete mode 100644 packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml delete mode 100644 packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log delete mode 100644 packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml delete mode 100644 packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs delete mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml delete mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log delete mode 100644 packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml delete mode 100644 packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs diff --git a/packages/azure_frontdoor/changelog.yml b/packages/azure_frontdoor/changelog.yml index a5fffb80249..1dd4bbcbdcc 100644 --- a/packages/azure_frontdoor/changelog.yml +++ b/packages/azure_frontdoor/changelog.yml @@ -1,5 +1,5 @@ # newer versions go on top -- version: "0.1.0" +- version: "0.0.1" changes: - description: Initial draft of the package type: enhancement diff --git a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml deleted file mode 100644 index 83a67af3043..00000000000 --- a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,8 +0,0 @@ -version: "2.3" -services: - fdaccess-log: - image: alpine - volumes: - - ./sample_logs:/sample_logs:ro - - ${SERVICE_LOGS_DIR}:/var/log - command: /bin/sh -c "cp /sample_logs/* /var/log/" diff --git a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log b/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log deleted file mode 100644 index 43f4d180d3b..00000000000 --- a/packages/azure_frontdoor/data_stream/access/_dev/deploy/docker/sample_logs/fdaccess.log +++ /dev/null @@ -1,2 +0,0 @@ -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.603","timeToFirstByte":"3.603","trackingReference":"00mK5YQAAAADK3xUiPx4/T51HuDizj0XAU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:36:54.0059097Z"} -{"category":"FrontdoorAccessLog","operationName":"Microsoft.Network/FrontDoor/AccessLog/Write","properties":{"ErrorInfo":"NoError","backendHostname":"samplev6erp.azurewebsites.net:443","cacheStatus":"CONFIG_NOCACHE","clientIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","clientPort":"65238","httpMethod":"POST","httpStatusCode":"200","httpStatusDetails":"200","httpVersion":"2.0.0.0","isReceivedFromClient":true,"pop":"SGE","requestBytes":"3081","requestProtocol":"HTTPS","requestUri":"https://erp.testcloud.com:443/Dashboard/getTopStockList","responseBytes":"3191","routingRuleName":"erp","rulesEngineMatchNames":[],"securityProtocol":"TLS 1.2","socketIp":"2400:ac40:60b:7aeb:418d:7c32:ac90:e100","timeTaken":"3.542","timeToFirstByte":"3.542","trackingReference":"00mK5YQAAAABiYkksxXO5SqADULPyu7WxU0dFRURHRTA5MjAAZGIyMTEzMjYtZmUyZi00MGFmLTkwODMtNzBlMmEyZmFkZmY3","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36"},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-15T03:36:54.0036459Z"} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json index df69cb55dbd..9bbc286649d 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -30,7 +30,7 @@ "provider": "azure" }, "ecs": { - "version": "8.5.0" + "version": "8.6.0" }, "event": { "category": [ @@ -129,7 +129,7 @@ "provider": "azure" }, "ecs": { - "version": "8.5.0" + "version": "8.6.0" }, "event": { "category": [ @@ -222,7 +222,7 @@ "provider": "azure" }, "ecs": { - "version": "8.5.0" + "version": "8.6.0" }, "event": { "category": [ diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml deleted file mode 100644 index 6a05159694e..00000000000 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/system/test-default-config.yml +++ /dev/null @@ -1,7 +0,0 @@ -service: fdaccess-log -vars: ~ -input: filestream -data_stream: - vars: - paths: - - "{{SERVICE_LOGS_DIR}}/fdaccess.log" diff --git a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs deleted file mode 100644 index d0bec8af049..00000000000 --- a/packages/azure_frontdoor/data_stream/access/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -paths: -{{#each paths as |path|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} \ No newline at end of file diff --git a/packages/azure_frontdoor/data_stream/access/fields/fields.yml b/packages/azure_frontdoor/data_stream/access/fields/fields.yml index 95f710f451c..60a2155dbbe 100644 --- a/packages/azure_frontdoor/data_stream/access/fields/fields.yml +++ b/packages/azure_frontdoor/data_stream/access/fields/fields.yml @@ -6,7 +6,7 @@ description: Azure Resource ID. - name: category type: keyword - description: Azue frontdoor category name. + description: Azure frontdoor category name. - name: operation_name type: keyword description: Azure operation name. diff --git a/packages/azure_frontdoor/data_stream/access/manifest.yml b/packages/azure_frontdoor/data_stream/access/manifest.yml index d5859332540..e08d08915a6 100644 --- a/packages/azure_frontdoor/data_stream/access/manifest.yml +++ b/packages/azure_frontdoor/data_stream/access/manifest.yml @@ -1,41 +1,6 @@ title: "FrontDoor Access" type: logs streams: - - input: filestream - title: Azure Frontdoor Access logs - description: Collect frontdoor access logs - vars: - - name: paths - type: text - title: Paths - multi: true - default: - - /var/log/*.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - azure-frontdoor-access - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - input: "azure-eventhub" template_path: "azure-eventhub.yml.hbs" title: "Azure Frontdoor Access logs" diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml deleted file mode 100644 index 47d8f89392c..00000000000 --- a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/docker-compose.yml +++ /dev/null @@ -1,8 +0,0 @@ -version: "2.3" -services: - fdwaf-log: - image: alpine - volumes: - - ./sample_logs:/sample_logs:ro - - ${SERVICE_LOGS_DIR}:/var/log - command: /bin/sh -c "cp /sample_logs/* /var/log/" diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log b/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log deleted file mode 100644 index 3f37a613033..00000000000 --- a/packages/azure_frontdoor/data_stream/waf/_dev/deploy/docker/sample_logs/fdwaf.log +++ /dev/null @@ -1,2 +0,0 @@ -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Log","clientIP":"8.38.147.74","clientPort":"56094","details":{"matches":[]},"host":"connect.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://connect.testcloud.com:443/connect_v2/module001/serviceAttendance/checkvalidUser1","ruleName":"AllowMyanmar","socketIP":"8.38.147.74","trackingReference":"09tTJYQAAAAAV8VyBP8m1Qo+8A3qdd2DuU0lOMzBFREdFMDIxOABkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T15:00:06.6330668Z"} -{"category":"FrontdoorWebApplicationFirewallLog","operationName":"Microsoft.Network/FrontDoor/WebApplicationFirewallLog/Write","properties":{"action":"Block","clientIP":"122.248.108.128","clientPort":"59781","details":{"data":"Matched Data: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\" found within CookieValue:w_db_ibp: {\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\"","matches":[{"matchVariableName":"CookieValue:w_db_ibp","matchVariableValue":"{\"selectPeriod\":\"0000\",\"fromDate\":\"20210701\",\"toDate\":\"20211231\",\"checkDate\":\"20211226\",\"ccSyskey\":\""},{"matchVariableName":"CookieValue:w_solist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"},{"matchVariableName":"CookieValue:w_pilist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRef\":\"\",\"status\":\"0\",\"venCodeOpt\":\"c\",\"venCode\":\"\",\"venNameOpt\":\"c\","},{"matchVariableName":"CookieValue:w_ah_ibp","matchVariableValue":"{\"selectedAccCat\":0,\"showTrial\":false,\"showAmt\":false,\"isCc\":false,\"isDept\":false,\"ccSyskey\":\"-1\",\"d"},{"matchVariableName":"CookieValue:w_silist_ibp","matchVariableValue":"{\"refNo\":\"\",\"secRefNo\":\"\",\"crossRefNo\":\"\",\"custCodeOpt\":\"c\",\"custCode\":\"\",\"custNameOpt\":\"c\",\"custNam"}],"msg":"Detects classic SQL injection probings 1/3"},"host":"erp.testcloud.com","policy":"waf2","policyMode":"detection","requestUri":"https://erp.testcloud.com:443/accountcategory/getAccountCategory","ruleName":"DefaultRuleSet-1.0-SQLI-942330","socketIP":"122.248.108.128","trackingReference":"0vePJYQAAAAB9WgG3hg2gTY6gNVGplMGWS1VMMzBFREdFMTAxNgBkYjIxMTMyNi1mZTJmLTQwYWYtOTA4My03MGUyYTJmYWRmZjc="},"resourceId":"/SUBSCRIPTIONS/49D1B571-1CBE-402D-B523-AFEE3C19B64E/RESOURCEGROUPS/WAF-RG/PROVIDERS/MICROSOFT.NETWORK/FRONTDOORS/TESTCLOUD","time":"2021-12-27T16:03:09.8128356Z"} diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json index e800c2f5c81..c73cb83db27 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -24,7 +24,7 @@ "provider": "azure" }, "ecs": { - "version": "8.5.0" + "version": "8.6.0" }, "event": { "action": "Log", @@ -91,7 +91,7 @@ "provider": "azure" }, "ecs": { - "version": "8.5.0" + "version": "8.6.0" }, "event": { "action": "Block", diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml b/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml deleted file mode 100644 index 1118b7c9a54..00000000000 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/system/test-default-config.yml +++ /dev/null @@ -1,7 +0,0 @@ -service: fdwaf-log -vars: ~ -input: filestream -data_stream: - vars: - paths: - - "{{SERVICE_LOGS_DIR}}/fdwaf.log" diff --git a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs b/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs deleted file mode 100644 index 0afb0da83e7..00000000000 --- a/packages/azure_frontdoor/data_stream/waf/agent/stream/stream.yml.hbs +++ /dev/null @@ -1,11 +0,0 @@ -paths: -{{#each paths as |path|}} - - {{path}} -{{/each}} -exclude_files: [".gz$"] -tags: -{{#each tags as |tag|}} -- {{tag}} -{{/each}} -processors: - - add_locale: ~ diff --git a/packages/azure_frontdoor/data_stream/waf/fields/fields.yml b/packages/azure_frontdoor/data_stream/waf/fields/fields.yml index 84c4fbc77c1..f6cefe4fbaf 100644 --- a/packages/azure_frontdoor/data_stream/waf/fields/fields.yml +++ b/packages/azure_frontdoor/data_stream/waf/fields/fields.yml @@ -6,7 +6,7 @@ description: Azure Resource ID. - name: category type: keyword - description: Azue frontdoor category name. + description: Azure frontdoor category name. - name: operation_name type: keyword description: Azure operation name. diff --git a/packages/azure_frontdoor/data_stream/waf/manifest.yml b/packages/azure_frontdoor/data_stream/waf/manifest.yml index f5ff930e9c8..ac12feec83a 100644 --- a/packages/azure_frontdoor/data_stream/waf/manifest.yml +++ b/packages/azure_frontdoor/data_stream/waf/manifest.yml @@ -1,42 +1,6 @@ title: "FrontDoor WAF" type: logs streams: - - input: filestream - template_path: stream.yml.hbs - title: Azure Frontdoor WAF logs - description: Collect frontdoor waf logs - vars: - - name: paths - type: text - title: Paths - multi: true - default: - - /var/log/*.log - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - azure-frontdoor-waf - - forwarded - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - input: "azure-eventhub" template_path: "azure-eventhub.yml.hbs" title: "Azure Frontdoor WAF logs" diff --git a/packages/azure_frontdoor/docs/README.md b/packages/azure_frontdoor/docs/README.md index 90bf7f711b8..3e1c84cc016 100644 --- a/packages/azure_frontdoor/docs/README.md +++ b/packages/azure_frontdoor/docs/README.md @@ -69,7 +69,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | azure.frontdoor.access.time | The date and time when the AFD edge delivered requested contents to client (in UTC). | keyword | | azure.frontdoor.access.time_taken | The length of time from the time AFD edge server receives a client's request to the time that AFD sends the last byte of response to client, in milliseconds. This field doesn't take into account network latency and TCP buffering. | keyword | | azure.frontdoor.access.time_to_first_byte | The length of time in milliseconds from AFD receives the request to the time the first byte gets sent to client, as measured on Azure Front Door. This property doesn't measure the client data. | keyword | -| azure.frontdoor.category | Azue frontdoor category name. | keyword | +| azure.frontdoor.category | Azure frontdoor category name. | keyword | | azure.frontdoor.operation_name | Azure operation name. | keyword | | azure.frontdoor.resource_id | Azure Resource ID. | keyword | | azure.frontdoor.tracking_reference | The unique reference string that identifies a request served by AFD, also sent as X-Azure-Ref header to the client. Required for searching details in the access logs for a specific request. | keyword | @@ -196,7 +196,7 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | Field | Description | Type | |---|---|---| | @timestamp | Event timestamp. | date | -| azure.frontdoor.category | Azue frontdoor category name. | keyword | +| azure.frontdoor.category | Azure frontdoor category name. | keyword | | azure.frontdoor.operation_name | Azure operation name. | keyword | | azure.frontdoor.resource_id | Azure Resource ID. | keyword | | azure.frontdoor.tracking_reference | The unique reference string that identifies a request served by AFD, also sent as X-Azure-Ref header to the client. Required for searching details in the access logs for a specific request. | keyword | diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index 2b6c1df43f3..af6f4a90481 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: azure_frontdoor title: "Azure Frontdoor" -version: 0.1.0 +version: 0.0.1 license: basic description: "This Elastic integration collects logs from Azure Frontdoor." type: integration @@ -10,7 +10,7 @@ categories: - network - security - web -release: beta +release: experimental conditions: kibana.version: "^8.6.0" screenshots: @@ -28,9 +28,6 @@ policy_templates: title: Azure Frontdoor logs description: Collect sample logs inputs: - - type: filestream - title: Collect azure frontdoor logs from log file. - description: "Collecting azure frontdoor logs (input: filestream)." - type: "azure-eventhub" title: "Collect azure frontdoor events from Event Hub" description: "Collecting azure frontdooor events from Azure eventhub inputs (input: azure-eventhub)."